@sema-agent/core 7.5.2 → 7.6.1

package/dist/core/runner/gate-exit.d.ts

@@ -0,0 +1,242 @@
+/**
+ * The tool gate's RECORD FLOOR — everything about how one gate pass is recorded and how it ends:
+ *
+ *  - the ONE mint of a {@link GateOutcome} ({@link mintGateOutcome}) — the record of what a tool-gate pass
+ *    decided, what ask it settled and who asked. The gate accumulates two facts on its way to an exit (WHO
+ *    refused, written once at the refusing site; WHAT was settled, written at the resolution site) and hands
+ *    them here; the mint assembles the record, runs the invariant screen, and refuses a record the engine
+ *    composed wrong. Every projection of the outcome (the deny observer's payload, the call's `tool_end`
+ *    frame, the engine's per-call sideband) is the object minted here, never a re-derivation;
+ *  - the settlement LEDGER of a pass ({@link createSettlementLedger}) — the one rule every attestation read
+ *    goes through;
+ *  - the PASS RECORD ({@link GatePass}) — the per-call cells the gate's station groups read and write, and
+ *    the hook-machinery seats they borrow, built once per call by `runToolGate` and handed to every station;
+ *  - the EXITS — the two phase-1 short-circuits ({@link engineFailClosedExit}, {@link hookDenyExit}) and the
+ *    single deny / allow exit of the adjudicate chain ({@link exitGate}), the only places a pass turns into a
+ *    `ToolGateResult`; plus the two observer-facing helpers every exit uses (the payload isolation clone and
+ *    the deployment-lane crash report).
+ *
+ * A floor module (layer 0 of the prepare/run path): the two station modules (`gate-fold.ts`, `gate-lanes.ts`)
+ * and the gate's dispatch in `hooks.ts` all reach DOWN for it, and it reaches down only for the vocabulary,
+ * the reminder envelope and the text helpers. Its `import type` edges up to `hooks.ts` name the gate's public
+ * contract (`ToolGateInput`, `ToolGateResult`, the observer payload), which stays declared there.
+ */
+import { type DeniedBy, type GateOutcome, type Settlement } from "../gate-outcome.js";
+import type { AskOrigin, AskOriginFacts } from "../ask-origin.js";
+import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
+import type { SafeNotifier } from "../safe-notify.js";
+import type { HookSeatOutcome, PermissionDeniedPayload, PreToolUseResult, ToolGateInput, ToolGateResult } from "../hooks.js";
+/** The ask a gate pass settled, as the gate captured it at its resolution site: the settlement the
+ *  resolver composed and the origin word the ask carried. Both or neither (invariant I1). */
+export interface SettledAsk {
+    settlement: Settlement;
+    origin: AskOrigin;
+}
+/** The facts a gate pass hands the mint. `deniedBy` is present exactly when the pass refused; `settled`
+ *  exactly when the pass consumed an ask's settlement (a person's yes that was later vetoed included). */
+export interface GateExitFacts {
+    deniedBy?: DeniedBy;
+    settled?: SettledAsk;
+}
+/**
+ * Mint the outcome. A defect here is an ENGINE defect (a refusing site that did not say who refused, a
+ * settlement without its origin, a person's yes beside a non-veto layer's deny) and throws: the gate's
+ * own composition is not a caller input, so there is no fail-closed "deny" to fall back to that would be
+ * more honest than the fault.
+ */
+export declare function mintGateOutcome(facts: GateExitFacts): GateOutcome;
+/** A direct refusal by one layer, with no ask settled — the five short-circuit exits (a hook that threw or
+ *  never answered, the hook's own deny, the compliance lock, the plan-mode block). */
+export declare function directDeny(deniedBy: Exclude<DeniedBy, "ask_resolution">): GateOutcome;
+/**
+ * The gate's settlement LEDGER for one pass — the one place "which ask did this pass consume" is written,
+ * with ONE rule for every attestation read (the main adjudication, the approval-edit re-check, the gate's
+ * own ask resolutions), so the three sites cannot disagree about what an attested decision means:
+ *  - an engine attestation on a decision object (the approval factory's wait ended inside a policy
+ *    `check()`; an inherited lane resolved an ancestor's ask) is a settled ask of THIS call — read off the
+ *    identity-keyed seat, never off a caller-composable member;
+ *  - a deny carrying a REFUSAL attestation is the ask's own resolution (`ask_resolution`); a deny carrying a
+ *    person's YES is a later layer's VETO (the yes stays on the settlement, the layer is the disposition —
+ *    invariant I3);
+ *  - the LATEST resolution wins (a re-check refusal replaces the first approval; a re-approval renews it);
+ *  - a SURVIVING ask supersedes any settlement read off an earlier decision (a tighten minted a new
+ *    question; whoever resolves it settles it afresh).
+ * For a resolver's object the attestation outranks the exposed member; the member is the fallback for a
+ * resolver seat that composes without attesting (a hand-built resolver; the ask lane's own intercept
+ * deny). TRUST BOUNDARY, stated: `ToolGateInput.resolveAsk` is wired by prepare from the engine's own
+ * resolver — a wrapper that spreads a resolved object (dropping the identity-keyed attestation) and
+ * REPLACES the member is inside the engine's trust line, not a deployment's; making the member
+ * attestation-only is the follow-up that migrates the ask lane's composition and the test resolvers
+ * onto an engine-owned mint.
+ */
+export interface SettlementLedger {
+    /** The ask this pass consumed, or undefined when no ask was settled (a direct deny, a plain allow). */
+    readonly settled: SettledAsk | undefined;
+    /** An engine-composed settlement the gate itself minted (the unshown content ask's refusal). */
+    set(settled: SettledAsk): void;
+    /** Record an ask's resolution: the resolver's settlement beside the ask's own origin word. */
+    fromResolved(resolved: ResolvedAsk, asked: PermissionResult, toolName: string): void;
+    /** Read an adjudication's attestation. For a deny, returns the refusing layer word (`ask_resolution`
+     *  for an attested refusal, `policy` otherwise — a veto when a yes rides the settlement); undefined
+     *  for an allow or an ask. */
+    fromDecision(decision: PermissionResult): DeniedBy | undefined;
+    /** A surviving ask supersedes whatever an earlier decision settled. */
+    supersede(): void;
+}
+export declare function createSettlementLedger(call: {
+    toolCallId: string;
+    toolName: string;
+}): SettlementLedger;
+/**
+ * 1.256 复审 MED-1 — observe-only payload isolation for {@link import("../hooks.js").Hooks.permissionDenied}:
+ * clone the tool args before they ride the observer payload, so a hook mutating `payload.input` can never
+ * pollute the LIVE args object (later events / audit records share it). Same posture as the postToolUseFailure
+ * details clone (the gate-stations phase): `structuredClone` first; a non-structured-cloneable graph
+ * (functions/handles) falls back to a SHALLOW plain object/array copy (top-level mutation isolated);
+ * a non-object primitive passes through as-is (immutable anyway).
+ */
+export declare function cloneObserverInput(input: unknown): unknown;
+/** RB-442: hand the crash itself to the deployment's trace lane (`onError(phase:"hook")`), never letting a
+ *  throwing sink alter the fail-closed outcome — the same swallow posture as every other observer here.
+ *  Shared by the gate's dispatch (the phase-1 crash arm, the seat-bound refusal), the reversibility probe's
+ *  two failure arms and the approved-edit re-screen. */
+export declare function traceHookCrash(input: ToolGateInput, err: unknown, notifier: SafeNotifier): void;
+/**
+ * The PreToolUse screening face as the gate's stations see it — the hook machinery of `runToolGate` (the seat
+ * runner, the per-call seat bound, the fresh per-screening context, the result screen, the two fail-closed
+ * reason texts) behind three methods, so the approved-edit re-screen in the lanes runs the SAME screening the
+ * phase-1 pass ran without the lanes module reaching into the hook machinery. Present on the pass exactly when
+ * a `preToolUse` face is wired.
+ */
+export interface PreToolUseScreening {
+    /** Run the deployment's PreToolUse face over `args` under the seat bound. The answer is the SEAT's, unscreened —
+     *  the caller passes it through {@link PreToolUseScreening.screened} in the seat's own continuation. The seat
+     *  promise is returned as is (no wrapping `async`): what the gate does after the face answers — the policy in
+     *  phase 1, the re-check in the edit chain — runs on the tick the seat settles, as it did when this call was the
+     *  seat runner's own; a wrapper that screened the answer inside a second `async` cost one more tick there. An
+     *  expired seat is reported, not thrown; a crashing face rejects. */
+    screen(args: unknown): Promise<HookSeatOutcome<PreToolUseResult | undefined>>;
+    /** The result screen over an answered seat's value: an out-of-contract decision becomes the ordinary hook deny. */
+    screened(answer: PreToolUseResult | undefined): PreToolUseResult | undefined;
+    /** The model-facing text for a face that THREW while screening `subject`. */
+    crashReason(subject: string, err: unknown): string;
+    /** The model-facing text for a face that never ANSWERED while screening `subject` (the timeout arm also
+     *  reports on the deployment lane; a task-abort expiry does not). */
+    unansweredReason(subject: string, cause: "timeout" | "aborted"): Promise<string>;
+}
+/**
+ * ONE gate pass — the record the station groups (`runGateFold`, `runGateLanes`) and the exits read and write,
+ * built once per call by `runToolGate` before the screening pass. What used to be the closure-captured `let`
+ * cells of a 1 500-line function are its MUTABLE cells (each written by the station named on it, read by the
+ * ones after); what the stations borrow from the hook machinery are its SEATS (fixed for the pass). Ownership
+ * classes follow the phase-Input convention: `borrowed-readonly` = fixed for the pass, the stations only read
+ * it; `borrowed-mutable` = a cell a station writes.
+ */
+export interface GatePass {
+    /** borrowed-readonly — the gate's input: every deployment seat the stations read by name (`egress`,
+     *  `orgRules`, `persistedRules`, `autoMode`, …), and the identity / reminder mark the exits stamp. */
+    readonly input: ToolGateInput;
+    /** borrowed-readonly — the gate's event, read ONCE at entry (the dispatch's entry destructure): the exit compares the
+     *  final args against THIS event's input, never against a re-read of the input record. */
+    readonly event: ToolGateInput["event"];
+    /** borrowed-readonly — the deployment's policy face, captured ONCE at entry before the screening pass. The fold
+     *  adjudicates through it and the edit chain re-adjudicates through the SAME binding: a stateful accessor on the
+     *  input cannot hand the fold one policy and the approved-edit re-check another (or none). */
+    readonly adjudicate: ToolGateInput["adjudicate"];
+    /** borrowed-readonly — the ask resolver, captured ONCE at entry (same rule: the first-round resolution and the edit
+     *  round's re-ask resolve through one binding). */
+    readonly resolveAsk: ToolGateInput["resolveAsk"];
+    /** borrowed-readonly — the durable park closure, captured ONCE at entry (the three park sites hand it the same
+     *  thirteen seats; presence is judged off this one read). */
+    readonly suspendAsk: ToolGateInput["suspendAsk"];
+    /** borrowed-readonly — `input.event.toolName`, read once. */
+    readonly toolName: string;
+    /** borrowed-readonly — `input.event.toolCallId`, read once. */
+    readonly toolCallId: string;
+    /** borrowed-readonly — design/384: ONE read of the per-call signal for the whole gate call (the one-read
+     *  discipline the settlement screen already states): every conditional seat invocation (the three wait
+     *  seats plus the three suspendAsk park sites) judges presence and passes the value from this same cell, so
+     *  a stateful accessor cannot answer the arity check with a signal and the call with something else. */
+    readonly callSignal: AbortSignal | undefined;
+    /** borrowed-readonly — RB-463: the one host-callback isolation scope of this gate call (the deny observer,
+     *  the hook-error trace sink, the org and rule lanes' disclosure sinks). */
+    readonly notifier: SafeNotifier;
+    /** borrowed-readonly — the settlement LEDGER of this pass (the binding is fixed; the ledger's own methods
+     *  are how the resolution sites write it — one rule per read, see {@link createSettlementLedger}). */
+    readonly ledger: SettlementLedger;
+    /** borrowed-readonly — the ONE emission seat of the deny observer for this pass, bounded and contained like
+     *  every other seat (the hook machinery owns the seat runner; the exits call this). */
+    readonly notifyPermissionDenied: (payload: Omit<PermissionDeniedPayload, "signal">) => Promise<void>;
+    /** borrowed-readonly — the PreToolUse screening face ({@link PreToolUseScreening}), or undefined when no
+     *  `preToolUse` face is wired (the edit chain then re-screens nothing, as before). */
+    readonly screening: PreToolUseScreening | undefined;
+    /** borrowed-readonly — the station group that runs AFTER the fold (the lanes: org layer, rule lane, classifier,
+     *  parks, resolution, edit chain, and the exit they end in), handed the pass by the fold's LAST station on the
+     *  fold's own completing tick. A seat rather than an import because the two station modules sit on one layer
+     *  and may not name each other; a seat rather than a second `await` in the dispatch because that await is a
+     *  suspension point of its own: the org face and the rule store read HOST state the host may refresh
+     *  concurrently, and the tick on which they are consulted is the contract — when the station bodies were one
+     *  function, the org face was invoked in the same continuation that ran the last tighten, and a refresh queued
+     *  behind the policy's answer could not land in between. Returns the gate result (a park's suspension or the
+     *  exit's record). Writer: the dispatch (`runToolGate`, which wires `runGateLanes`). Reader: the fold's tail. */
+    readonly afterFold: (pass: GatePass) => Promise<ToolGateResult>;
+    /** borrowed-mutable — the FINAL args: the model's input, rewritten by the phase-1 hook, by the policy
+     *  rewrite on the ask path, by the content-ask lane's presented snapshot and by the exits' rewrite fold.
+     *  Writers: the dispatch (phase 1), the lanes, the exits. */
+    currentInput: unknown;
+    /** borrowed-mutable — the adjudication request. Minted over the model's input so the record is whole from
+     *  the first station, and RE-MINTED by the adjudication station over the FINAL post-screen args (the
+     *  pre-existing `const req` site); `args` is re-pointed at the policy rewrite on the ask path and at the
+     *  content-ask lane's presented snapshot. Writers: the fold (mint), the lanes (`args`). */
+    req: ToolCallRequest;
+    /** borrowed-mutable — the PreToolUse `additionalContext` collected for this call (pushed into; the binding
+     *  is fixed). Writers: the dispatch (phase 1), the lanes (sandbox admission note, the edit re-screen). */
+    readonly preToolContext: string[];
+    /** borrowed-mutable — the phase-1 hook's ASK, remembered for the fold. Only ever an ask (assigned under the
+     *  `r.action === "ask"` arm); typed as the narrowed member so the fold's reconstruction reads the ask-only
+     *  fields without a runtime re-test that could, if it ever failed, silently skip the promotion (i.e. loosen).
+     *  Writer: the dispatch (phase 1). Readers: the fold, the sandbox-admission conjunct. */
+    hookAsk: Extract<PermissionResult, {
+        action: "ask";
+    }> | undefined;
+    /** borrowed-mutable — set by a park attempt that FAILED (see `ParkAttemptFailed`). Read at the single deny
+     *  exit — whatever the fallback chain then decides to say, it says it knowing the park was tried first.
+     *  Writers: the three park sites. */
+    parkFailed: string | undefined;
+    /** borrowed-mutable — WHO refused, written ONCE by the refusing site (a direct policy / org / classifier
+     *  deny, a hook re-screen refusal, the write-protection re-judge, the edit chain's cap, an ask resolution
+     *  that ended as a refusal). The exit mints the outcome from it beside the ledger's `settled`; a refusal
+     *  that reaches the exit without it is an engine defect and the mint throws. */
+    deniedBy: DeniedBy | undefined;
+    /** borrowed-mutable — the standing verdict. The no-policy default until the adjudication station writes the
+     *  policy's answer; then rewritten by every station that changes the verdict (fold, tightens, org, rule
+     *  lane, stamp, classifier, sandbox, content lane, resolution, edit chain). */
+    decision: PermissionResult;
+    /** borrowed-mutable — which of the gate's OWN post-fold tightens minted the standing ask, if one did — an
+     *  input of the ask-origin derivation (`AskOriginFacts.tightened`). Written at most once per pass: every
+     *  tighten fires only over a surviving `allow`, and the first one to fire leaves an `ask` the others do not
+     *  touch. Recorded by the gate rather than read off `decisionReason` because that member is a policy's to
+     *  compose (a policy stamping `"safety"` on its own ask must read as `policy`). Writer: the fold. */
+    tightenedBy: AskOriginFacts["tightened"];
+    /** borrowed-mutable — the rewrite remembered BEFORE a hook-ask promotion / tighten, re-applied on the
+     *  approved path (a redaction is not cancelled because a person confirmed). Writer: the fold. Readers: the
+     *  fold's probe and write-protection judges, the lanes, the allow exit. */
+    policyRewrite: unknown;
+}
+/**
+ * The engine's fail-closed block of phase 1 — the PreToolUse face THREW or never ANSWERED, so the engine
+ * decides, on its own rule, that the call does not run. design/134 R5 BOUNDARY (deliberate asymmetry with
+ * {@link hookDenyExit} — do NOT unify the two): a hook `deny` is the HOOK's decision and the observer
+ * exclusion covers it; a crash / an unanswered seat produces no decision at all, so the deny OBSERVER fires
+ * here — an attribution channel whose job is "why was this call denied" must see an engine deny, or the
+ * deployment's only evidence of a broken hook is a tool that mysteriously stops working.
+ */
+export declare function engineFailClosedExit(pass: GatePass, reason: string): Promise<ToolGateResult>;
+/** The hook's OWN deny in phase 1. design/134 R5: a PreToolUse hook deny does NOT fire `permissionDenied`
+ *  (the exclusion recorded on `Hooks.permissionDenied`) — this return stays observer-free. */
+export declare function hookDenyExit(pass: GatePass, r: PreToolUseResult): ToolGateResult;
+/**
+ * The exit of the adjudicate chain — the pass has a standing `deny` or `allow` (every ask was resolved or
+ * parked before this), and this is where it becomes the gate result and the ONE record of the pass.
+ */
+export declare function exitGate(pass: GatePass): Promise<ToolGateResult>;

package/dist/core/runner/gate-exit.js

@@ -0,0 +1,124 @@
+import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
+import { decisionText, engineSettlementOf } from "../tool-policy.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+import { formatHookFeedback } from "../reminder-mint.js";
+export function mintGateOutcome(facts) {
+    const settlement = facts.settled !== undefined ? Object.freeze({ ...facts.settled.settlement, who: Object.freeze({ ...facts.settled.settlement.who }) }) : undefined;
+    const outcome = Object.freeze({
+        disposition: Object.freeze(facts.deniedBy !== undefined ? { kind: "denied", deniedBy: facts.deniedBy } : { kind: "allowed" }),
+        ...(facts.settled !== undefined ? { settlement: settlement, origin: facts.settled.origin } : {}),
+    });
+    const defects = screenGateOutcome(outcome);
+    if (defects.length > 0)
+        throw new Error(`the tool gate composed an outcome that violates its own record: ${defects.join("; ")}`);
+    return outcome;
+}
+export function directDeny(deniedBy) {
+    return mintGateOutcome({ deniedBy });
+}
+export function createSettlementLedger(call) {
+    let settled;
+    return {
+        get settled() {
+            return settled;
+        },
+        set(next) {
+            settled = next;
+        },
+        fromResolved(resolved, asked, toolName) {
+            if (asked.action !== "ask" || asked.origin === undefined) {
+                if (resolved.settlement === undefined)
+                    return;
+                throw new Error(`an ask for "${toolName}" was resolved without an origin word — the origin stamp precedes every resolution`);
+            }
+            const attested = engineSettlementOf(resolved, call);
+            if (attested !== undefined) {
+                settled = { settlement: attested.settlement, origin: asked.origin };
+                return;
+            }
+            if (resolved.settlement === undefined)
+                return;
+            settled = { settlement: resolved.settlement, origin: asked.origin };
+        },
+        fromDecision(decision) {
+            if (decision.action === "ask")
+                return undefined;
+            const attested = engineSettlementOf(decision, call);
+            if (attested !== undefined)
+                settled = { settlement: attested.settlement, origin: attested.origin };
+            if (decision.action !== "deny")
+                return undefined;
+            return attested !== undefined && SETTLEMENT_IS_REFUSAL[attested.settlement.kind] ? "ask_resolution" : "policy";
+        },
+        supersede() {
+            settled = undefined;
+        },
+    };
+}
+export function cloneObserverInput(input) {
+    try {
+        return structuredClone(input);
+    }
+    catch {
+        if (Array.isArray(input))
+            return [...input];
+        if (input !== null && typeof input === "object")
+            return { ...input };
+        return input;
+    }
+}
+export function traceHookCrash(input, err, notifier) {
+    notifier.notify(() => input.onHookError?.(err), "toolGate.onHookError");
+}
+const PARK_FAILURE_CAUSE_MAX = 600;
+function withParkFailureCause(reason, parkFailed) {
+    if (parkFailed === undefined)
+        return reason;
+    return (`${reason} — note: a durable approval park was attempted for this call FIRST and could not be minted ` +
+        `(${inlineUntrusted(parkFailed, PARK_FAILURE_CAUSE_MAX)}), so the refusal above is what the fallback had ` +
+        `left to say, not the reason the call stopped.`);
+}
+export async function engineFailClosedExit(pass, reason) {
+    const { input, toolName, toolCallId, notifyPermissionDenied } = pass;
+    const gate = directDeny("hook");
+    await notifyPermissionDenied({ toolName, input: cloneObserverInput(pass.currentInput), toolCallId, reason, gate, ...(input.identity !== undefined ? { identity: input.identity } : {}) });
+    return { block: true, reason: formatHookFeedback(reason, input.reminderMark), gate, preToolContext: pass.preToolContext };
+}
+export function hookDenyExit(pass, r) {
+    const { input, toolName } = pass;
+    return {
+        block: true,
+        reason: formatHookFeedback(decisionText(r) ?? `tool "${toolName}" blocked by a PreToolUse hook`, input.reminderMark),
+        gate: directDeny("hook"),
+        preToolContext: pass.preToolContext,
+    };
+}
+export async function exitGate(pass) {
+    const { input, event, toolName, toolCallId, ledger, notifyPermissionDenied } = pass;
+    if (pass.decision.action === "deny") {
+        const denyReason = withParkFailureCause(decisionText(pass.decision) ?? `tool "${toolName}" denied by policy`, pass.parkFailed);
+        if (pass.decision.updatedInput !== undefined) {
+            pass.currentInput = pass.decision.updatedInput;
+        }
+        if (pass.deniedBy === undefined)
+            throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
+        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
+        await notifyPermissionDenied({ toolName, input: cloneObserverInput(pass.currentInput), toolCallId, reason: denyReason, gate, ...(input.identity !== undefined ? { identity: input.identity } : {}) });
+        return {
+            block: true,
+            reason: formatHookFeedback(denyReason, input.reminderMark),
+            gate,
+            preToolContext: pass.preToolContext,
+        };
+    }
+    if (pass.decision.action === "allow") {
+        const rw = pass.decision.updatedInput !== undefined ? pass.decision.updatedInput : pass.policyRewrite;
+        if (rw !== undefined)
+            pass.currentInput = rw;
+    }
+    return {
+        updatedInput: pass.currentInput === event.input ? undefined : pass.currentInput,
+        gate: mintGateOutcome(ledger.settled !== undefined ? { settled: ledger.settled } : {}),
+        preToolContext: pass.preToolContext,
+    };
+}

package/dist/core/runner/park-commit.d.ts

@@ -55,23 +55,23 @@ export declare function sanitizedTtlMs(ttlMs: number | undefined): number | unde
  * SINGLE derivation on purpose. Two consumers need this answer: the abort-classification seam, which
  * stamps it into the `details` of the results the loop mints for the contaminated siblings, and the
  * `tool_end` projection, which puts it on the wire. Reading it from one function keeps the two from
- * disagreeing about WHICH HOLDER WINS or about what a holder with no call means. They are not otherwise
+ * disagreeing about what a pause with no call means. They are not otherwise
  * interchangeable: the frame face applies strictly narrower conditions on top of this answer (see
  * `tool_end.gatedCallId`), so a frame may omit an id this function returns — never the reverse.
+ * "Which holder wins" is no longer a question: there is one holder, and a pause that holds no call
+ * publishes absence.
  *
  * The frame side must not read the id back out of a tool RESULT even though the marker is there: a
  * result's `details` is written by the tool (and replaceable by post-tool hooks), so lifting a
  * cross-call attribution from it would let any failing tool name an arbitrary call and put a phantom
- * approval wait on someone else's frame. Same rule, same reason, as `settledBy`.
+ * approval wait on someone else's frame. Same rule, same reason, as `tool_end.gate`.
  *
- * The two holders are never both set (the commit-side discriminant writes exactly one); they are read
- * here in assemble-result's slot order so the winner is the same one the terminal status is built from.
  */
-export declare function gatedCallIdOf(p: Pick<Prepared, "suspendRef" | "reviewRef">): string | undefined;
+export declare function gatedCallIdOf(p: Pick<Prepared, "pausedRef">): string | undefined;
 /**
  * The abort-classification marker for the loop's short-circuit "Operation aborted" family: when a gate
- * committed a durable park this run (`suspendRef` for human/irreversible/content asks, `reviewRef` for
- * the dry-run/plan-review family), the contaminated sibling frames carry something a consumer can key
+ * committed a durable park this run (`pausedRef.current`, whatever the pause's kind), the contaminated
+ * sibling frames carry something a consumer can key
  * on instead of parsing the (contract-stable) result text (ruled 2026-08-04). The commit is published
  * BEFORE the abort fires, so this read is race-free at mint time.
  *
@@ -83,26 +83,20 @@ export declare function gatedCallIdOf(p: Pick<Prepared, "suspendRef" | "reviewRe
  * Module-level rather than a closure in `prepareTask` (design/238 D-7: extract, don't accrete) — the
  * marker's shape and its rules belong beside {@link gatedCallIdOf}, the derivation it reads.
  */
-export declare function parkContaminationMarker(refs: Pick<Prepared, "suspendRef" | "reviewRef">): Record<string, unknown> | undefined;
+export declare function parkContaminationMarker(refs: Pick<Prepared, "pausedRef">): Record<string, unknown> | undefined;
 /**
- * design/76 §2.5 — THE COMMIT-SIDE DISCRIMINANT (v4 MAJOR-A, the load-bearing dry-run fix). Called
- * AFTER `commitSuspendSaga` returns true (the checkpoint is durably committed) to publish which holder
- * the run loop reads for the terminal status. Branch on the COMMITTED `gate.kind`: a REVIEW-PAUSE gate
- * writes `reviewRef` (→ assemble-result slot 8.6 → `status:"needs_review"` / `review.pending`); every
- * approval/resource gate (human / irreversible_ask / resource_limit / task_done) writes `suspendRef` as
- * before (→ slot 8.5 → `status:"suspended"`). NEVER both — a review pause that also set `suspendRef`
- * would assemble as `"suspended"` and make slot 8.6 dead code. The review-pause family is BOTH the
- * dry-run `{kind:"needs_review"}` gate (design/76 §2.5) AND the design/80 D-B `{kind:"plan_review"}`
- * gate — both are human-review pauses that share the `needs_review` terminal (a `plan_review` resumes
- * with a `plan_review` outcome, a `needs_review` with `dry_run_review`; the distinct gate.kind keeps the
- * resume discriminant unambiguous). (The review checkpoints themselves are minted by a PROFILE, out of
- * core scope; core only owns this routing seam + the gate/status/resume discriminants.)
+ * THE COMMIT-SIDE PUBLICATION. Called AFTER `commitSuspendSaga` returns true (the checkpoint is durably
+ * committed) to publish the run's one committed pause for the run loop's terminal assembly. There is no
+ * routing: the cause carries the committed gate whole, and WHICH terminal status it reads
+ * (`suspended` / `needs_review`) is the gate kind's registry row — the two holders the review family and
+ * the approval family used to be split across, and the branch that chose between them, are gone.
+ * (Review checkpoints themselves are minted by a PROFILE, out of core scope; core owns this seam and the
+ * gate/status/resume discriminants.)
  *
- * Module-level, taking the holders as a parameter (design/238 D-7: extract, don't accrete) — the
- * closure form captured nothing else, so hoisting it costs nothing and puts the discriminant beside the
+ * Module-level, taking the holder as a parameter (design/238 D-7: extract, don't accrete) — beside the
  * two readers of what it publishes ({@link gatedCallIdOf}, {@link parkContaminationMarker}).
  */
-export declare function publishCommittedSuspend(refs: Pick<Prepared, "suspendRef" | "reviewRef">, token: CheckpointToken, gate: CheckpointGate, scope: string, remoteHandle: WorkspaceHandle | undefined, checkpointId?: string, 
+export declare function publishCommittedSuspend(refs: Pick<Prepared, "pausedRef">, token: CheckpointToken, gate: CheckpointGate, scope: string, remoteHandle: WorkspaceHandle | undefined, checkpointId?: string, 
 /** The COMMITTED row's pendingAction — passed whole, not as a pre-extracted id, so no call site can
  *  hand this seam an id the committed row does not actually park on. */
 pendingAction?: PendingAction): void;

package/dist/core/runner/park-commit.js

@@ -7,26 +7,25 @@ export function sanitizedTtlMs(ttlMs) {
     return Number.isFinite(ttlMs) && ttlMs > 0 ? ttlMs : DEFAULT_RESOURCE_TTL_MS;
 }
 export function gatedCallIdOf(p) {
-    if (p.suspendRef.token !== undefined)
-        return p.suspendRef.gatedCallId;
-    if (p.reviewRef.token !== undefined)
-        return p.reviewRef.gatedCallId;
-    return undefined;
+    return p.pausedRef.current?.gatedCallId;
 }
 export function parkContaminationMarker(refs) {
-    if (refs.suspendRef.token === undefined && refs.reviewRef.token === undefined)
+    if (refs.pausedRef.current === undefined)
         return undefined;
     const gatedCallId = gatedCallIdOf(refs);
     return { code: "gate.parked", ...(gatedCallId !== undefined ? { gatedCallId } : {}) };
 }
 export function publishCommittedSuspend(refs, token, gate, scope, remoteHandle, checkpointId, pendingAction) {
-    const ref = gate.kind === "needs_review" || gate.kind === "plan_review" ? refs.reviewRef : refs.suspendRef;
-    ref.token = token;
-    if (checkpointId !== undefined)
-        ref.checkpointId = checkpointId;
-    ref.gate = gate;
-    ref.gatedCallId = pendingAction?.kind === "tool_approval" ? pendingAction.toolCallId : undefined;
-    if (remoteHandle !== undefined)
-        ref.restoreMode = remoteHandle.restoreMode === "park_only" ? "park_only" : "snapshot";
-    ref.scope = scope;
+    const pause = {
+        cause: {
+            kind: "paused",
+            gate,
+            token,
+            ...(checkpointId !== undefined ? { checkpointId } : {}),
+            ...(remoteHandle !== undefined ? { restoreMode: remoteHandle.restoreMode === "park_only" ? "park_only" : "snapshot" } : {}),
+        },
+        scope,
+        ...(pendingAction?.kind === "tool_approval" ? { gatedCallId: pendingAction.toolCallId } : {}),
+    };
+    refs.pausedRef.current = pause;
 }

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -60,9 +60,6 @@ export interface PrepareAskLaneInput {
      *  synchronous resolve that a person actually judged (count / totalWaitMs / gates push); runtask adds the durable
      *  resume latency. */
     humanReviewRef: Prepared["humanReviewRef"];
-    /** borrowed-mutable — the bare-human-rejection sideband. Writer here: a `settledBy:"human"` deny with no note
-     *  (`add`); the gate station judges and sweeps it. */
-    humanBareRejections: Set<string>;
     /** borrowed-readonly — the injectable wall clock every human-time observable reads (`Prepared.now`). */
     now: () => number;
     /** borrowed-readonly — the policy-chain phase's rule-offer factory (the suggestion members the ask mint threads). */

package/dist/core/runner/prepare-ask-lane.js

@@ -55,7 +55,7 @@ function resolveApprovalPreview(tools, toolName, args) {
     }
 }
 export function prepareAskLane(input) {
-    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, humanBareRejections, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash } = input;
+    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash } = input;
     if (!gateMachineryActive)
         return { askLane: undefined };
     const composedCallSignal = (callSignal) => composeCallSignal(abortController.signal, callSignal);
@@ -77,6 +77,7 @@ export function prepareAskLane(input) {
                     `(no live approver reachable, or a durable-park mandate applies), and no durable approval park is ` +
                     `available — denied fail-closed (the inherited constraint stands).`,
                 decisionReason: "mode",
+                settlement: { kind: "approver_unavailable", who: { party: "none" }, when: now() },
                 approverUnavailable: true,
             };
         }
@@ -104,7 +105,7 @@ export function prepareAskLane(input) {
             ...(decision.action === "ask" && decision.ruleEvidence !== undefined ? { ruleEvidence: decision.ruleEvidence } : {}),
         }, onAsk, composedCallSignal(callSignal), lateAskSettlementObserver({ toolName: req.toolName, toolCallId: req.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
         const waitMs = Math.max(0, now() - t0);
-        if (resolved.approverUnavailable !== true && resolved.resolution !== "task_aborted") {
+        if (resolved.approverUnavailable !== true && resolved.settlement?.kind !== "task_aborted") {
             humanReviewRef.count += 1;
             humanReviewRef.totalWaitMs += waitMs;
             const toolArg = primaryActivityArg(req.args);
@@ -116,9 +117,6 @@ export function prepareAskLane(input) {
                 ...(toolArg !== undefined ? { toolArg } : {}),
             });
         }
-        if (resolved.action === "deny" && resolved.settledBy === "human" && resolved.humanRefusalNote !== true) {
-            humanBareRejections.add(req.toolCallId);
-        }
         return resolved;
     };
     const notifyPermissionDenied = createDenyObserverNotifier(hooks, hookTimeoutMs, abortController.signal, notifyOwnHookCrash);

package/dist/core/runner/prepare-boundary-parks.d.ts

@@ -78,12 +78,9 @@ export interface PrepareBoundaryParksInput {
     f012CheckpointState: () => boolean;
     /** borrowed-readonly — see `faceCheckpointState`. */
     orgAdmissionCheckpointState: () => boolean;
-    /** borrowed-mutable — the durable-suspend holder (`Prepared.suspendRef`). Writer here: the commit-side publication of a
-     *  committed resource row. */
-    suspendRef: Prepared["suspendRef"];
-    /** borrowed-mutable — the review holder (`Prepared.reviewRef`). Writer here: the commit-side publication of a committed
-     *  plan_review row. */
-    reviewRef: Prepared["reviewRef"];
+    /** borrowed-mutable — the run's committed-pause holder (`Prepared.pausedRef`). Writer here: the commit-side publication
+     *  of a committed resource / platform / plan-review checkpoint. */
+    pausedRef: Prepared["pausedRef"];
     /** borrowed-mutable — the run-scoped remote-lifecycle failure log. Writer here: a refused `suspendVM` (`push`). */
     remoteEnvFailures: Prepared["remoteEnvFailures"];
     /** borrowed-readonly — the wiring-manifest phase's task-axis predicate (opt-in ∧ durable infra): exposes `suspendForResource`. */

package/dist/core/runner/prepare-boundary-parks.js

@@ -5,7 +5,7 @@ import { checkpointScopeOf } from "./checkpoint-scope.js";
 import { DEFAULT_RESOURCE_TTL_MS, publishCommittedSuspend, sanitizedTtlMs, USAGE_WINDOW_REAP_MARGIN_MS } from "./park-commit.js";
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
 export function prepareBoundaryParks(input) {
-    const { saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, suspendRef, reviewRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter } = input;
+    const { saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter } = input;
     if (saga === undefined)
         return { suspendForResource: undefined, suspendForPlatformLimit: undefined, suspendForReview: undefined };
     const { inFlightSpendMicroUsd, serializeCheckpointState, commitSuspendSaga, suspendLoopCapHit, suspendableEnv, parkOnlyRemoteEnv, parkOnlyHandle } = saga;
@@ -67,7 +67,7 @@ export function prepareBoundaryParks(input) {
         };
         if ((await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).tag !== "committed")
             return false;
-        publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, scope, remoteHandle, cp.checkpointId, cp.pendingAction);
+        publishCommittedSuspend({ pausedRef }, token, gate, scope, remoteHandle, cp.checkpointId, cp.pendingAction);
         try {
             await sessions.pin?.(sessionId);
         }
@@ -153,7 +153,7 @@ export function prepareBoundaryParks(input) {
             };
             if ((await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).tag !== "committed")
                 return false;
-            publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, scope, remoteHandle, cp.checkpointId, cp.pendingAction);
+            publishCommittedSuspend({ pausedRef }, token, gate, scope, remoteHandle, cp.checkpointId, cp.pendingAction);
             try {
                 await sessions.pin?.(sessionId);
             }

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -22,7 +22,6 @@ import type { AgentHarness, AgentTool, ThinkingLevel } from "../../internal/harn
 import type { Model } from "../../internal/llm.js";
 import { forkGovernanceDenial } from "../../agents/subagent.js";
 import type { PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
-import { createRunWorkflowTool } from "../../orchestration/run-workflow-tool.js";
 import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import { type AutoModeDecider, type AutoModeDenialTracker } from "../auto-mode.js";
@@ -33,11 +32,8 @@ import type { OnAsk } from "../tool-policy.js";
 import type { RunnerDeps, RuntimeCaps, TaskEvent, TaskSpec, ToolExecuteContext } from "../types.js";
 import type { AutoModeArmReason } from "../wiring-manifest.js";
 import type { ReadFace } from "../../tools/fs/index.js";
-import type { InheritedGate, Prepared, RunInternals, ToolFaceSnapshot } from "./contracts.js";
+import type { InheritedGate, Prepared, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 import { type BlockedRef } from "./synthetic-tools.js";
-/** The runner the Workflow mount accepts — spelled as the factory's own option type so this phase names no runner
- *  module of its own (the narrow `RunnerSelfSeat` contract is a design decision still open; see the layering registry). */
-type WorkflowMountRunner = Parameters<typeof createRunWorkflowTool>[0]["runner"];
 export interface PrepareCapsAndWorkflowInput {
     /** borrowed-readonly — the REBOUND spec, whole: the roster map reads `tools`; the mounts read `enableBlockedReport`,
      *  `enablePlanMode`, `interactiveTools`, `checkpointStore`; the caps/compliance stations read `principal`, `selfOrchestration`,
@@ -113,7 +109,7 @@ export interface PrepareCapsAndWorkflowInput {
     peerSendMessageBuiltIn: boolean;
     /** borrowed-readonly — the trusted Runner self-reference the Workflow mount executes children through; undefined when
      *  prepareTask runs standalone (then Workflow is simply not mounted). */
-    runnerSelf: WorkflowMountRunner | undefined;
+    runnerSelf: RunnerSelfSeat | undefined;
     /** borrowed-readonly — LATE-BOUND: the memory-engine session; the Workflow mount's capture-floor getter reads it at ITS call time. */
     memoryEngineSession: () => Prepared["memoryEngineSession"];
     /** borrowed-readonly — LATE-BOUND: the adopted center artifact; the Workflow mount's two center getters read it at THEIR call time. */
@@ -167,4 +163,3 @@ export interface PrepareCapsAndWorkflowResult {
 }
 /** The M4 phase body — prepareTask's caps-and-workflow stretch, verbatim (see the module header). */
 export declare function prepareCapsAndWorkflow(input: PrepareCapsAndWorkflowInput): Promise<PrepareCapsAndWorkflowResult>;
-export {};

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -244,7 +244,7 @@ export async function prepareCapsAndWorkflow(input) {
             },
             ...(spec.handsReadOnly === true ? { parentHandsReadOnly: true } : {}), ...(spec.interactiveTools === false ? { parentInteractiveTools: false } : {}),
             onNotice: deps.onNotice,
-            parentCheckpointStoreDisabled: spec.checkpointStore === null,
+            parentCheckpointStoreDisabled: spec.checkpointStore === "disabled",
             parentCenterArtifactDigest: () => input.centerAdoption()?.artifact.artifactDigest,
             parentCenterSourceRevision: () => input.centerAdoption()?.sourceRevision,
             ...(forwardEvent ? { forwardEvent } : {}),