@sema-agent/core 7.50.2 → 7.51.0

package/dist/core/runner/prepare-project-context.d.ts

@@ -32,6 +32,8 @@ export interface PrepareProjectContextInput {
     session: Pick<StoredSession, "getBranch">;
     /** borrowed-readonly — the acquired session's id (seam ctx cache key; operator-line context). */
     sessionId: string;
+    /** borrowed-readonly — the run's id (`Prepared.runId`): the seam ctx's `runId`. */
+    runId: string;
     /** borrowed-readonly — `spec.taskId ?? sessionId`: the shared-memory tools' trusted task identity. */
     hostTaskId: string;
     /** borrowed-readonly — the FINAL task root (post-restore): the seam's `cwd`. */
@@ -63,13 +65,11 @@ export interface PrepareProjectContextInput {
     roster: RosterBuilder;
     /** borrowed-readonly — the frozen task-start tool face; only `exclude` is read (pair yield ①). */
     toolFaceSnapshot: Pick<ToolFaceSnapshot, "selector">;
-    /** borrowed-readonly — the once-per-session announcement ledger; only its deduplicated `onError`
-     *  sink is invoked (a pair's mount shape is a session-level fact, announced once). */
+    /** borrowed-readonly — the once-per-session ledger; only its deduplicated `onError` sink is invoked (a pair's mount shape is announced once). */
     onceLedger: AnnounceOnceSink;
     /** borrowed-readonly — the memory phase's engine-pair ToolSpecs (present iff the pair may mount). */
     memoryTools: ToolSpec[] | undefined;
-    /** borrowed-readonly — the memory phase's session seat; only `!== undefined` is read (the
-     *  blocked-mount disclosure fires only when a session mounted). */
+    /** borrowed-readonly — the memory phase's session seat; only `!== undefined` is read (the blocked-mount disclosure fires only then). */
     memoryEngineSession: Prepared["memoryEngineSession"];
     /** borrowed-readonly — the engine pair's early conjuncts (computed before the memory phase). */
     memorySearchToolsPlanned: boolean;

package/dist/core/runner/prepare-project-context.js

@@ -14,7 +14,7 @@ import { RosterBuilder } from "../tool-roster.js";
 import { mountedToolNames } from "../tool-name-aliases.js";
 import { asThrownError } from "../thrown-value.js";
 export async function prepareProjectContext(input) {
-    const { deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, allowedTools, allowedToolTables, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget } = input;
+    const { deps, spec, internals, session, sessionId, runId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, allowedTools, allowedToolTables, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget } = input;
     const tools = roster.tools;
     let memoryBlock = memoryBlockFromEngine;
     let instructionSources;
@@ -50,6 +50,7 @@ export async function prepareProjectContext(input) {
                 isSubagent: delegation.isNonForkChild,
                 ...(internals?.agentName ? { agentName: internals.agentName } : {}),
                 sessionId,
+                runId,
                 phase: projectMemoryPhase,
             }));
         }

package/dist/core/runner/prepare-prompt-assembly.js

@@ -65,6 +65,7 @@ export async function preparePromptAssembly(input) {
         memoryBlock,
         buildEnvBlock: (date) => buildEnvironmentContext({ ...envFacts, date }) || undefined,
         date: envFacts.date,
+        envFacts,
         ...(model.promptGuidance && model.promptGuidance.length > 0 ? { modelGuidance: model.promptGuidance.join("\n\n") } : {}),
         onWarn: (message, phase) => deps.onError?.(new Error(message), { phase, sessionId }),
         ...(centerDecls !== undefined ? { centerDeclarations: centerDecls } : {}),

package/dist/core/runner/prepare-prompt-inputs.d.ts

@@ -78,7 +78,7 @@ export interface PreparePromptInputsInput {
     };
     /** borrowed-readonly — the resolved role; only its `systemPrompt` preset is read (second source). */
     resolvedRole: Pick<ResolvedRole, "systemPrompt">;
-    /** borrowed-readonly — the materialized MCP roster; only `serverInstructions` is read (fenced). */
+    /** borrowed-readonly — the materialized MCP roster; only `serverInstructions` (the disposed entries) is read. */
     mcp: Pick<MaterializedMcp, "serverInstructions">;
     /** borrowed-readonly — the resolved model (id for the env line + the cutoff lookup). */
     model: Model;

package/dist/core/runner/prepare-prompt-inputs.js

@@ -1,13 +1,13 @@
-import { defaultPromptProvider, formatLocalDate, isValidTimeZone } from "../../prompts/default.js";
+import { formatLocalDate, isValidTimeZone, promptProviderInForce } from "../../prompts/default.js";
 import { isIsolated } from "../remote-env.js";
 import { readDateAnchor } from "./announce-once-ledger.js";
 import { probeGitStatusLane } from "./git-status-frame.js";
-import { fenceMcpServerInstructions } from "./turn-attachments.js";
+import { renderMcpInstructionsEntry } from "./turn-attachments.js";
 const ULTRA_REASONING_TIERS = new Set(["xhigh", "max"]);
 import { compactionEnabled } from "../context-settings.js";
 export async function preparePromptInputs(input) {
     const { spec, deps, failClosedReason, lockedPreflight, selfOrchestrationActive, executionEnv, reminderMark, resolvedReadFace, resolvedWriteFace, toolFaceSnapshot, promptProfile, fableMitigations, internals, thinking, ownedEnv, delegation, resolvedRole, mcp, model, externalContentTargetActive, resume, handsEnabled, taskRootFinal, additionalRootsCanonical, additionalReadRootsCanonical, sessionId, session, advertisedWritableDirs } = input;
-    const provider = spec.promptProvider ?? deps.promptProvider ?? defaultPromptProvider;
+    const provider = promptProviderInForce(spec.promptProvider, deps.promptProvider);
     const promptPolicyEnabled = Boolean(lockedPreflight.toolPolicy);
     const promptHooks = spec.hooks ?? deps.hooks;
     const promptHooksEnabled = Boolean(promptHooks?.preToolUse || promptHooks?.postToolUse);
@@ -34,7 +34,7 @@ export async function preparePromptInputs(input) {
     const userSystemPrompt = spec.systemPrompt ?? resolvedRole.systemPrompt ?? internals?.defaultSystemPrompt;
     const userAppendSystemPrompt = spec.appendSystemPrompt;
     const mcpInstructionsBlock = mcp.serverInstructions.length
-        ? `# MCP Server Instructions\n${mcp.serverInstructions.map((s) => fenceMcpServerInstructions(s.server, s.text)).join("\n\n")}`
+        ? `# MCP Server Instructions\n${mcp.serverInstructions.map(renderMcpInstructionsEntry).join("\n\n")}`
         : undefined;
     const userTz = spec.clientContext?.timeZone;
     const tzValid = userTz !== undefined && isValidTimeZone(userTz);

package/dist/core/runner/prepare-protocol-tools.d.ts

@@ -35,12 +35,13 @@ export interface PrepareProtocolToolsInput {
      *  materialize input, the RefreshMcpTools mount predicate, and whether a real client was acquired. */
     lockedPreflight: Pick<LockedPreflight, "mcp">;
     /** borrowed-readonly — the REBOUND spec. Read: `principal` (the MCP header / the A2A identity), `tools`
-     *  (the caller names both reserved-name guards check against), `a2a` (the peer entries). Never mutated. */
-    spec: Pick<TaskSpec, "principal" | "tools" | "a2a">;
+     *  (the caller names both reserved-name guards check against), `a2a` (the peer entries), `promptProvider` (with
+     *  `deps.promptProvider`: the provider in force, whose section seat disposes of each server's instructions). */
+    spec: Pick<TaskSpec, "principal" | "tools" | "a2a" | "promptProvider">;
     /** borrowed-readonly — the deployment seats the materializers and their operator faces read: `onElicit`
      *  and `mcpImageResizer` ride into the MCP intake; `onError` takes the A2A warnings (no ledger — a peer is
      *  re-read every prepare); `mcpRevocations` + `onNotice` make the revocation wiring. */
-    deps: Pick<RunnerDeps, "onElicit" | "mcpImageResizer" | "onError" | "mcpRevocations" | "onNotice">;
+    deps: Pick<RunnerDeps, "onElicit" | "mcpImageResizer" | "onError" | "mcpRevocations" | "onNotice" | "promptProvider">;
     /** borrowed-readonly — the run tree's MCP connection pool (the leg leases its connections from it) and whether THIS leg created it
      *  (then this leg's dispose also closes it). Absent for a leg that declares no server. */
     mcpPool?: {

package/dist/core/runner/prepare-protocol-tools.js

@@ -9,6 +9,7 @@ import { REFRESH_MCP_TOOLS_TOOL_NAME, toolFace } from "../tool-catalog-entries.j
 import { MCP_NAMESPACE, A2A_NAMESPACE } from "../protocol-table.js";
 import { mintNamespacePrefix } from "../protocol-naming.js";
 import { applyMcpToolFaces } from "./tool-face-overlay.js";
+import { promptProviderInForce } from "../../prompts/default.js";
 import { thrownText } from "../thrown-value.js";
 export async function prepareProtocolTools(input) {
     const { lockedPreflight, spec, deps, mcpPool, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, toolMarkSources, abortController, rollback } = input;
@@ -24,7 +25,7 @@ export async function prepareProtocolTools(input) {
         throw Object.assign(new Error(`MCP server name ${JSON.stringify(overPeer.name.slice(0, 40) + "…")} is ${overPeer.name.length} characters; a peer rides every roster row of its tools and the roster's bound on a name is ${TOOL_WIRE_NAME_MAX_CHARS}.`), { code: "config.tool_name_too_long" });
     }
     const mcp = lockedPreflight.mcp?.length
-        ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps, runId), mcpPool === undefined ? undefined : { pool: mcpPool.pool, ownsPool: mcpPool.owned })
+        ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps, runId), mcpPool === undefined ? undefined : { pool: mcpPool.pool, ownsPool: mcpPool.owned }, promptProviderInForce(spec.promptProvider, deps.promptProvider))
         :
             { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, droppedTools: [], statuses: [], refresh: async () => [], reconnect: async (server) => ({ server, prefix: mintNamespacePrefix(MCP_NAMESPACE, server), outcome: "not_declared", reason: "this task declared no MCP servers", toolCount: 0, added: [], removed: [] }), dispose: async () => { } };
     if (lockedPreflight.mcp?.length)
@@ -183,7 +184,7 @@ function mcpRevocationWiring(deps, runId) {
         return undefined;
     const ledger = deps.mcpRevocations;
     return {
-        isRevoked: (name) => ledger.isRevoked(name),
+        isRevoked: (name, mount) => (mount === undefined ? ledger.isRevoked(name) : ledger.isRevoked(name, mount)),
         onProbeFailure: (e) => deliverEngineNotice(deps.onNotice, {
             code: "mcp.revocation_probe_failed",
             message: `the mcpRevocations.isRevoked probe threw — MCP dispatch fails OPEN (no server treated as revoked) until the probe recovers: ${thrownText(e)}`,

package/dist/core/runner/prepare-task.js

@@ -101,6 +101,7 @@ import { rosterCanPersistMemory } from "../tool-registry.js";
 import { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import { resolveTaskRootCanonical } from "./task-root-canonical.js";
 import { createStructuredProjector } from "./tool-output-projection.js";
+import { toolResultMediaRefusedSeat } from "./tool-result-media-seat.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
 import { createAttachmentDelivery, refuseUserAttachmentPathsWithoutWorkspace, screenUserAttachments } from "../user-attachment.js";
 function warnCompactionWindowHazard(tracer, spec, model, compModel, hostTaskId, overlay) {
@@ -656,7 +657,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
                 deps.onError?.(asThrownError(err), { phase: "config", sessionId });
             }
         }
-        const projectContext = await prepareProjectContext({ deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, allowedTools, allowedToolTables, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget: doors.skillListingBudget });
+        const projectContext = await prepareProjectContext({ deps, spec, internals, session, sessionId, runId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, allowedTools, allowedToolTables, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget: doors.skillListingBudget });
         const { memoryBlock: memoryBlockWithProject, instructionSources, projectInstructionContent, skillSpecs, skillSeatOf, skillsListing, sharedMemoryPairMounted, memoryEnginePairMounted } = projectContext;
         const { provider, featureFlags, userSystemPrompt, userAppendSystemPrompt, mcpInstructionsBlock, envFacts, tzValid, userTz, dateAnchor, gitStatusRef } = await preparePromptInputs({ spec, deps, contextOverlay: legContextOverlay(), failClosedReason: selfOrchestrationFailClosedReason(spec, deps), lockedPreflight, selfOrchestrationActive, executionEnv, reminderMark, resolvedReadFace, resolvedWriteFace: resolvedWriteFace?.inForce(), toolFaceSnapshot, promptProfile, fableMitigations, internals, thinking, ownedEnv, delegation, resolvedRole, mcp, model, externalContentTargetActive, resume, handsEnabled, taskRootFinal, additionalRootsCanonical, additionalReadRootsCanonical: (await readRoots.ready().then(readRoots)).filter((r) => !additionalRootsCanonical.includes(r)), sessionId, session, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}) });
         judgeRunToolLists({ spec, tools: roster.tools, declaredPeers: { mcp: lockedPreflight.mcp, a2a: a2a.statuses }, own: { allow: toolFaceLists.allow, exclude: toolFaceLists.exclude }, layers: toolFaceSnapshot.selector.layers, legs: toolLegs, judgedUpstream: toolListsJudged !== undefined, ownWhere: internals?.ownToolListsWhere, onceLedger, sessionId });
@@ -705,6 +706,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         const harness = new AgentHarness({
             abortResultDetails: () => (gateStopRef.terminal !== undefined ? { code: gateStopRef.terminal.code } : parkContaminationMarker({ pausedRef })),
             onToolInputValidationFault: validateInputFaultNotice(deps.onError, sessionId),
+            onToolMediaRefused: toolResultMediaRefusedSeat(deps.onNotice, { sessionId, runId }),
             ...(spec.limits?.maxOutputTokens !== undefined && spec.limits.maxOutputTokens > 0
                 ? { maxOutputTokens: spec.limits.maxOutputTokens }
                 : {}),
@@ -771,7 +773,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
                 releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
             }
         }
-        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, ruleLanesBeyondRun, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight: installedPreflight, pathRuleAnchors: { leg: legAnchors, chainTop }, headLeads, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, personRowsBeyondRun, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, readFace: () => resolvedReadFace, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
+        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, ruleLaneFacts, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight: installedPreflight, pathRuleAnchors: { leg: legAnchors, chainTop }, headLeads, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, readFace: () => resolvedReadFace, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
         const { onAsk, preToolContexts, blockedToolCalls, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, askSeat: doors.askSeat, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox, checkpointScope });
         const writeProtectionCheck = writeProtection.mount?.check;
         writeTargetJudgeRef.current = writeProtection.judgeWriteTarget;
@@ -793,9 +795,9 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         const postureFrameRef = { report: (err) => deps.onError?.(err, { phase: "degraded", sessionId }) };
         const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, toolRosterDeltas: rosterSeat, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, contextOverlay: legContextOverlay, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
         const preparedHolder = {};
-        const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, syntheticReadVerdict, syntheticWriteVerdict, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, readRoots, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants: skillGrantLane, callerPolicy: installedToolPolicy, inheritedPolicies: (inheritedParentConstraints ?? []).map((c) => c.policy), persistedRuleLane: permissionRuleLane, ruleLanesBeyondRun, orgRuleLane: permissionRuleOrgLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
+        const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, syntheticReadVerdict, consolidationWriteJudge, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, readRoots, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants: skillGrantLane, callerPolicy: installedToolPolicy, inheritedPolicies: (inheritedParentConstraints ?? []).map((c) => c.policy), persistedRuleLane: permissionRuleLane, ruleLaneFacts, personRowsBeyondRun, orgRuleLane: permissionRuleOrgLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
-        const buildPrepared = () => ({ harness, session, sessionId, runId, registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: askSeatEffective(wiringManifest) }, ...(outputStyleFrame !== undefined ? { outputStyleFrame } : {}), permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, toolOccurrences, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(attachmentRootCanonical !== undefined ? { handsRoot: attachmentRootCanonical } : {}), ...(stampCallTarget !== undefined ? { stampCallTarget } : {}), toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), exemptRoots: legExemptRoots, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, skillGrants: skillGrantLane, skillSpecs, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), syntheticWriteVerdict, ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit && withheldDiagnosticsOf ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent, withheldOf: withheldDiagnosticsOf } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(userAttachmentsSeat !== undefined ? { userAttachments: userAttachmentsSeat } : {}), attachmentDelivery: createAttachmentDelivery(), ...(modelFileReaderSeat.current !== undefined ? { modelFileReader: modelFileReaderSeat.current } : {}), syntheticReadVerdict, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}), ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: askSeatEffective(wiringManifest) }, ...(outputStyleFrame !== undefined ? { outputStyleFrame } : {}), permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, toolOccurrences, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(attachmentRootCanonical !== undefined ? { handsRoot: attachmentRootCanonical } : {}), ...(stampCallTarget !== undefined ? { stampCallTarget } : {}), toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), exemptRoots: legExemptRoots, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, skillGrants: skillGrantLane, skillSpecs, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), consolidationWriteJudge, ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit && withheldDiagnosticsOf ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent, withheldOf: withheldDiagnosticsOf } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(userAttachmentsSeat !== undefined ? { userAttachments: userAttachmentsSeat } : {}), attachmentDelivery: createAttachmentDelivery(), ...(modelFileReaderSeat.current !== undefined ? { modelFileReader: modelFileReaderSeat.current } : {}), syntheticReadVerdict, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}), ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}) });
         refuseLateRosterChanges(callerRoster.roster);
         rollback.commit();
         commitModeSeats(abortController.signal);

package/dist/core/runner/prepare-turn-wiring.d.ts

@@ -7,7 +7,9 @@ import { type TurnPromptSnapshot } from "../../prompt-assembly/turn-snapshot.js"
 import type { PromptTextDeclaration } from "../../prompts/default.js";
 import { CacheBreakDetector, type ToolFingerprintInput } from "../cache-break-detector.js";
 import type { ToolPolicy } from "../tool-policy.js";
-import { type SyntheticReadJudge, type SyntheticWriteJudge } from "../synthetic-read-verdict.js";
+import { type SyntheticReadJudge } from "../synthetic-read-verdict.js";
+import type { ConsolidationWriteJudge } from "../memory-engine/consolidation-driver.js";
+import { type ConsolidationWriteJudgeLeg } from "./memory-consolidation-write-judge.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import { type ContainmentFace } from "../../tools/fs/index.js";
@@ -17,8 +19,9 @@ import { type ReadFileState } from "../../tools/fs/safety.js";
 import type { Prepared } from "./contracts.js";
 export interface PrepareTurnWiringInput {
     /** borrowed-readonly — the deployment seats: `cacheBreakDetection` (the detector knob), `onError` (the attachment-skip
-     *  degraded line), `promptSource` (the center candidate's state and current artifact). Receiver preserved. */
-    deps: Pick<RunnerDeps, "cacheBreakDetection" | "onError" | "promptSource">;
+     *  degraded line), `promptSource` (the center candidate's state and current artifact), `permissionRuleStore` and
+     *  `localOwnerRules` (the consolidation write judge's owner of the rows). Receiver preserved. */
+    deps: Pick<RunnerDeps, "cacheBreakDetection" | "onError" | "promptSource" | "permissionRuleStore" | "localOwnerRules">;
     /** borrowed-mutable — the LIVE system prompt (the prompt-assembly phase's accessor cell). Read: the fingerprint, the
      *  snapshot's stable text, the overhead term. Writer here: the center candidate's `apply` (the boundary swap). */
     systemPromptSeat: {
@@ -46,8 +49,9 @@ export interface PrepareTurnWiringInput {
     systemBlocks: AssembledPrompt["systemBlocks"];
     /** borrowed-readonly — the resolved thinking level, or undefined (a snapshot element). */
     thinking: ThinkingLevel | undefined;
-    /** borrowed-readonly — the REBOUND spec; only `outputSchema` (presence) and `taskId` (the snapshot's identity). */
-    spec: Pick<TaskSpec, "outputSchema" | "taskId">;
+    /** borrowed-readonly — the REBOUND spec; only `outputSchema` (presence), `taskId` (the snapshot's identity) and `principal`
+     *  (whose rows the consolidation write judge reads). */
+    spec: Pick<TaskSpec, "outputSchema" | "taskId" | "principal">;
     /** borrowed-readonly — the acquired session id (the snapshot; the attachment-skip attribution). */
     sessionId: string;
     /** borrowed-mutable — the snapshot ref the tool-disclosure phase minted. Writers: THIS phase seeds `current`; the candidate's
@@ -84,17 +88,16 @@ export interface PrepareTurnWiringInput {
     /** borrowed-readonly — the skill lane: the run's skill deny rows (a layer of the judge; only `denying` is read). */
     skillGrants: Prepared["skillGrants"];
     /** borrowed-readonly — the deployment's caller policy as resolved through the lock layer, or undefined (a layer of the
-     *  judge, consulted with an aborted signal — never an approver). */
+     *  judge, asked with a request that states nobody can be asked about it — never an approver). */
     callerPolicy: ToolPolicy | undefined;
     /** borrowed-readonly — each live inherited parent policy (a layer of the judge, consulted like the caller policy). */
     inheritedPolicies: readonly ToolPolicy[];
     /** borrowed-readonly — the person's persisted-rule lane, or undefined (a layer of the judge). */
     persistedRuleLane: Prepared["persistedRuleLane"];
-    /** borrowed-readonly — the person's and the org's lanes over the reader the run's cut does not end (the write face is asked after it). */
-    ruleLanesBeyondRun: {
-        readonly personal: Prepared["persistedRuleLane"];
-        readonly org: Prepared["permissionRuleOrg"];
-    };
+    /** borrowed-readonly — the leg's facts the rule lanes judge against: the consolidation write judge builds its two lanes on them. */
+    ruleLaneFacts: ConsolidationWriteJudgeLeg["lanes"];
+    /** borrowed-readonly — a reader of the person's rows the run's cut does not end (the consolidation judge is asked after the run). */
+    personRowsBeyondRun: ConsolidationWriteJudgeLeg["rows"];
     /** borrowed-readonly — the org rule lane, or undefined (a layer of the judge). */
     orgRuleLane: Prepared["permissionRuleOrg"];
     /** borrowed-readonly — the leg's target-reading stamp, or undefined (hands-less): the visibility judge stamps its request. */
@@ -162,8 +165,8 @@ export interface PrepareTurnWiringResult {
     /** owned — the run's ONE synthetic-Read deny judge over every layer that can refuse a model's `Read` (the
      *  changed-files door reads it; a face that delivers a file the model did not ask for reads the same one). */
     syntheticReadVerdict: SyntheticReadJudge;
-    /** owned — the same layers' WRITE face (`Prepared.syntheticWriteVerdict`): an `ask` is an objection there. */
-    syntheticWriteVerdict: SyntheticWriteJudge;
+    /** owned — the consolidation write judge (`Prepared.consolidationWriteJudge`): the same layers' WRITE face, an `ask` an objection. */
+    consolidationWriteJudge: ConsolidationWriteJudge;
     /** owned — the post-compact background-task listing (`Prepared.listBackgroundTasks`). */
     listBackgroundTasks: Prepared["listBackgroundTasks"];
     /** owned — the compaction-boundary center adoption candidate, or undefined (no source, or no adoption). */

package/dist/core/runner/prepare-turn-wiring.js

@@ -4,7 +4,8 @@ import { artifactDeclarations } from "../../prompt-assembly/artifact.js";
 import { buildTurnPromptSnapshot } from "../../prompt-assembly/turn-snapshot.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { createSyntheticReadJudge, createSyntheticWriteJudge } from "../synthetic-read-verdict.js";
+import { createSyntheticReadJudge } from "../synthetic-read-verdict.js";
+import { createConsolidationWriteJudge } from "./memory-consolidation-write-judge.js";
 import { toolCallFaceOf } from "../tool-roster.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
 import { decodeTextBytes } from "../../tools/fs/encoding.js";
@@ -14,7 +15,7 @@ import { PROMPT_HASH_SALT } from "./prompt-hash-salt.js";
 import { CHANGED_FILES_MTIME_EPS_MS } from "./turn-attachments.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareTurnWiring(input) {
-    const { deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, readRoots, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants, callerPolicy, inheritedPolicies, persistedRuleLane, ruleLanesBeyondRun, orgRuleLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder } = input;
+    const { deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, readRoots, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants, callerPolicy, inheritedPolicies, persistedRuleLane, ruleLaneFacts, personRowsBeyondRun, orgRuleLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder } = input;
     const cacheBreakDetector = deps.cacheBreakDetection === false ? undefined : new CacheBreakDetector();
     const cacheFingerprint = cacheBreakDetector
         ? { systemPrompt: systemPromptSeat.current, tools: toolsToFingerprintInputs(harnessTools) }
@@ -119,10 +120,10 @@ export function prepareTurnWiring(input) {
         ...(stampCallTarget !== undefined ? { stampCallTarget } : {}),
     };
     const syntheticReadVerdict = createSyntheticReadJudge({ ...syntheticLayers, signal: abortController.signal });
-    const syntheticWriteVerdict = createSyntheticWriteJudge({ ...syntheticLayers, ...(ruleLanesBeyondRun.personal !== undefined ? { persistedRuleLane: ruleLanesBeyondRun.personal } : {}), ...(ruleLanesBeyondRun.org !== undefined ? { orgRuleLane: ruleLanesBeyondRun.org } : {}) }, () => {
-        const p = preparedHolder.current;
-        return { face: toolCallFaceOf(p?.toolRoster, "Write"), cwd: p?.cwdRef?.current, root: p?.handsRoot, advertisedWritableDirs: p?.advertisedWritableDirs, exemptRoots: p?.exemptRoots };
-    });
+    const consolidationWriteJudge = createConsolidationWriteJudge({ ruleStoreProvider: deps.permissionRuleStore, principal: spec.principal, localOwnerDeclared: deps.localOwnerRules === true, ...(callerPolicy !== undefined ? { callerPolicy } : {}) }, { rows: personRowsBeyondRun, lanes: ruleLaneFacts, layers: { skillGrants, ...(denyNarrowingPolicy !== undefined ? { denyNarrowingPolicy } : {}), inheritedPolicies, ...(stampCallTarget !== undefined ? { stampCallTarget } : {}) }, facts: () => {
+            const p = preparedHolder.current;
+            return { face: toolCallFaceOf(p?.toolRoster, "Write"), cwd: p?.cwdRef?.current, root: p?.handsRoot, advertisedWritableDirs: p?.advertisedWritableDirs, exemptRoots: p?.exemptRoots };
+        } });
     const changedFilesReadDenied = async (paths) => {
         const deadlineAt = Date.now() + ORG_ADJUDICATION_TIMEOUT_MS;
         return Promise.all(paths.map(async (path) => (await syntheticReadVerdict({ file_path: path }, "changed-files", { deadlineAt })).verdict === "deny"));
@@ -215,5 +216,5 @@ export function prepareTurnWiring(input) {
     const effectiveReadFaceObserved = carrierReadFace();
     const effectiveWriteFaceObserved = carrierWriteFace();
     const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
-    return { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, syntheticReadVerdict, syntheticWriteVerdict, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved };
+    return { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, syntheticReadVerdict, consolidationWriteJudge, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved };
 }

package/dist/core/runner/run-harness-handlers.js

@@ -3,7 +3,7 @@ import { forwardSafely } from "./forward-sink.js";
 import { emitsChildRowFrames } from "../delegation-frames.js";
 import { emitTrace } from "../trace.js";
 import { primaryActivityArg } from "../arg-summary.js";
-import { redactSecrets } from "../untrusted-egress.js";
+import { egressText } from "../untrusted-egress.js";
 import { readDegradation } from "../../brain/degrading.js";
 import { OUTPUT_TOOL_NAME } from "./synthetic-tools.js";
 import { usageCostMicroUsd } from "./usage-accounting.js";
@@ -177,7 +177,7 @@ export function createHarnessHandlers(input) {
                         rs.counters.repetitionCuts += 1;
                     else
                         rs.counters.repetitionSpared += 1;
-                    const segment = redactSecrets(e.segment);
+                    const segment = egressText("same-principal", e.segment);
                     if (rs.counters.repetitionEvents.length < rs.counters.REPETITION_EVENTS_CAP) {
                         rs.counters.repetitionEvents.push({ turn: stats.turns + 1, action, rule: e.rule, period: e.period, reps: e.reps, segment });
                     }

package/dist/core/runner/run-leg.js

@@ -29,6 +29,7 @@ import { settleExecutionRecord } from "./execution-record.js";
 import { holdPrompt } from "./prompt-block.js";
 import { frozenInputSnapshot } from "./gate-exit.js";
 import { withGateTimeout } from "../gate-bounded-await.js";
+import { readStationAnswer } from "../shell-read-silence.js";
 import { resolveGitLegDelivery, wrapGitFrame } from "./git-leg-delivery.js";
 import { GIT_STATUS_ECHO_PREVIEW } from "./git-status-frame.js";
 import { toImageContent } from "./image.js";
@@ -39,7 +40,8 @@ import { announceToolCall, emitSettled, toolResultMsg } from "./tool-end-body.js
 import { announceListingTruncation } from "../skill-listing-budget.js";
 import { attachmentEnvelopeTags, collectDateChange, commitAgentListing, commitSkillsListing, reduceToolEnd, renderAgentListingFrame, renderOrphanedBackgroundTasks, renderSkillsListingFrame, stampWriteAnchor } from "./turn-attachments.js";
 import { flushOwedAnnouncedSnapshot } from "./announce-once-ledger.js";
-import { asThrownError, thrownMarksOf, thrownText } from "../thrown-value.js";
+import { asThrownError, thrownMarksOf } from "../thrown-value.js";
+import { egressThrownText, egressValue } from "../untrusted-egress.js";
 import { ruleSourcePhrase } from "../rule-denial-sentence.js";
 import { wireOf } from "../tool-name-readings.js";
 export async function runLeg(input) {
@@ -756,22 +758,21 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         });
         if (judged !== null) {
             let verdict;
-            let answered = true;
             try {
                 verdict = await withGateTimeout(judged, ORG_ADJUDICATION_TIMEOUT_MS, prepared.abortController.signal, "shellReadStation");
             }
             catch {
-                answered = false;
                 verdict = prepared.shellReadCheck.unanswered(readCall, "the read station could not answer on the resumed leg");
             }
-            if (!answered || verdict.disposition === "refuse" || (unseen && verdict.disposition !== "vouch")) {
-                const readDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${verdict.sentence ?? "the read boundary does not vouch for what it reads on this leg"} This approval is spent — the call has to be re-issued and approved again.`, prepared.reminderMark);
-                await settleEnd(true, { content: readDenial, ...(verdict.details !== undefined ? { details: verdict.details } : {}) }, "read_boundary");
+            const reading = readStationAnswer(verdict, { toolName: pendingAction.toolName, toolCallId: pendingAction.toolCallId });
+            if (reading.kind === "refuse" || reading.kind === "silence" || (unseen && reading.kind !== "vouch")) {
+                const readDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${reading.verdict.sentence ?? "the read boundary does not vouch for what it reads on this leg"} This approval is spent — the call has to be re-issued and approved again.`, prepared.reminderMark);
+                await settleEnd(true, { content: readDenial, ...(reading.verdict.details !== undefined ? { details: reading.verdict.details } : {}) }, "read_boundary");
                 const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, readDenial, true));
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);
                 return;
             }
-            verdict.admit?.();
+            reading.verdict.admit?.();
         }
     }
     const grantRefusal = parkedSkillApprovalRefusal(pendingAction, executedArgs, prepared.skillSpecs, SKILL_TOOL_NAME, "execution");
@@ -798,8 +799,8 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         res = await tool.execute(pendingAction.toolCallId, args, prepared.abortController.signal);
     }
     catch (err) {
-        const execError = `Error: ${thrownText(err)}`;
-        const marks = thrownMarksOf(err);
+        const execError = `Error: ${egressThrownText("same-principal", err)}`;
+        const marks = egressValue("same-principal", thrownMarksOf(err));
         const failed = await finalize({ result: { content: [{ type: "text", text: execError }], details: marks ?? {} }, isError: true });
         const failedText = failed.result.content.flatMap((c) => (c.type === "text" ? [c.text] : [])).join("\n");
         await settleEnd(true, { content: failedText, ...(marks !== undefined ? { details: marks } : {}) });

package/dist/core/runner/run-settle-and-teardown.js

@@ -5,6 +5,7 @@ import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity } fr
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { hasBackgroundShell, sweepRunBoundaryBackgroundShells } from "../background-shell.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
+import { reopenReasonOf, reopenedUnstartedSentence, resumeStartupCauseOf } from "../resume-startup-cause.js";
 import { hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { modelCostToPricing } from "../pricing.js";
 import { hasDestroy, isIsolated } from "../remote-env.js";
@@ -22,7 +23,6 @@ import { generatePromptSuggestions } from "./prompt-suggestions.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 import { owedDateAnchor } from "./announce-once-ledger.js";
 import { autoRunConsolidationFromRecommendation, autoRunOnRecommendationEffective, scopeHasUnconsumedRecommendation } from "./memory-consolidation-driver.js";
-import { consolidationWriteJudgeOfLeg } from "./memory-consolidation-write-judge.js";
 import { amendTerminal, terminalProjection } from "./terminal-projection.js";
 import { mintCompactedEvent } from "../auto-compaction.js";
 import { asThrownError } from "../thrown-value.js";
@@ -141,10 +141,11 @@ export async function runSettleAndTeardown(input) {
             result.terminal.kind !== "paused" &&
             !(resumeDecisionWasNegative(resume) && resume.decisionDelivered === true) &&
             resume.onEnvRestoreFailed !== undefined) {
+            const reopenReason = reopenReasonOf(resumeStartupCauseOf(result.terminal.kind === "failed" ? result.terminal.code : undefined));
             try {
-                await resume.onEnvRestoreFailed("env_failed");
+                await resume.onEnvRestoreFailed(reopenReason);
                 rowReturned = true;
-                amendTerminal(result, "resume.reopened_unstarted", (m) => `${m ?? "the resume leg did not complete"} — the approved action never started, so the checkpoint was REOPENED (pending): the same approval can be resumed again, do not ask for a fresh one`);
+                amendTerminal(result, "resume.reopened_unstarted", (m) => `${m ?? "the resume leg did not complete"} — ${reopenedUnstartedSentence(reopenReason)}`);
             }
             catch {
                 amendTerminal(result, "resume.reopen_failed_unstarted", (m) => `${m ?? "the resume leg did not complete"} — the approved action never started, and reopening the checkpoint FAILED: its state is unprovable from here. Re-read it before deciding; do NOT issue a fresh approval on the assumption the old one is dead`);
@@ -239,8 +240,7 @@ export async function runSettleAndTeardown(input) {
             await settleTeardownLeg(() => mes.harvest(), "memoryEngineSession.harvest (settle leg)", (e) => runner.deps.onError?.(e, { phase: "config", sessionId: prepared.sessionId }));
             const scope = mes.handle.writeScope;
             if (scope !== null && autoRunOnRecommendationEffective(runner.deps) && scopeHasUnconsumedRecommendation(mes.engine, scope)) {
-                const writeJudge = consolidationWriteJudgeOfLeg(prepared.syntheticWriteVerdict);
-                void autoRunConsolidationFromRecommendation({ deps: runner.deps, engine: mes.engine, scope, sessionId: prepared.sessionId, writeJudge, onNotice: runner.deps.onNotice, onError: runner.deps.onError });
+                void autoRunConsolidationFromRecommendation({ deps: runner.deps, engine: mes.engine, scope, sessionId: prepared.sessionId, writeJudge: prepared.consolidationWriteJudge, onNotice: runner.deps.onNotice, onError: runner.deps.onError });
             }
         }
         emitTrace(rs.telemetry.tracer, () => ({

package/dist/core/runner/run-turn-boundary.js

@@ -17,7 +17,8 @@ import { appendBoundaryFrames, compactionRestateOptions } from "./compaction-res
 import { COMPACTION_FREED_EPSILON, COMPACTION_REGROWTH_FACTOR, MAX_CONSECUTIVE_COMPACTION_FAILURES } from "./compaction-knobs.js";
 import { compactionHookOptions, recordCompactionReuse, seamCCompactionOptions } from "./compaction-seams.js";
 import { contextUsageSections } from "../../prompt-assembly/section-usage.js";
-import { asThrownError, thrownText } from "../thrown-value.js";
+import { asThrownError } from "../thrown-value.js";
+import { egressThrownText } from "../untrusted-egress.js";
 const BATCH_CONTEXT_MIN_KEEP_BYTES = 160;
 const BATCH_TRUNCATION_MARKER = "\n…[truncated]";
 export function createTurnBoundary(input) {
@@ -686,7 +687,7 @@ export function createTurnBoundary(input) {
             else if (!prepared.abortController.signal.aborted) {
                 compactionBreaker.failures += 1;
                 runnerHooks.onError?.(err, { phase: "compaction", sessionId: prepared.sessionId });
-                const msg = thrownText(err);
+                const msg = egressThrownText("same-principal", err);
                 const failReason = msg.length > 512 ? `${msg.slice(0, 512)}…` : msg;
                 emitTrace(rs.telemetry.tracer, () => ({
                     kind: "compaction.failed",

package/dist/core/runner/runtask.d.ts

@@ -101,8 +101,7 @@ export declare class Runner implements RunnerSelfSeat {
     private acquireSessionLock;
     /**
      * Hot-swap the deployment seats a running Runner may change without a restart — the ONE door for every
-     * hot-swappable seat ({@link SWAPPABLE_DEP_SEATS}: the model catalog generation `models` + its `tiers`
-     * bindings, and the deployment's two containment-face declarations `readFace` / `writeFace`), and the ONLY sanctioned way to
+     * hot-swappable seat (the closed set {@link SWAPPABLE_DEP_SEATS}, each seat's meaning beside it), and the ONLY sanctioned way to
      * change any of them after construction. It replaces the former `swapModels` verb (retired, no alias):
      * one verb per seat restated the same laws with a list of verbs as the only record of what is swappable.
      *

package/dist/core/runner/runtask.js

@@ -10,7 +10,7 @@ import { emitTaskOutcome } from "../task-outcome.js";
 import { authCarrierFingerprint, displayUrlOf, routeKeyOf } from "../../brain/route-adjudicator.js";
 import { runWithReasoningWireFacts } from "../../brain/status-sink.js";
 import { expandTiers } from "../roles.js";
-import { screenSwappableDeps } from "../swappable-deps.js";
+import { announceReadDenySwap, screenSwappableDeps } from "../swappable-deps.js";
 import { runSideQuery } from "../side-query.js";
 import { PushQueue } from "../push-queue.js";
 import { TtlSessionStore } from "../session-store.js";
@@ -236,19 +236,14 @@ export class Runner {
         };
         if (catalogSwap && tiers === undefined)
             delete written.tiers;
-        const writtenFaceSeats = written;
-        for (const seat of faceSeats) {
-            if (candidate[seat] !== undefined)
-                writtenFaceSeats[seat] = candidate[seat];
-            else
-                delete writtenFaceSeats[seat];
-        }
         const priorContextSettings = this.deps.contextSettings;
-        if (seats.includes("contextSettings")) {
-            if (candidate.contextSettings !== undefined)
-                written.contextSettings = candidate.contextSettings;
+        for (const seat of seats) {
+            if (seat === "models" || seat === "tiers")
+                continue;
+            if (candidate[seat] !== undefined)
+                Object.assign(written, { [seat]: candidate[seat] });
             else
-                delete written.contextSettings;
+                Reflect.deleteProperty(written, seat);
         }
         assertContextSettingsWords(written.contextSettings, written.models, "swapDeps");
         this.deps = written;
@@ -293,6 +288,7 @@ export class Runner {
             else
                 deliverEngineNotice(this.deps.onNotice, { code: "config.write_face_swapped", message, detail });
         }
+        announceReadDenySwap(this.deps.onNotice, seats, this.deps);
     }
     sideQuery(spec) {
         return runWithReasoningWireFacts(() => { }, () => runSideQuery(spec, { brain: this.deps.brain, models: this.deps.models, roles: this.deps.roles }));

package/dist/core/runner/session-rule-policy.d.ts

@@ -1,7 +1,8 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ToolEffect } from "../types.js";
-import { type NamedToolPolicy } from "../tool-policy.js";
+import type { NamedToolPolicy } from "../tool-policy.js";
 import { type SessionPermissionRules, type SessionPolicyStore, type StoredSessionRules } from "../session-policy-store.js";
+import type { PathRuleBases } from "../permission-rule-model.js";
 /** The FULL path-confinable write-tool set: every catalog tool declaring a write path target — `Write` / `Edit`
  *  (target `file_path`) and `NotebookEdit`, whose write target is `notebook_path` and is extracted by the shared
  *  tool-aware {@link writeTargetPath} (notebook_path outranks a decoy `file_path` for that tool).
@@ -105,19 +106,21 @@ export declare function createLiveSessionRules(store: SessionPolicyStore, floor:
 }): (toolCallId: string, signal?: AbortSignal) => Promise<SessionPermissionRules>;
 /**
  * Build the per-session deny-narrowing policy. For each tool call:
- *  - `toolDeny` → deny the listed tools.
- *  - `toolAllow` (if set) → deny any tool NOT listed (a narrowing allowlist).
- *  - `commandAllow`/`commandDeny` → delegate to {@link createCoarseCommandNamePolicy} (argv[0] names; only
- *    speaks about shell tools) with `defaultAction:"deny"` in BOTH modes — so this policy structurally
- *    emits no ask. Allowlist mode denies the un-listed and the un-parseable; blocklist mode denies the
- *    listed and the un-parseable (a parseable command absent from the deny list stays allowed).
+ *  - `toolDeny` → deny the calls its entries reach — the one list matcher's deny reading (`judgeAllowEntries`): a tool name
+ *    under any name the call answers to, a protocol namespace, a shell command rule over every program the command line runs
+ *    (a line it cannot read against the rule is refused too), a path rule over every view of the call's target.
+ *  - `toolAllow` (if set) → deny any call no entry admits (the matcher's allow reading in the `narrowing` posture: every
+ *    segment of a command line named by an entry; never the allow layer's auto-mode strip), naming the uncovered segment.
+ *  - an entry that reads as nothing → in no row (it guards and grants nothing; the prepare-time audit names it).
+ *  - a snapshot the shape reading refuses → deny every call, saying what it holds (never its text).
  *  - `allowDirs` (if set) → a WRITE tool must land inside one of the dirs (resolved via `canonicalizeTarget`,
  *    so a symlink can't carry across a write out); a write-capable tool that cannot be path-confined (e.g. `bash`)
  *    is DENIED while `allowDirs` is set (fail-closed).
- * Returns `allow` when nothing constrains the call. `env`/`rootPath` are the task's real exec env + root, so
- * matching sees the actual filesystem (a remote/E2B task resolves in its container). A relative
- * TARGET prefers the call's live tracked cwd ({@link ToolCallRequest.cwd}) when the engine stamps one;
- * `allowDirs` entries always resolve against `rootPath`.
+ * The policy structurally emits no ask. Returns `allow` when nothing constrains the call. `env`/`rootPath` are the task's real
+ * exec env + root, so matching sees the actual filesystem (a remote/E2B task resolves in its container). A relative TARGET
+ * prefers the call's live tracked cwd ({@link ToolCallRequest.cwd}) when the engine stamps one; `allowDirs` entries always
+ * resolve against `rootPath`, and a path rule's pattern against `anchors` (the leg's root and home — absent, `rootPath`
+ * alone, so a home-relative pattern is unreadable and refuses in the deny direction).
  *
  * The rules are taken from a {@link SessionRuleSource} at EVERY call
  * ({@link SessionRuleSource} carries the law); a plain rules object is the constant source, which is what
@@ -127,4 +130,5 @@ export declare function createSessionRulePolicy(rules: SessionPermissionRules |
     env: ExecutionEnv;
     rootPath?: string;
     toolEffects?: ReadonlyMap<string, ToolEffect>;
+    anchors?: PathRuleBases;
 }): NamedToolPolicy;