@sema-agent/core 7.50.1 → 7.51.0

package/dist/core/mcp.d.ts

@@ -1,10 +1,11 @@
-import { type ProtocolId } from "./protocol-table.js";
+import { type McpInstructionsEntry, type PromptSectionSeat } from "./prompt-section-seat.js";
 import { McpConnectionPool } from "./mcp-connection-pool.js";
 import { type McpDelivered, type McpFailureKind, type McpServerLiveness } from "./mcp-failure.js";
 import type { AgentTool } from "../internal/harness-types.js";
 import type { ImageContent, TextContent } from "../internal/llm.js";
 import { type McpImageResizer } from "./image-downsample.js";
 import type { McpServerSpec, OnElicit, ToolEffect } from "./types.js";
+import type { McpRevocationLedger } from "./mcp-server-spec.js";
 import { type ReminderDisclosureCounts } from "./reminder-disclosure.js";
 export { resolveMcpDeclaredResultSize } from "./mcp-tool-meta.js";
 /**
@@ -100,13 +101,11 @@ export interface MaterializedMcp {
     toolAxes: McpToolAxis[];
     /**
      * MCP server `instructions` (design/64 §17.3, CC `# MCP Server Instructions`): the optional guidance a
-     * connected server returns from `initialize`. The Runner injects these into the (stable) system prompt so
-     * the model uses the server's tools correctly. One entry per server that provided non-empty instructions.
+     * connected server returns from `initialize`, after the host's disposition (`PromptProvider.section`,
+     * applied once at the dial: a dropped entry is absent, a replaced one carries `author: "host"`). The
+     * Runner injects these into the (stable) system prompt. One entry per server whose entry survived.
      */
-    serverInstructions: Array<{
-        server: string;
-        text: string;
-    }>;
+    serverInstructions: McpInstructionsEntry[];
     /**
      * G1 通告层续批 (CC `mcp_instructions_delta` parity) — the run-scoped instruction-delta ref the run
      * loop drains at turn boundaries (`spec.attachments.mcpInstructions` opt-in; `newTools` consumption
@@ -121,15 +120,12 @@ export interface MaterializedMcp {
      *   CC deviation: prefix-cache-correct).
      */
     instructionsDelta: {
-        pendingAdds: Array<{
-            server: string;
-            text: string;
-        }>;
+        pendingAdds: McpInstructionsEntry[];
         pendingRemovals: string[];
     };
     /**
      * The OPERATOR warning lane for this materialization (the Runner forwards each entry to
-     * `onError(phase:"mcp")`). Empty when every server connected and listed completely. Two populations,
+     * `onError(phase:"mcp")`). Empty when every server connected and listed completely. Populations,
      * distinguishable by the `code` each Error carries — a consumer must NOT read mere presence as "this
      * server was skipped":
      *  - `mcp.server_unavailable` — a server that failed to connect / list its tools and was SKIPPED
@@ -138,7 +134,9 @@ export interface MaterializedMcp {
      *  - `mcp.listing_incomplete` — a server that DID connect but whose `tools/list` pagination walk did
      *    not reach the end ({@link McpListingIncomplete}): its tools past the stopping point are not
      *    mounted this task, which is a capability loss the operator must see rather than infer from a
-     *    short tool list.
+     *    short tool list;
+     *  - `prompt.section_answer_invalid` — the host's disposition of a CONNECTED server's instructions
+     *    could not be read, so the entry was included as computed.
      */
     warnings: Error[];
     /**
@@ -471,28 +469,6 @@ export * from "./image-downsample.js";
  * type, ≤10 object entries then `, ...`.
  */
 export declare function inferCompactSchema(value: unknown, depth?: number): string;
-/** The per-peer HTTP auth declaration every protocol spec carries in the same two fields — the static
- *  headers the deployment configured, and the header name the per-task principal rides on (design/62).
- *  Named rather than inlined because it is a cross-module signature: {@link McpServerSpec}'s http
- *  transport and A2A's peer spec both satisfy it, and the resolver below serves both. */
-export interface ProtocolHttpAuth {
-    headers?: Record<string, string>;
-    principalHeader?: string;
-}
-/**
- * Resolve the HTTP request headers for one remote PEER of `protocol`, injecting the per-task end-user
- * principal (design/62). The principal is added **only** when the spec declares a `principalHeader` AND a
- * `principal` is present; it is injected **last** so it overrides any same-named static header; an absent
- * principal sends no such header (the remote must then default to deny/public, never admin). Pure +
- * exported for testing and so a consumer can verify what its config sends.
- *
- * Shared across protocols (A2A reuses it verbatim), which is why the failure names its protocol from the
- * ARGUMENT rather than from a hard-coded literal: a copy of this guard per protocol is exactly the
- * "second mint" shape whose copies stop tracking each other. Callers must invoke it INSIDE their per-peer
- * boundary — the throw is one peer's configuration defect, and the surrounding per-peer catch is what
- * turns it into a skipped peer instead of a failed task.
- */
-export declare function resolveProtocolHttpHeaders(protocol: ProtocolId, t: ProtocolHttpAuth, principal?: string): Record<string, string> | undefined;
 /** `kind` is the dial's ONE read of `spec.transport.kind` (taken by the caller beside the dial and threaded
  *  here, to the idle bucket and to the failure classifier alike): a nested `transport` object is the
  *  caller's, and a getter that answered differently to two readers would otherwise connect over one
@@ -624,13 +600,12 @@ export declare function materializeMcpTools(specs: McpServerSpec[], principal?:
 reminderDisclosure?: {
     reminderMark?: string;
     counts?: ReminderDisclosureCounts;
-}, mcpRevocations?: {
-    isRevoked(serverName: string): boolean;
+}, mcpRevocations?: McpRevocationLedger & {
     onProbeFailure?: (error: unknown) => void;
 }, poolOpts?: {
     pool: McpConnectionPool;
     ownsPool?: boolean;
-}): Promise<MaterializedMcp>;
+}, promptSections?: PromptSectionSeat): Promise<MaterializedMcp>;
 /**
  * Fold the caller's AUTHORITATIVE per-tool override (design F: caller = trust root) over the server-hint axis.
  * Unlike server hints, the caller may RAISE or LOWER any axis: `effect` sets the repeat-safety class (lower to

package/dist/core/mcp.js

@@ -1,7 +1,9 @@
-import { redactSecrets } from "./untrusted-egress.js";
+import { egressText } from "./untrusted-egress.js";
 import { __resetEnvKnobAnnouncements } from "./env-knob-announce.js";
 import { resolveEnvBudget } from "./env-budget.js";
 import { MCP_NAMESPACE } from "./protocol-table.js";
+import { resolveProtocolHttpHeaders } from "./protocol-http-auth.js";
+import { disposeSectionEntry, sectionAnswerWarning } from "./prompt-section-seat.js";
 import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolName, normalizeNameSegment } from "./protocol-naming.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { McpConnectionPool } from "./mcp-connection-pool.js";
@@ -179,7 +181,7 @@ export function collapseMcpErrorPrefix(message) {
 function sanitizeMcpErrorTextInPlace(err) {
     if (!(err instanceof Error))
         return;
-    const sanitized = redactSecrets(err instanceof McpError ? collapseMcpErrorPrefix(err.message) : err.message);
+    const sanitized = egressText("same-principal", err instanceof McpError ? collapseMcpErrorPrefix(err.message) : err.message);
     if (sanitized !== err.message)
         err.message = sanitized;
 }
@@ -190,7 +192,7 @@ function namedMcpFailureText(err) {
 }
 function remoteErrorText(err, opts) {
     const raw = thrownText(err);
-    return redactSecrets(opts?.collapse === true ? collapseMcpErrorPrefix(raw) : raw);
+    return egressText("same-principal", opts?.collapse === true ? collapseMcpErrorPrefix(raw) : raw);
 }
 function writeEffectWarning(writeEffect) {
     return writeEffect
@@ -372,14 +374,6 @@ export function inferCompactSchema(value, depth = 2) {
     }
     return typeof value;
 }
-export function resolveProtocolHttpHeaders(protocol, t, principal) {
-    if (t.principalHeader && principal !== undefined) {
-        if (/[\r\n]/.test(principal))
-            throw new Error(`${protocol}: principal must not contain CR/LF (header injection guard)`);
-        return { ...t.headers, [t.principalHeader]: principal };
-    }
-    return t.headers;
-}
 export const declaredEndpointFetch = (url, init) => fetch(url, { ...init, redirect: "manual" });
 function buildTransport(spec, principal, kind) {
     const t = spec.transport;
@@ -408,8 +402,10 @@ export async function mapContent(content, serverName, imageResizer) {
         if (item.type === "text" && typeof item.text === "string") {
             out.push({ type: "text", text: item.text });
         }
-        else if (item.type === "image" && item.data && item.mimeType) {
-            out.push(await boundedImageBlock(item.data, item.mimeType, serverName, resizer));
+        else if (item.type === "image") {
+            const data = typeof item.data === "string" ? item.data : "";
+            const mimeType = typeof item.mimeType === "string" ? item.mimeType : "";
+            out.push(data !== "" && mimeType !== "" ? await boundedImageBlock(data, mimeType, serverName, resizer) : { type: "image", data, mimeType });
         }
         else if (item.type === "audio" && typeof item.data === "string" && item.data) {
             out.push(await blobToTextBlock(item.data, item.mimeType, serverName, `[Audio from ${serverName ?? "MCP server"}] `));
@@ -660,7 +656,7 @@ export function mcpToolSchemaProblem(schema) {
     }
     return undefined;
 }
-export async function materializeMcpTools(specs, principal, onElicit, imageResizer, reminderDisclosure, mcpRevocations, poolOpts) {
+export async function materializeMcpTools(specs, principal, onElicit, imageResizer, reminderDisclosure, mcpRevocations, poolOpts, promptSections) {
     const entries = snapshotMcpEntries(specs);
     {
         const collision = findNamespacePrefixCollision(MCP_NAMESPACE, entries.map((s) => s.name));
@@ -678,7 +674,8 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
         if (mcpRevocations === undefined)
             return false;
         try {
-            const r = mcpRevocations.isRevoked(serverName);
+            const fingerprint = entries.find((e) => e.name === serverName)?.fingerprint;
+            const r = fingerprint === undefined ? mcpRevocations.isRevoked(serverName) : mcpRevocations.isRevoked(serverName, { fingerprint });
             if (typeof r !== "boolean") {
                 throw new Error(`isRevoked returned ${r instanceof Promise ? "a Promise — the ledger seat is SYNCHRONOUS by contract" : `a non-boolean (${typeof r})`}`);
             }
@@ -751,6 +748,8 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
             droppedTools.push({ server: inlineUntrusted(spec.name, 160), ...d });
         for (const a of s.schemaAdvisories)
             raised.push(schemaAdvisoryWarning(spec.name, a.tool, a.reason));
+        if (s.instructionsDefect !== undefined)
+            raised.push(sectionAnswerWarning(s.instructionsDefect));
         if (s.toolsCapabilityAbsent === true && spec.allowTools !== undefined && spec.allowTools.length > 0) {
             raised.push(toolsCapabilityAbsentWarning(spec.name));
         }
@@ -791,7 +790,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
             hadPendingAdd = true;
         }
         if (after !== undefined) {
-            instructionsDelta.pendingAdds.push({ server: name, text: after });
+            instructionsDelta.pendingAdds.push(after);
             return;
         }
         if (connected)
@@ -799,7 +798,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
         if (before !== undefined || owedRemoval || hadPendingAdd)
             instructionsDelta.pendingRemovals.push(name);
     };
-    const settled = await Promise.allSettled(entries.map((spec, i) => connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure, isServerRevoked, dialKinds[i], poolOpts?.pool)));
+    const settled = await Promise.allSettled(entries.map((spec, i) => connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure, isServerRevoked, dialKinds[i], poolOpts?.pool, { sections: promptSections })));
     try {
         for (let i = 0; i < entries.length; i++) {
             const r = settled[i];
@@ -808,9 +807,8 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
                 const s = r.value;
                 tools.push(...s.tools);
                 toolAxes.push(...s.axes);
-                if (s.instructions) {
-                    serverInstructions.push({ server: spec.name, text: s.instructions });
-                }
+                if (s.instructions)
+                    serverInstructions.push(s.instructions);
                 commitConnectedServer(spec, s, dialKinds[i]);
             }
             else {
@@ -857,7 +855,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
             const dialKind = readDialKind(spec);
             let connected;
             try {
-                connected = await connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure, isServerRevoked, dialKind, poolOpts?.pool, { fresh: true });
+                connected = await connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure, isServerRevoked, dialKind, poolOpts?.pool, { fresh: true, sections: promptSections });
             }
             catch (err) {
                 const { kind, delivered, httpStatus } = classifyMcpFailure(err, { phase: "connect", transport: dialKind });
@@ -1523,6 +1521,10 @@ async function listToolsLenient(client, options) {
     return { tools: walk.items, ...(walk.incomplete !== undefined ? { incomplete: walk.incomplete } : {}) };
 }
 async function connectServer(spec, principal, onElicit, imageResizer, reminderDisclosure, isServerRevoked, transportKind, pool, dialOpts) {
+    const fp = spec.fingerprint;
+    if (fp !== undefined && !(typeof fp === "string" && fp.length > 0 && fp.length <= 128)) {
+        throw Object.assign(new Error(`MCP server "${inlineUntrusted(spec.name, 160)}": fingerprint must be a non-empty string of at most 128 characters (got ${typeof fp === "string" ? `${fp.length} characters` : typeof fp}) — not dialed`), { code: "config.mcp_fingerprint_invalid" });
+    }
     const elicitOn = spec.elicitation === true && onElicit !== undefined;
     const health = { dead: false, pendingElicitations: 0, lastElicitationClosedAt: 0 };
     const announce = {};
@@ -1588,7 +1590,9 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
             }
             : undefined;
         const rawInstructions = client.getInstructions();
-        const instructions = rawInstructions && rawInstructions.trim() ? sanitizeUntrustedText(rawInstructions.trim()) : undefined;
+        const sanitized = rawInstructions && rawInstructions.trim() ? sanitizeUntrustedText(rawInstructions.trim()) : undefined;
+        const disposed = sanitized === undefined ? undefined : disposeSectionEntry(dialOpts?.sections, { section: "core/discovery.mcp-instructions", server: spec.name, text: sanitized, mountedTools: serverTools.map((t) => t.name) });
+        const instructions = disposed?.kept === undefined ? undefined : { server: spec.name, ...disposed.kept };
         const info = client.getServerVersion();
         const status = {
             name: spec.name,
@@ -1611,6 +1615,7 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
             ...(listed.toolsCapabilityAbsent === true ? { toolsCapabilityAbsent: true } : {}),
             listedTools: listed.tools,
             ...(instructions ? { instructions } : {}),
+            ...(disposed?.defect !== undefined ? { instructionsDefect: disposed.defect } : {}),
             ...(listed.incomplete !== undefined ? { listingIncomplete: listed.incomplete } : {}),
             ...(resourceInfo && (resourceInfo.listAllowed || resourceInfo.readAllowed) ? { resourceServer: { server: spec.name, client, health, transportKind: idleKindOf(transportKind), ...resourceInfo } } : {}),
         };
@@ -1761,7 +1766,7 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
                     const errScLine = structuredContentErrorLine(res.structuredContent, parts.join("\n"));
                     if (errScLine !== undefined)
                         parts.push(errScLine);
-                    const body = truncateMcpErrorText(redactSecrets(parts.join("\n").trim()));
+                    const body = truncateMcpErrorText(egressText("same-principal", parts.join("\n").trim()));
                     const msg = body
                         ? `MCP tool ${inlineUntrusted(remoteName)} reported an error. The server's error content follows as external/untrusted data:\n${delimitUntrusted(`${spec.name} tool error`, body)}`
                         : `MCP tool ${inlineUntrusted(remoteName)} reported an error`;

package/dist/core/media-byte-cap.d.ts

@@ -24,6 +24,31 @@ export declare function mediaBudgetBytes(cap: number | undefined): number;
  *  (`0` and `Infinity` both mean "no budget"). A non-number, `NaN` or a negative is refused (`config.invalid_argument`),
  *  never read as "no budget". */
 export declare function checkedMediaByteCap(value: unknown, seat: string): void;
+/** A media block: an image or a document whose payload is a base64 string. */
+export type MediaBlock = ImageContent | DocumentContent;
+/** The media type a block claims — its `type`, read once, when that is a media type — or `undefined` for any other value. */
+export declare function claimedMediaType(block: unknown): MediaBlock["type"] | undefined;
+/** Whether a value is a media block: its `type` is a media type and its `data` a string. A block of a media type with no
+ *  string `data` is not one — a {@link MediaDescriptor} is such a block. */
+export declare function isMediaBlock(block: unknown): block is MediaBlock;
+/** What media becomes where its bytes do not ride: one block's identity (its type, its media type when it can be one, its
+ *  decoded size), or one summary of every block from there on. Never a string, never the bytes. */
+export type MediaDescriptor = {
+    type: MediaBlock["type"];
+    mimeType?: string;
+    bytes: number;
+    truncated: true;
+} | {
+    type: "omitted";
+    blocks: number;
+    bytes: number;
+    truncated: true;
+};
+/** A media block's descriptor. The media type is echoed only when it can be one (RFC 6838: type and subtype are at most
+ *  127 characters each); `bytes` is {@link imageBytes}. */
+export declare function mediaBlockDescriptor(block: MediaBlock): MediaDescriptor;
+/** The one summary of media blocks that leave together: how many, and their decoded size. */
+export declare function omittedMediaDescriptor(blocks: readonly MediaBlock[]): MediaDescriptor;
 /** Decoded byte size of a base64 media payload (4 base64 chars ≈ 3 bytes). Approximate — fine for a budget.
  *  PDF read: `document` blocks (base64 PDFs) count against the SAME aggregate budget — same class of inline
  *  media bytes, same unbounded-accumulation failure mode. */

package/dist/core/media-byte-cap.js

@@ -1,4 +1,5 @@
 import { describeRejectedValue } from "./tool-search-setting.js";
+import { readMember } from "./thrown-value.js";
 export const AGGREGATE_MEDIA_BUDGET_BYTES = 30 * 1024 * 1024;
 export function mediaBudgetBytes(cap) {
     const limit = cap ?? AGGREGATE_MEDIA_BUDGET_BYTES;
@@ -12,6 +13,21 @@ export function checkedMediaByteCap(value, seat) {
     throw e;
 }
 const MEDIA_STRIPPED_MARKER = "[media removed to fit the request media budget — re-read the file if you still need to see it]";
+const MEDIA_BLOCK_TYPES = new Set(["image", "document"]);
+export function claimedMediaType(block) {
+    const type = readMember(block, "type");
+    return MEDIA_BLOCK_TYPES.has(type) ? type : undefined;
+}
+const mediaTyped = (b) => claimedMediaType(b) !== undefined;
+export function isMediaBlock(block) {
+    return mediaTyped(block) && typeof readMember(block, "data") === "string";
+}
+export function mediaBlockDescriptor(block) {
+    return { type: block.type, ...(typeof block.mimeType === "string" && block.mimeType.length <= 255 ? { mimeType: block.mimeType } : {}), bytes: imageBytes(block), truncated: true };
+}
+export function omittedMediaDescriptor(blocks) {
+    return { type: "omitted", blocks: blocks.length, bytes: blocks.reduce((n, b) => n + imageBytes(b), 0), truncated: true };
+}
 export function imageBytes(b) {
     return typeof b.data === "string" ? Math.floor((b.data.length * 3) / 4) : 0;
 }
@@ -28,7 +44,7 @@ export function capAggregateMediaBytes(messages, opts) {
         const blocks = blocksOf(m);
         if (blocks)
             for (const b of blocks)
-                if (b.type === "image" || b.type === "document")
+                if (mediaTyped(b))
                     total += imageBytes(b);
     }
     if (total <= limitBytes)
@@ -43,7 +59,7 @@ export function capAggregateMediaBytes(messages, opts) {
             continue;
         let changed = false;
         const next = blocks.map((b) => {
-            if (remaining > limitBytes && (b.type === "image" || b.type === "document")) {
+            if (remaining > limitBytes && mediaTyped(b)) {
                 const bytes = imageBytes(b);
                 remaining -= bytes;
                 removedBytes += bytes;

package/dist/core/memory-engine/consolidation-driver.js

@@ -119,7 +119,7 @@ async function refuseUnlessWriteAllowed(judge, target, consequence) {
         why = `the write judge could not answer${where !== undefined ? ` at ${where}` : ""}${text(answer.cause) !== undefined ? ` (${text(answer.cause)})` : ""}${text(answer.reason) !== undefined ? `: ${text(answer.reason)}` : ""}, so whether a standing rule forbids this write is unknown`;
     else
         why = "the write judge answered something outside its closed set of verdicts";
-    throw new ConsolidationRefusedError(CONSOLIDATION_WRITE_REFUSED_CODE, `memory consolidation refused for scope ${inlineUntrusted(target.scope, 80)} (${inlineUntrusted(target.path, 200)}): ${why}${consequence !== undefined ? ` — ${consequence}` : ""}`);
+    throw new ConsolidationRefusedError(CONSOLIDATION_WRITE_REFUSED_CODE, `memory consolidation refused for scope ${inlineUntrusted(target.scope, 80)}: ${why}${consequence !== undefined ? ` — ${consequence}` : ""} (library ${inlineUntrusted(target.path, 200)})`);
 }
 const MAX_THROTTLE_WAITS_PER_SNAPSHOT = 4;
 const MAX_BUSY_WAITS = 2;

package/dist/core/mode-policy.d.ts

@@ -19,6 +19,7 @@ import type { PermissionResult, ToolCallRequest, ToolPolicy } from "./tool-polic
 import { type ToolRoster } from "./tool-roster.js";
 import { type PermissionMode } from "./ask-origin.js";
 import type { RuntimeCaps } from "./runtime-caps.js";
+import type { RunnerDeps } from "./runner-deps.js";
 import { recordedModeSeed } from "./checkpoint-store.js";
 import type { TaskSpec } from "./task-spec.js";
 /** WHY an effective mode is not the requested one: the deployment's deny bit (`RuntimeCaps.bypassPermissions` /
@@ -196,6 +197,20 @@ export interface PermissionModeArming {
      *  or a rejection from it is contained. */
     readonly onArmFault?: (error: unknown) => void;
 }
+/**
+ * The auto-mode classifier FACE a leg arms from — ONE reading for the arming fact ({@link PermissionModeArming.autoFacePresent}),
+ * the arming itself and the face this leg hands its children: the leg's own deployment face (`RunnerDeps.autoMode`), else
+ * the face its ancestor armed from, riding the trusted chain (`InheritedGate.autoModeFace`). A delegated child whose own
+ * runner wires no face is classified from its ancestor's deployment face — each of a subagent's actions goes through the
+ * same decision order as the parent's — on the child's own transcript and model; the child's own face wins where it has one.
+ */
+export declare function autoModeFaceOf(deps: Pick<RunnerDeps, "autoMode">, inherited: InheritedAutoModeFace | undefined): RunnerDeps["autoMode"];
+/** The chain's carriage of that face (`InheritedGate` extends it). */
+export interface InheritedAutoModeFace {
+    /** The auto-mode face the spawning leg armed from — opaque half, never serialized; present only when that leg's deps (or its own
+     *  chain) carried one. A child whose runner wires no face of its own arms its classifier from it ({@link autoModeFaceOf}). */
+    autoModeFace?: RunnerDeps["autoMode"];
+}
 /** A live ceiling: the parent leg's own controller (`current` tracks the parent's steers), or a recorded word. A ceiling
  *  that can start something on a read (a controller, the engine's leg ceiling) also answers `observed` — the same word,
  *  read without starting anything; one without it is read through `current` on an observation too. */
@@ -219,8 +234,11 @@ export declare class PermissionModeController {
     private arming;
     private readonly onFold;
     private prePlan;
+    /** `onFold` hears every fold with the word the fold FOLDED — what a fold notice names: the leg's own request for the
+     *  ceiling fold (the word the parent's mode outranks); for the deployment's folds the declared word (the request after
+     *  the ceiling, or — a leg that requested nothing — the word it inherited). */
     constructor(requestedBySpec: PermissionMode | undefined, ceiling: PermissionModeCeiling | undefined, opts?: {
-        onFold?: (receipt: PermissionModeReceipt) => void;
+        onFold?: (receipt: PermissionModeReceipt, folded: PermissionMode) => void;
         prePlanMode?: PermissionMode;
     });
     /** The declared word the leg had when a steer (or the model's `EnterPlanMode`) last moved it into `plan`, while it is
@@ -249,6 +267,12 @@ export declare class PermissionModeController {
     /** The three-member answer as it stands right now. */
     receipt(): PermissionModeReceipt;
     private receiptOf;
+    /** The receipt and, when it records a fold, the word that fold folded — one declaration read for both. */
+    private answerOf;
+    /** Hand a fold to the observer with the word it folded (an answer without a fold says nothing). */
+    private announce;
+    /** The construction-time announcement: a fold the leg STARTS with (a ceiling fold, before any arming is bound). */
+    announceStart(): PermissionModeReceipt;
     /** The ceiling's source moved to another leg (the parent session's next leg); `before` is this leg's receipt under the
      *  previous one. A ceiling fold the move produced — or changed — is announced, as the construction-time fold is. */
     ceilingRebound(before: PermissionModeReceipt): void;

package/dist/core/mode-policy.js

@@ -131,6 +131,9 @@ function screenAs(field, screen) {
         throw e;
     }
 }
+export function autoModeFaceOf(deps, inherited) {
+    return deps.autoMode ?? inherited?.autoModeFace;
+}
 export class PermissionModeController {
     requestedBySpec;
     ceiling;
@@ -183,6 +186,9 @@ export class PermissionModeController {
         return this.receiptOf(false);
     }
     receiptOf(observe) {
+        return this.answerOf(observe).receipt;
+    }
+    answerOf(observe) {
         const { effective: declared, clamped } = this.declaration(observe);
         const requested = this.requested;
         const base = requested !== undefined ? { requested } : {};
@@ -197,29 +203,39 @@ export class PermissionModeController {
                         ? "operator_deny"
                         : undefined;
         if (armingFold !== undefined)
-            return { ...base, effective: "default", foldedBy: armingFold };
+            return { receipt: { ...base, effective: "default", foldedBy: armingFold }, folded: declared };
         if (clamped)
-            return { ...base, effective: declared, foldedBy: "inherited_ceiling" };
-        return { ...base, effective: declared };
+            return { receipt: { ...base, effective: declared, foldedBy: "inherited_ceiling" }, folded: requested ?? declared };
+        return { receipt: { ...base, effective: declared } };
+    }
+    announce(answer) {
+        if (answer.receipt.foldedBy !== undefined && answer.folded !== undefined)
+            this.onFold?.(answer.receipt, answer.folded);
+    }
+    announceStart() {
+        const answer = this.answerOf(false);
+        this.announce(answer);
+        return answer.receipt;
     }
     ceilingRebound(before) {
-        const after = this.receipt();
-        if (after.foldedBy === "inherited_ceiling" && (before.foldedBy !== "inherited_ceiling" || before.effective !== after.effective))
-            this.onFold?.(after);
+        const after = this.answerOf(false);
+        if (after.receipt.foldedBy === "inherited_ceiling" && (before.foldedBy !== "inherited_ceiling" || before.effective !== after.receipt.effective))
+            this.announce(after);
     }
     bindArming(arming) {
         const before = this.receipt();
         this.arming = arming;
-        const receipt = this.receipt();
-        if (receipt.foldedBy !== undefined && receipt.foldedBy !== before.foldedBy)
-            this.onFold?.(receipt);
-        return receipt;
+        const answer = this.answerOf(false);
+        if (answer.receipt.foldedBy !== before.foldedBy)
+            this.announce(answer);
+        return answer.receipt;
     }
     async steer(mode) {
         const entry = { word: mode };
         const before = this.declared;
         this.steers.push(entry);
-        const receipt = this.receipt();
+        const answer = this.answerOf(false);
+        const receipt = answer.receipt;
         const arming = this.arming;
         if (receipt.effective === "auto" && arming?.armAuto !== undefined) {
             this.armedForAuto = true;
@@ -243,8 +259,7 @@ export class PermissionModeController {
             else if (before !== "plan")
                 this.prePlan = before;
         }
-        if (receipt.foldedBy !== undefined)
-            this.onFold?.(receipt);
+        this.announce(answer);
         return receipt;
     }
 }

package/dist/core/own-property-receipt.d.ts

@@ -0,0 +1,18 @@
+/** How a refusal names the object being received. */
+export interface OwnPropertyReceiptWords {
+    /** The object, e.g. `RunnerDeps`. */
+    readonly subject: string;
+    /** One of its properties, e.g. `seat`. */
+    readonly unit: string;
+    /** When the one read happens, e.g. `at new Runner`. */
+    readonly moment: string;
+}
+/** The receipt's coded refusal. */
+export declare function receiptRefusal(message: string): Error & {
+    code: "config.invalid_argument";
+};
+/** The receipt's first look, before ANY reflection on the object (a door that must look at the caller's object before
+ *  the receipt — a retired-name door reading its prototype chain — calls this first): a Proxy is refused. */
+export declare function refuseProxy(given: object, words: OwnPropertyReceiptWords): void;
+/** Read `given` by the receipt law (module note): the plain copy, every own member taken once from its captured descriptor. */
+export declare function receiveOwnProperties<T extends object>(given: T, words: OwnPropertyReceiptWords): T;

package/dist/core/own-property-receipt.js

@@ -0,0 +1,39 @@
+import { types } from "node:util";
+export function receiptRefusal(message) {
+    const e = new Error(message);
+    e.code = "config.invalid_argument";
+    return e;
+}
+export function refuseProxy(given, words) {
+    if (types.isProxy(given))
+        throw receiptRefusal(`${words.subject} must be a plain object, not a Proxy: its ${words.unit}s are read once off its own descriptors, and a Proxy would run its traps in that read — refused rather than wired through it`);
+}
+export function receiveOwnProperties(given, words) {
+    refuseProxy(given, words);
+    const proto = Object.getPrototypeOf(given);
+    if (proto !== Object.prototype && proto !== null) {
+        throw receiptRefusal(`${words.subject} must be a plain object (its prototype is neither Object.prototype nor null): every ${words.unit} is read once as an own property, and a ${words.unit} its prototype would supply is not read — refused rather than wired without it`);
+    }
+    const captured = Object.getOwnPropertyDescriptors(given);
+    const received = Object.create(Object.prototype);
+    for (const name of Object.getOwnPropertyNames(captured)) {
+        const d = captured[name];
+        let value;
+        if (Object.hasOwn(d, "value")) {
+            value = d.value;
+        }
+        else {
+            const get = Object.hasOwn(d, "get") ? d.get : undefined;
+            try {
+                value = get === undefined ? undefined : get.call(given);
+            }
+            catch {
+                throw receiptRefusal(`${words.subject}.${name} threw while it was read ${words.moment} — a ${words.unit} is read once, here; refused rather than wired without it`);
+            }
+        }
+        Object.defineProperty(received, name, { value, enumerable: true, writable: true, configurable: true });
+    }
+    if (Object.getPrototypeOf(given) !== proto)
+        throw receiptRefusal(`${words.subject}'s prototype changed while its ${words.unit}s were read ${words.moment} — refused rather than wired from a moving object`);
+    return received;
+}

package/dist/core/permission-rule-model.d.ts

@@ -73,7 +73,7 @@
  * `Bash(git status:*)`) — the last two are strict-side divergences from upstream, registered as such.
  */
 import { type DenyFace } from "../tools/fs/read-deny.js";
-import type { AssertAllKeysHandled } from "./ask-origin.js";
+import type { AssertAllKeysHandled, RuleOffersAbsence } from "./ask-origin.js";
 import { type ToolCallLike } from "./tool-registry.js";
 import { type PathDenialEvidence, type PathFamily, type PathIdentity } from "../tools/fs/safety.js";
 import { type TargetViews } from "./path-rule-binding.js";
@@ -928,7 +928,13 @@ export declare function spelledScope<C extends {
  * coverage (the eligibility predicate's behavior conjunct). The mixed-table walk that orders the three
  * behaviors is {@link adjudicatePersistedRules}.
  */
-export declare function findAdmittingRule(rules: readonly PersistedRule[], call: {
+export declare function findAdmittingRule(rules: readonly PersistedRule[], call: AdmissionCall): readonly PersistedRule[] | undefined;
+/** Whose admission a list's allow rows answer: a GRANT (a person's recorded yes, a list that releases a call — the reference's
+ *  per-segment form, where a read-only segment of a compound allows itself) or a NARROWING (a list outside of which nothing
+ *  runs — every segment must be named by a row; nothing allows itself). The posture is the list's, never the call's. */
+export type AdmissionPosture = "grant" | "narrowing";
+/** The call {@link findAdmittingRule} / {@link commandCoverageOf} judge. */
+export interface AdmissionCall {
     tool: string;
     command: string;
     cwd: string | undefined;
@@ -938,7 +944,16 @@ export declare function findAdmittingRule(rules: readonly PersistedRule[], call:
      *  `./x` against the moved cursor, not the task root). Defaults to `cwd`; the scope/eligibility
      *  axis stays `cwd` either way. */
     execCwd?: string;
-}): readonly PersistedRule[] | undefined;
+    /** {@link AdmissionPosture}; absent = `grant`. */
+    posture?: AdmissionPosture;
+}
+/** {@link findAdmittingRule}'s answer with its miss named: the rules that cover the command, or the first segment no row covers
+ *  (`undefined` when the command cannot be read at all — the fail-closed floor). One walk; the miss is for a sentence only. */
+export declare function commandCoverageOf(rules: readonly PersistedRule[], call: AdmissionCall): {
+    readonly covering: readonly PersistedRule[];
+} | {
+    readonly uncovered: string | undefined;
+};
 /** The answer of {@link adjudicatePersistedRules}: which behavior decided, and the rule(s) it stands
  *  on — a one-element set for a deny/ask (the first table-order rule of the deciding behavior that
  *  reaches the call) and the allow direction's coverage SET ({@link findAdmittingRule}). */
@@ -1251,15 +1266,21 @@ export interface UncoveredSegmentDetail {
  */
 export declare const UNCOVERED_SEGMENT_REASON_BASELINE: Readonly<Record<UncoveredSegmentDetail["reason"], string>>;
 /**
- * design/382 §3.5-2 — the BASELINE sentence per card-level offer-ABSENCE reason (#490 修②'s typed
- * seat: `ruleOffersAbsence` on the ask and its durable park twin; the closed vocabulary is declared
- * literally at those two faces, and this table spells the same literals — the copy row is data, not
- * the type's home). Same reword-never-invert contract as the table above. The load-bearing
- * asymmetry: `mandated` must NOT point at writing rules — on a mandated ask no rule is consulted,
- * and directing a person to mint one that can never take effect is the #457④ anti-shape; the other
- * two reasons name their real outlets.
+ * design/382 §3.5-2 — the BASELINE sentence per card-level offer-ABSENCE reason (`ruleOffersAbsence` on the ask and its
+ * durable park twin; the closed set is {@link import("./ask-origin.js").RULE_OFFERS_ABSENCES}). Same reword-never-invert
+ * contract as the table above. The load-bearing asymmetries: `mandated` and `allow_outranked` must NOT point at writing
+ * rules — on a mandated ask no rule is consulted, an outranked allow shows another allow would be outranked the same way, and
+ * directing a person to mint one that can never take effect is the #457④ anti-shape; the other two reasons name their real
+ * outlets.
  */
-export declare const RULE_OFFERS_ABSENCE_BASELINE: Readonly<Record<"mandated" | "lane_cannot_speak" | "shadowed", string>>;
+export declare const RULE_OFFERS_ABSENCE_BASELINE: {
+    readonly mandated: "This approval is required by the deployment's policy each time; a rule cannot waive it.";
+    readonly allow_outranked: "An allow rule already matches this call, and this question outranks it — another allow rule would be outranked the same way; it is approved per use.";
+    readonly ask_rule_matched: "An ask-each-time rule matches this call and keeps asking — a new allow rule changes nothing while it stands; to stop being asked, review the existing ask rules.";
+    readonly lane_cannot_speak: "This card has no rule to offer for this exact command; it can be approved per use. A coverable form of what you trust can still get a rule — through a card drawn for that form, or settings.";
+};
+/** The fence over the baseline table: `never` while every word has a sentence. */
+export type OfferAbsenceBaselineCoversEveryWord = AssertAllKeysHandled<Exclude<RuleOffersAbsence, keyof typeof RULE_OFFERS_ABSENCE_BASELINE>>;
 /**
  * The offers presented on an approval card for `command` (design/375 §5.2).
  *