@sema-agent/core 7.50.1 → 7.51.0

package/dist/core/gate-outcome.js

@@ -1,4 +1,4 @@
-import { isAskClass, isAskOrigin, isModeReleaseReason, isPermissionMode, ASK_FACES, releasableAskClassesFor } from "./ask-origin.js";
+import { isAskClass, isAskOrigin, isModeReleaseReason, isPermissionMode, isPersistedRuleMandate, ASK_FACES, releasableAskClassesFor } from "./ask-origin.js";
 import { isAutoModeFallbackCause } from "./auto-mode.js";
 export const SETTLEMENT_KINDS = Object.freeze([
     "human_allowed",
@@ -108,76 +108,186 @@ export const DENIED_BY_MAY_CARRY_CAUSE = {
     read_boundary: false,
     mode: false,
 };
-export function screenGateOutcome(g) {
+const retired = (word, retiredIn) => Object.freeze({ word, retiredIn });
+export const RETIRED_MEMBERS = Object.freeze({
+    askClass: Object.freeze([retired("write_protection_unresolved", "7.49.0"), retired("governance_unavailable", "7.51.0")]),
+    modeReleaseReason: Object.freeze([retired("write_protection_unresolved", "7.49.0"), retired("rule_unreadable", "7.50.0")]),
+    askOrigin: Object.freeze([retired("unresolvable", "7.14.0")]),
+    persistedRuleMandate: Object.freeze([retired("write_protection_unresolved", "7.49.0")]),
+    deniedBy: Object.freeze([retired("plan_mode", "7.34.0")]),
+    settlementKind: Object.freeze([]),
+    settlementParty: Object.freeze([]),
+    classifierDenyCause: Object.freeze([]),
+    permissionMode: Object.freeze([]),
+    autoModeFallbackCause: Object.freeze([]),
+});
+const LIVE_MEMBER = Object.freeze({
+    "askClass": isAskClass,
+    "modeReleaseReason": isModeReleaseReason,
+    "askOrigin": isAskOrigin,
+    "persistedRuleMandate": isPersistedRuleMandate,
+    "deniedBy": isDeniedBy,
+    "settlementKind": isSettlementKind,
+    "settlementParty": isSettlementParty,
+    "classifierDenyCause": isClassifierDenyCause,
+    "permissionMode": isPermissionMode,
+    "autoModeFallbackCause": isAutoModeFallbackCause,
+});
+function retiredInOf(set, v) {
+    return RETIRED_MEMBERS[set].find((r) => r.word === v)?.retiredIn;
+}
+export function isRetiredMember(set, word) {
+    if (typeof set !== "string" || !Object.hasOwn(RETIRED_MEMBERS, set))
+        throw new TypeError(`isRetiredMember: ${JSON.stringify(String(set))} is not a closed set a gate record carries (${Object.keys(RETIRED_MEMBERS).join(", ")})`);
+    return retiredInOf(set, word) !== undefined;
+}
+export function releasePolicyDefects(g) {
+    const d = objectOf(objectOf(g)?.disposition);
+    const r = d?.kind === "allowed" ? objectOf(d.released) : undefined;
+    const askClass = r?.askClass;
+    const classes = r?.classes;
+    if (!isAskClass(askClass) || !Array.isArray(classes) || !classes.every(isAskClass))
+        return [];
+    if (!ASK_FACES.some((face) => releasableAskClassesFor(face).includes(askClass)))
+        return [`I7: released.askClass "${askClass}" is not a releasable class under this engine's table`];
+    const held = [askClass, ...classes];
+    return ASK_FACES.some((face) => held.every((c) => releasableAskClassesFor(face).includes(c))) ? [] : [`I7: released.classes ${JSON.stringify(classes)} is not a set one face of this engine's table releases`];
+}
+const DENY_ONLY_MEMBERS = Object.freeze(["deniedBy", "cause", "mode", "askClass", "classes"]);
+function objectOf(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
+}
+function shapeOf(v) {
+    return v === null ? "null" : Array.isArray(v) ? "an array" : typeof v === "object" ? "an object" : typeof v;
+}
+function spelled(v) {
+    return v === null || (typeof v !== "object" && typeof v !== "function") ? `"${String(v)}"` : `(${shapeOf(v)})`;
+}
+function readingOf(opts) {
+    if (opts === undefined)
+        return "archive";
+    if (typeof opts !== "object" || opts === null)
+        throw new TypeError(`screenGateOutcome: the options are an object ({ reading?: "archive" | "producer" }), not ${opts === null ? "null" : typeof opts}`);
+    const reading = opts.reading;
+    if (reading === undefined || reading === "archive" || reading === "producer")
+        return reading ?? "archive";
+    throw new TypeError(`screenGateOutcome: reading ${typeof reading === "string" ? JSON.stringify(reading) : typeof reading} is not a reading (archive, producer)`);
+}
+export function screenGateOutcome(g, opts) {
+    const producer = readingOf(opts) === "producer";
+    const member = (set, v) => LIVE_MEMBER[set](v) || (!producer && retiredInOf(set, v) !== undefined);
+    const outside = (field, set, v) => {
+        const was = retiredInOf(set, v);
+        return `${field} ${spelled(v)} is outside the closed set${was !== undefined ? ` (retired in ${was})` : ""}`;
+    };
+    const classList = (v) => Array.isArray(v) && v.length > 0 && v.every((c) => member("askClass", c));
+    const notRecord = (field, v) => `${field} is not an object (${shapeOf(v)})`;
+    const record = objectOf(g);
+    if (record === undefined)
+        return [notRecord("the gate record", g)];
     const defects = [];
-    const d = g.disposition;
-    if (d.kind === "denied" && !isDeniedBy(d.deniedBy))
-        defects.push(`disposition.deniedBy "${String(d.deniedBy)}" is outside the closed set`);
-    const s = g.settlement;
-    if (s !== undefined && !isSettlementKind(s.kind))
-        defects.push(`settlement.kind "${String(s.kind)}" is outside the closed set`);
-    const party = s === undefined ? undefined : s.who?.party;
-    if (s !== undefined && !isSettlementParty(party))
-        defects.push(`settlement.who.party "${String(party)}" is outside the closed set`);
-    if (g.origin !== undefined && !isAskOrigin(g.origin))
-        defects.push(`origin "${String(g.origin)}" is outside the closed set`);
-    if ((s !== undefined) !== (g.origin !== undefined))
+    const d = objectOf(record.disposition);
+    if (d === undefined)
+        defects.push(notRecord("disposition", record.disposition));
+    else if (d.kind !== "allowed" && d.kind !== "denied")
+        defects.push(`disposition.kind ${spelled(d.kind)} is neither allowed nor denied`);
+    const denied = d?.kind === "denied" ? d : undefined;
+    const allowed = d?.kind === "allowed" ? d : undefined;
+    const layer = denied !== undefined && member("deniedBy", denied.deniedBy);
+    if (denied !== undefined && !layer)
+        defects.push(outside("disposition.deniedBy", "deniedBy", denied.deniedBy));
+    const settled = record.settlement !== undefined;
+    const s = objectOf(record.settlement);
+    if (settled && s === undefined)
+        defects.push(notRecord("settlement", record.settlement));
+    if (s !== undefined && !member("settlementKind", s.kind))
+        defects.push(outside("settlement.kind", "settlementKind", s.kind));
+    const party = objectOf(s?.who)?.party;
+    if (s !== undefined && !member("settlementParty", party))
+        defects.push(outside("settlement.who.party", "settlementParty", party));
+    if (record.origin !== undefined && !member("askOrigin", record.origin))
+        defects.push(outside("origin", "askOrigin", record.origin));
+    if (settled !== (record.origin !== undefined))
         defects.push("I1: settlement and origin must be present together — they describe the same ask");
-    if (d.kind === "denied" && d.deniedBy === "ask_resolution" && (s === undefined || !isSettlementKind(s.kind) || !SETTLEMENT_IS_REFUSAL[s.kind])) {
+    const kind = s !== undefined && isSettlementKind(s.kind) ? s.kind : undefined;
+    if (denied?.deniedBy === "ask_resolution" && (kind === undefined || !SETTLEMENT_IS_REFUSAL[kind]))
         defects.push("I2: deniedBy ask_resolution requires a settlement whose kind is a refusal");
+    const approval = kind !== undefined && !SETTLEMENT_IS_REFUSAL[kind];
+    if (approval && denied !== undefined && layer && !(isDeniedBy(denied.deniedBy) && DENIED_BY_MAY_VETO[denied.deniedBy])) {
+        defects.push(`I3: a ${kind} settlement beside a deny must name a veto layer, not "${String(denied.deniedBy)}"`);
     }
-    const approval = s !== undefined && isSettlementKind(s.kind) && !SETTLEMENT_IS_REFUSAL[s.kind];
-    if (approval && d.kind === "denied" && isDeniedBy(d.deniedBy) && !DENIED_BY_MAY_VETO[d.deniedBy]) {
-        defects.push(`I3: a ${s.kind} settlement beside a deny must name a veto layer, not "${d.deniedBy}"`);
-    }
-    if (d.kind === "allowed" && s !== undefined && !approval)
-        defects.push(`I4: an allowed disposition cannot carry a "${String(s.kind)}" settlement`);
-    if (d.kind === "denied" && d.cause !== undefined) {
-        if (!isClassifierDenyCause(d.cause))
-            defects.push(`disposition.cause "${String(d.cause)}" is outside the closed set`);
-        else if (isDeniedBy(d.deniedBy) && !DENIED_BY_MAY_CARRY_CAUSE[d.deniedBy])
-            defects.push(`I5: a classifier cause cannot stand beside deniedBy "${d.deniedBy}"`);
+    if (allowed !== undefined && s !== undefined && !approval)
+        defects.push(`I4: an allowed disposition cannot carry a ${spelled(s.kind)} settlement`);
+    if (denied !== undefined && denied.cause !== undefined) {
+        if (!member("classifierDenyCause", denied.cause))
+            defects.push(outside("disposition.cause", "classifierDenyCause", denied.cause));
+        else if (layer && !(isDeniedBy(denied.deniedBy) && DENIED_BY_MAY_CARRY_CAUSE[denied.deniedBy]))
+            defects.push(`I5: a classifier cause cannot stand beside deniedBy "${String(denied.deniedBy)}"`);
     }
-    if (d.kind === "allowed" && d.released !== undefined) {
-        const r = d.released;
-        if (s !== undefined)
-            defects.push("I7: a mode release carries no settlement — nobody answered the ask it released");
-        if (r.mode !== "bypassPermissions")
-            defects.push(`I7: a mode release names mode "${String(r.mode)}" — only bypassPermissions releases`);
-        if (!isAskClass(r.askClass) || !ASK_FACES.some((face) => releasableAskClassesFor(face).includes(r.askClass)))
-            defects.push(`I7: released.askClass "${String(r.askClass)}" is not a releasable class`);
-        if (!Array.isArray(r.classes) || r.classes.length === 0 || !r.classes.every((c) => isAskClass(c)))
-            defects.push("I7: released.classes must be a non-empty list of ask classes");
-        if (r.origin !== undefined && !isAskOrigin(r.origin))
-            defects.push(`I7: released.origin "${String(r.origin)}" is outside the closed set`);
-        if (r.reason !== undefined && !isModeReleaseReason(r.reason))
-            defects.push(`I7: released.reason "${String(r.reason)}" is outside the closed set`);
-        else if (r.reason !== undefined && Array.isArray(r.classes) && !r.classes.includes(r.reason))
-            defects.push(`I7: released.reason "${r.reason}" is not a member of released.classes`);
+    for (const k of DENY_ONLY_MEMBERS)
+        if (allowed !== undefined && allowed[k] !== undefined)
+            defects.push(`disposition.${k} stands only on a denied disposition`);
+    if (denied !== undefined && denied.released !== undefined)
+        defects.push("I7: disposition.released stands only on an allowed disposition");
+    if (d !== undefined && d.released !== undefined) {
+        const r = objectOf(d.released);
+        if (r === undefined)
+            defects.push(notRecord("I7: disposition.released", d.released));
+        else {
+            if (settled)
+                defects.push("I7: a mode release carries no settlement — nobody answered the ask it released");
+            if (r.mode !== "bypassPermissions")
+                defects.push(`I7: a mode release names mode ${spelled(r.mode)} — only bypassPermissions releases`);
+            if (!member("askClass", r.askClass))
+                defects.push(outside("I7: released.askClass", "askClass", r.askClass));
+            if (!classList(r.classes))
+                defects.push("I7: released.classes must be a non-empty list of ask classes");
+            if (r.origin !== undefined && !member("askOrigin", r.origin))
+                defects.push(outside("I7: released.origin", "askOrigin", r.origin));
+            if (r.mandate !== undefined && !member("persistedRuleMandate", r.mandate))
+                defects.push(outside("I7: released.mandate", "persistedRuleMandate", r.mandate));
+            if (r.reason !== undefined && !member("modeReleaseReason", r.reason))
+                defects.push(outside("I7: released.reason", "modeReleaseReason", r.reason));
+            else if (r.reason !== undefined && Array.isArray(r.classes) && !r.classes.includes(r.reason))
+                defects.push(`I7: released.reason "${String(r.reason)}" is not a member of released.classes`);
+        }
     }
-    if (d.kind === "denied") {
-        const modeRefusal = d.deniedBy === "mode";
-        if (modeRefusal !== (d.mode !== undefined))
+    if (denied !== undefined) {
+        const modeRefusal = denied.deniedBy === "mode";
+        if (modeRefusal !== (denied.mode !== undefined))
             defects.push("I8: deniedBy mode and disposition.mode must be present together");
-        if (modeRefusal && (!isPermissionMode(d.mode) || (d.mode !== "bypassPermissions" && d.mode !== "dontAsk")))
-            defects.push(`I8: a mode refusal names mode "${String(d.mode)}" — only bypassPermissions, dontAsk and plan refuse`);
-        if (modeRefusal && (!isAskClass(d.askClass) || !Array.isArray(d.classes) || d.classes.length === 0 || !d.classes.every((c) => isAskClass(c))))
-            defects.push("I8: a mode refusal carries askClass and a non-empty classes list");
+        if (modeRefusal && denied.mode !== undefined && (!member("permissionMode", denied.mode) || (denied.mode !== "bypassPermissions" && denied.mode !== "dontAsk"))) {
+            defects.push(`I8: a mode refusal names mode ${spelled(denied.mode)} — only bypassPermissions and dontAsk refuse`);
+        }
+        if (modeRefusal && (denied.askClass === undefined || denied.classes === undefined))
+            defects.push("I8: a mode refusal carries askClass and classes");
+        if (denied.askClass !== undefined && !member("askClass", denied.askClass))
+            defects.push(outside("disposition.askClass", "askClass", denied.askClass));
+        if (denied.classes !== undefined && !classList(denied.classes))
+            defects.push("disposition.classes must be a non-empty list of ask classes");
     }
-    const attribution = d.classifier;
-    if (attribution !== undefined) {
+    if (d !== undefined && d.classifier !== undefined) {
+        const attribution = objectOf(d.classifier);
         const named = (v) => typeof v === "string" && v !== "";
-        if (!named(attribution.modelRequested) || !named(attribution.modelUsed))
-            defects.push("I6: disposition.classifier must name both the model the round was for and the model that answered");
-        const fb = attribution.fallback;
-        if (fb !== undefined) {
-            if (!named(fb.from) || !named(fb.to))
-                defects.push("I6: disposition.classifier.fallback must name the rung it left and the rung it arrived at");
-            else if (fb.to !== attribution.modelUsed)
-                defects.push(`I6: the fallback landed on "${fb.to}" but the record names "${attribution.modelUsed}" as the model that answered`);
-            if (!isAutoModeFallbackCause(fb.cause))
-                defects.push(`I6: fallback cause "${String(fb.cause)}" is outside the closed set`);
+        if (attribution === undefined)
+            defects.push(notRecord("I6: disposition.classifier", d.classifier));
+        else {
+            if (!named(attribution.modelRequested) || !named(attribution.modelUsed))
+                defects.push("I6: disposition.classifier must name both the model the round was for and the model that answered");
+            const fb = objectOf(attribution.fallback);
+            if (attribution.fallback !== undefined && fb === undefined)
+                defects.push(notRecord("I6: disposition.classifier.fallback", attribution.fallback));
+            if (fb !== undefined) {
+                if (!named(fb.from) || !named(fb.to))
+                    defects.push("I6: disposition.classifier.fallback must name the rung it left and the rung it arrived at");
+                else if (fb.to !== attribution.modelUsed)
+                    defects.push(`I6: the fallback landed on ${spelled(fb.to)} but the record names ${spelled(attribution.modelUsed)} as the model that answered`);
+                if (!member("autoModeFallbackCause", fb.cause))
+                    defects.push(outside("I6: fallback cause", "autoModeFallbackCause", fb.cause));
+            }
         }
     }
+    if (producer)
+        defects.push(...releasePolicyDefects(g));
     return defects;
 }

package/dist/core/governance-codes.d.ts

@@ -137,7 +137,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.path_view_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "route.finish_reason_unknown", "route.stream_end_ignored", "route.extra_body_reserved_dropped", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.read_deny_swapped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.path_view_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "route.finish_reason_unknown", "route.stream_end_ignored", "route.extra_body_reserved_dropped", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "tool_result.media_refused", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable", "permission.entry_mode_clamped"];
 /** A catalogued code (see {@link ENGINE_NOTICE_CODES}); {@link NOTICE_MINTER} says who mints it. NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */
@@ -199,6 +199,7 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "config.read_face_deployment_clamped": "operator";
     readonly "config.write_face_swapped": "operator";
     readonly "config.write_face_deployment_clamped": "operator";
+    readonly "config.read_deny_swapped": "operator";
     readonly "config.tool_model_gate_removed": "operator";
     readonly "config.tool_model_gate_unknown_class": "operator";
     readonly "config.tool_model_gate_env_invalid": "operator";
@@ -241,10 +242,12 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "skills.listing_truncated": "operator";
     readonly "agents.listing_truncated": "operator";
     readonly "tool_result.offload_put_failed": "operator";
+    readonly "tool_result.media_refused": "operator";
     readonly "config.forward_sink_failed": "operator";
     readonly "instructions.source_changed": "user";
     readonly "session.records_skipped": "user";
     readonly "server.model_unreachable": "user";
+    readonly "permission.entry_mode_clamped": "user";
     readonly "memory.layer_locked_legacy": "operator";
 };
 /** Compile-time fence: every catalogued code has an audience row (and, via `satisfies`, only those). */
@@ -280,6 +283,7 @@ declare const NOTICE_MINTER_TABLE: {
     readonly "config.read_face_deployment_clamped": "engine";
     readonly "config.write_face_swapped": "engine";
     readonly "config.write_face_deployment_clamped": "engine";
+    readonly "config.read_deny_swapped": "engine";
     readonly "config.tool_model_gate_removed": "engine";
     readonly "config.tool_model_gate_unknown_class": "engine";
     readonly "config.tool_model_gate_env_invalid": "engine";
@@ -357,10 +361,12 @@ declare const NOTICE_MINTER_TABLE: {
     readonly "skills.listing_truncated": "engine";
     readonly "agents.listing_truncated": "engine";
     readonly "tool_result.offload_put_failed": "engine";
+    readonly "tool_result.media_refused": "engine";
     readonly "instructions.source_changed": "server";
     readonly "session.records_skipped": "server";
     readonly "memory.layer_locked_legacy": "server";
     readonly "server.model_unreachable": "server";
+    readonly "permission.entry_mode_clamped": "server";
 };
 /** Compile-time fence: every catalogued code has a minter row (and, via `satisfies`, only those). */
 export type MinterTableCoversEveryNoticeCode = AssertAllKeysHandled<Exclude<EngineNoticeCode, keyof typeof NOTICE_MINTER_TABLE>>;

package/dist/core/governance-codes.js

@@ -128,6 +128,7 @@ export const ENGINE_NOTICE_CODES = Object.freeze([
     "config.read_face_deployment_clamped",
     "config.write_face_swapped",
     "config.write_face_deployment_clamped",
+    "config.read_deny_swapped",
     "config.tool_model_gate_removed",
     "config.tool_model_gate_unknown_class",
     "config.tool_model_gate_env_invalid",
@@ -205,10 +206,12 @@ export const ENGINE_NOTICE_CODES = Object.freeze([
     "skills.listing_truncated",
     "agents.listing_truncated",
     "tool_result.offload_put_failed",
+    "tool_result.media_refused",
     "instructions.source_changed",
     "session.records_skipped",
     "memory.layer_locked_legacy",
     "server.model_unreachable",
+    "permission.entry_mode_clamped",
 ]);
 const NOTICE_AUDIENCE_TABLE = {
     "memory.session_polluted": "user",
@@ -254,6 +257,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.read_face_deployment_clamped": "operator",
     "config.write_face_swapped": "operator",
     "config.write_face_deployment_clamped": "operator",
+    "config.read_deny_swapped": "operator",
     "config.tool_model_gate_removed": "operator",
     "config.tool_model_gate_unknown_class": "operator",
     "config.tool_model_gate_env_invalid": "operator",
@@ -296,10 +300,12 @@ const NOTICE_AUDIENCE_TABLE = {
     "skills.listing_truncated": "operator",
     "agents.listing_truncated": "operator",
     "tool_result.offload_put_failed": "operator",
+    "tool_result.media_refused": "operator",
     "config.forward_sink_failed": "operator",
     "instructions.source_changed": "user",
     "session.records_skipped": "user",
     "server.model_unreachable": "user",
+    "permission.entry_mode_clamped": "user",
     "memory.layer_locked_legacy": "operator",
 };
 export const NOTICE_AUDIENCE = NOTICE_AUDIENCE_TABLE;
@@ -316,6 +322,7 @@ const NOTICE_MINTER_TABLE = {
     "config.read_face_deployment_clamped": "engine",
     "config.write_face_swapped": "engine",
     "config.write_face_deployment_clamped": "engine",
+    "config.read_deny_swapped": "engine",
     "config.tool_model_gate_removed": "engine",
     "config.tool_model_gate_unknown_class": "engine",
     "config.tool_model_gate_env_invalid": "engine",
@@ -393,9 +400,11 @@ const NOTICE_MINTER_TABLE = {
     "skills.listing_truncated": "engine",
     "agents.listing_truncated": "engine",
     "tool_result.offload_put_failed": "engine",
+    "tool_result.media_refused": "engine",
     "instructions.source_changed": "server",
     "session.records_skipped": "server",
     "memory.layer_locked_legacy": "server",
     "server.model_unreachable": "server",
+    "permission.entry_mode_clamped": "server",
 };
 export const NOTICE_MINTER = Object.freeze(NOTICE_MINTER_TABLE);

package/dist/core/hooks.d.ts

@@ -1131,7 +1131,7 @@ export interface PersistedRuleHit {
  * design/252 G-2 — the answer a lane gives when it could not READ its store, or a partition of it (no `reason`; the CALL form is `reason`'s).
  *
  * The store form fails CLOSED: a deny or ask row inside what could not be read may forbid this call and an allow beside it
- * is no yes, so the decision becomes a real-approval ask (origin `rule_store_unavailable`, class `governance_unavailable`:
+ * is no yes, so the decision becomes a real-approval ask (origin `rule_store_unavailable`, class `rule_unreadable`:
  * no automatic lane clears it, `bypassPermissions` keeps it for a person, headless it is refused) until a read succeeds
  * again; a deny or ask row that WAS read still stands. The RECORD says `"unavailable"`, not `"no_match"`; the lane
  * announces the skipped partition once per run.
@@ -1139,9 +1139,9 @@ export interface PersistedRuleHit {
 export interface PersistedRuleUnreadable {
     readonly unreadable: true;
     /** WHY the lane could not read: absent for a store (or partition) read failure — the store form, a real-approval ask of
-     *  class `governance_unavailable`; for a CALL the lane could not read against the person's standing deny/ask rows (an
+     *  class `rule_unreadable`; for a CALL the lane could not read against the person's standing deny/ask rows (an
      *  expansion where a rule reads a word, an unterminated quote, a syntax error) the lexer's reason — the call form, an allow
-     *  tightens to a real-approval ask of class `rule_unreadable`. Both carry the origin `rule_store_unavailable`. */
+     *  tightens to a real-approval ask of the same class. Both carry the origin `rule_store_unavailable`. */
     readonly reason?: string;
 }
 /**
@@ -1457,7 +1457,7 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
      * small-model policy CLASSIFIER before any human/durable resolution:
      *  - verdict `allow` → the ask resolves to allow (`decisionReason:"classifier"`) — no suspend, no onAsk;
      *  - verdict `block` → deny (`decisionReason:"classifier"`, `source:"classifier"`; CC `automode-blocked`); `parse_error` too;
-     *  - `unavailable` → where `unavailable.approvalSeat` (a person, live or parked) the ask goes on, its text saying why;
+     *  - `unavailable` → where `unavailable.route` names a person (`live_approver`, or `durable_park`) the ask goes on, its text saying why;
      *    else CC's refusal (`cause: "unavailable"`). Never counted by the denial limit (`classifierUnavailableArm`).
      * SCOPE (declared semantic): this covers every surviving ask INCLUDING the deterministic egress/
      * irreversibility safety tightens — auto mode is the deployment's explicit choice to let the

package/dist/core/hooks.js

@@ -1,4 +1,4 @@
-import { abortedSeatDeny, decisionText, describeThrown, receiveHookResult, isEngineRefusal } from "./tool-policy.js";
+import { decisionText, describeThrown, receiveHookResult, isEngineRefusal, unaskedSeatAnswer } from "./tool-policy.js";
 import { asThrownError } from "./thrown-value.js";
 import { createSettlementLedger, engineFailClosedExit, hookDenyExit } from "./runner/gate-exit.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
@@ -196,8 +196,9 @@ function screenPreToolUseResult(r) {
 export function createPreToolUseConstraintPolicy(preToolUse, env, onCrash, timeoutMs) {
     return brandPolicyAskClass({
         check: async (req, signal) => {
-            if (signal?.aborted)
-                return abortedSeatDeny(req, `the inherited PreToolUse screening of "${req.toolName}" was not consulted: the run or turn was already interrupted`, "hook");
+            const unasked = unaskedSeatAnswer(req, signal, { aborted: `the inherited PreToolUse screening of "${req.toolName}" was not consulted: the run or turn was already interrupted`, unreachable: `the inherited PreToolUse screening of "${req.toolName}" was not consulted: nobody can be asked about this call` }, "hook");
+            if (unasked !== undefined)
+                return unasked;
             let r;
             const boundMs = resolveHookTimeoutMs(timeoutMs, onCrash);
             try {

package/dist/core/mcp-connection-pool.d.ts

@@ -54,6 +54,8 @@ export declare class McpConnectionPool {
     /**
      * The key a declaration leases under. `kind` is the dial's own single reading of the transport kind (the dial reads it once and threads it, so a
      * transport object that answers differently to two readers cannot split the dial from its key); every other transport member is read here.
+     * The declaration's mount identity (`fingerprint`) is part of the key when declared: the revocation probe is asked with it, so two mounts the
+     * host tells apart never share one connection (an undeclared fingerprint leaves the key as it always was).
      */
     static keyOf(spec: McpServerSpec, principal: string | undefined, kind: string | undefined): string;
     /**

package/dist/core/mcp-connection-pool.js

@@ -6,7 +6,8 @@ export class McpConnectionPool {
     shut = false;
     static keyOf(spec, principal, kind) {
         const rest = Object.fromEntries(Object.keys(spec.transport).filter((k) => k !== "kind").map((k) => [k, Reflect.get(spec.transport, k)]));
-        return canonicalize([spec.name, kind ?? null, rest, principal ?? null]);
+        const fingerprint = spec.fingerprint;
+        return canonicalize(fingerprint === undefined ? [spec.name, kind ?? null, rest, principal ?? null] : [spec.name, kind ?? null, rest, principal ?? null, fingerprint]);
     }
     async acquire(key, dial, opts) {
         if (this.shut)

package/dist/core/mcp-failure.js

@@ -72,6 +72,7 @@ export function networkErrorCode(err, depth = 0) {
     return networkErrorCode(err.cause, depth + 1);
 }
 const isNodeErrCode = (code) => code.startsWith("ERR_");
+const isDeclarationFault = (code) => code === "ERR_INVALID_URL" || (typeof code === "string" && code.startsWith("config."));
 export const FAILURE_CLASSIFIER = [
     {
         name: "sdk connection closed",
@@ -100,7 +101,7 @@ export const FAILURE_CLASSIFIER = [
     },
     {
         name: "malformed declaration",
-        when: (err, at) => at.phase === "connect" && err instanceof Error && err.code === "ERR_INVALID_URL",
+        when: (err, at) => at.phase === "connect" && err instanceof Error && isDeclarationFault(err.code),
         reads: () => ({ kind: "invalid_config" }),
     },
     {

package/dist/core/mcp-server-spec.d.ts

@@ -33,8 +33,9 @@ export interface McpServerSpec {
          * Per-task **end-user principal** header (design/62). When set, the Runner injects the running task's
          * authenticated {@link TaskSpec.principal} as this header (e.g. `"X-Agent-Principal"`) on every call to
          * this server's tools, so the MCP server can enforce per-user RBAC. Absent {@link TaskSpec.principal}
-         * ⇒ the header is **not** sent (the MCP server must default to deny/public, never admin). Overrides any
-         * same-named static `headers` entry. The principal is Runner-held and the model/worker can neither read
+         * ⇒ the header is **not** sent (the MCP server must default to deny/public, never admin). A static `headers`
+         * entry under the same name in any case refuses this server at its dial (`config.protocol_header_collision`,
+         * header names being case-insensitive). The principal is Runner-held and the model/worker can neither read
          * nor set it (it is not a tool argument) — see {@link TaskSpec.principal}.
          */
         principalHeader?: string;
@@ -136,6 +137,24 @@ export interface McpServerSpec {
      * plane and needs no such gate.
      */
     contentOrigin?: ToolContentOrigin;
+    /**
+     * The host's identity of THIS MOUNT of the server — a non-empty string (≤ 128 characters) the host
+     * minted from the declaration; the engine computes nothing from it and reads nothing off it. When present
+     * it rides the revocation probe ({@link McpRevocationLedger.isRevoked}) as the second argument, so the
+     * host can tell one mount generation of a server from a re-declared one under the same name. Absent ⇒
+     * the probe is asked with the name alone. Any other value refuses this server at its dial
+     * (`config.mcp_fingerprint_invalid`).
+     */
+    fingerprint?: string;
+}
+/** The identity of one mount of a declared server, as the host minted it ({@link McpServerSpec.fingerprint}). */
+export interface McpMountIdentity {
+    readonly fingerprint: string;
+}
+/** The host's MCP revocation ledger ({@link RunnerDeps.mcpRevocations}) — declared once, read by every MCP dispatch outlet. */
+export interface McpRevocationLedger {
+    /** Synchronous. `mount` is passed exactly when the server's declaration carries a `fingerprint`. */
+    isRevoked(serverName: string, mount?: McpMountIdentity): boolean;
 }
 /**
  * Definition of one A2A (agent-to-agent protocol) PEER to talk to for the duration of one task.
@@ -157,14 +176,17 @@ export interface A2aServerSpec {
     /** Explicit agent-card location, when the peer does not publish at a well-known path. Set ⇒ it is used
      *  ALONE (no well-known probing behind the operator's back). */
     cardUrl?: string;
-    /** Static headers sent on every request to this peer (e.g. an auth bearer). */
+    /** Static headers sent on every request to this peer (e.g. an auth bearer). They travel only to the
+     *  declared origins (`url`, `cardUrl`): a card naming an endpoint on another origin refuses the peer
+     *  (`config.protocol_endpoint_unbound`), and a redirect is not followed. */
     headers?: Record<string, string>;
     /**
      * Per-task **end-user principal** header (design/62), same contract as the MCP side: when set, the
      * Runner injects the running task's authenticated {@link TaskSpec.principal} under this header name on
      * every call to this peer, so the peer can enforce per-user authorization. Absent principal ⇒ the
-     * header is not sent (the peer must then default to deny/public, never admin). Overrides any same-named
-     * static entry in {@link headers}. The principal is Runner-held: the model can neither read nor set it.
+     * header is not sent (the peer must then default to deny/public, never admin). A static entry in
+     * {@link headers} under the same name in any case refuses the peer (`config.protocol_header_collision`).
+     * The principal is Runner-held: the model can neither read nor set it.
      */
     principalHeader?: string;
     /** Optional allowlist of skill ids to expose (others are not mounted). */