@sema-agent/core 7.50.2 → 7.51.0

package/dist/core/shell-read-silence.js

@@ -1,3 +1,105 @@
+import { types } from "node:util";
+import { dispositionsOfRow, SHELL_READ_FINDINGS } from "../tools/fs/shell-read-judge.js";
+import { receiveContract } from "./decision-receipt.js";
+import { egressThrownText } from "./untrusted-egress.js";
+const DISPOSITIONS = ["refuse", "mandated", "ordinary", "vouch"];
+const MEMBER_KINDS = {
+    disposition: "word",
+    finding: "word",
+    environmentSilent: "mark",
+    rowsUnread: "mark",
+    face: "face",
+    sentence: "word",
+    details: "record",
+    readRootCandidate: "record",
+    unestablished: "mark",
+    writesPlaced: "mark",
+    writeProtected: "mark",
+    targetUnresolved: "mark",
+    unplacedOptions: "record",
+    admit: "admission",
+};
+const VERDICT_MEMBERS = Object.keys(MEMBER_KINDS);
+const DATA_DEPTH = 8;
+function ownedData(value, depth, path) {
+    if (value === null || value === undefined || typeof value === "string" || typeof value === "number" || typeof value === "boolean")
+        return { ok: true, value };
+    if (typeof value !== "object" || depth >= DATA_DEPTH || types.isProxy(value) || path.has(value))
+        return { ok: false };
+    const list = Array.isArray(value);
+    const proto = Object.getPrototypeOf(value);
+    if (list ? proto !== Array.prototype : proto !== Object.prototype && proto !== null)
+        return { ok: false };
+    const own = Object.getOwnPropertyDescriptors(value);
+    path.add(value);
+    try {
+        const out = list ? [] : {};
+        for (const key of Object.keys(own)) {
+            if (list && key === "length")
+                continue;
+            const d = own[key];
+            if (!Object.hasOwn(d, "value") || d.enumerable !== true)
+                return { ok: false };
+            const inner = ownedData(d.value, depth + 1, path);
+            if (!inner.ok)
+                return { ok: false };
+            Object.defineProperty(out, key, { value: inner.value, enumerable: true, writable: true, configurable: true });
+        }
+        return { ok: true, value: out };
+    }
+    finally {
+        path.delete(value);
+    }
+}
+function receivedAnswer(answer, call) {
+    if (typeof answer !== "object" || answer === null)
+        return undefined;
+    const outer = receiveContract(answer, VERDICT_MEMBERS, "");
+    if (outer.kind !== "held")
+        return undefined;
+    const out = {};
+    for (const [member, kind] of Object.entries(MEMBER_KINDS)) {
+        let v = outer.held[member];
+        if (v === undefined)
+            continue;
+        if (kind === "word" ? typeof v !== "string" : kind === "mark" ? v !== true : kind === "face" ? v !== "write" : kind === "admission" ? typeof v !== "function" || types.isProxy(v) : false)
+            return undefined;
+        if (kind === "record") {
+            const data = ownedData(v, 0, new Set());
+            if (!data.ok || typeof data.value !== "object" || data.value === null || Array.isArray(data.value))
+                return undefined;
+            v = data.value;
+        }
+        if (kind === "admission") {
+            const admission = v;
+            v = () => {
+                try {
+                    Reflect.apply(admission, undefined, []);
+                }
+                catch (e) {
+                    call.report?.(new Error(`shell read station's admission threw for tool "${call.toolName}"${call.toolCallId !== undefined ? ` (toolCallId ${call.toolCallId})` : ""} — nothing was admitted: ${egressThrownText("same-principal", e)}`));
+                }
+            };
+        }
+        Object.defineProperty(out, member, { value: v, enumerable: true, writable: true, configurable: true });
+    }
+    return out;
+}
+export function readStationAnswer(answer, call) {
+    const verdict = receivedAnswer(answer, call);
+    if (verdict?.disposition === "refuse")
+        return { kind: "refuse", verdict };
+    if (verdict !== undefined && (verdict.finding === "unanswered" || (verdict.finding === "none" && (verdict.environmentSilent === true || verdict.rowsUnread === true))))
+        return { kind: "silence", verdict };
+    if (verdict !== undefined && DISPOSITIONS.includes(verdict.disposition) && dispositionsOfRow(verdict.finding).has(verdict.disposition))
+        return { kind: verdict.disposition, verdict };
+    const word = (w, set) => (w !== undefined && set.includes(w) ? `"${w}"` : "a word outside its closed set");
+    const sentence = verdict === undefined
+        ? `tool "${call.toolName}" was refused: the read station's answer is not one the engine can receive (an ordinary object holding its members as its own data properties, each of its kind), so it is not believed (denied fail-closed)`
+        : `tool "${call.toolName}" was refused: the read station answered ${word(verdict.disposition, DISPOSITIONS)} beside the finding ${word(verdict.finding, SHELL_READ_FINDINGS)}, an answer the read decision table never gives that finding — the station's answer contradicts its own finding and is not believed (denied fail-closed)`;
+    call.report?.(new Error(`shell read station answered out of its contract for tool "${call.toolName}"${call.toolCallId !== undefined ? ` (toolCallId ${call.toolCallId})` : ""} — ${sentence}`));
+    return { kind: "refuse", verdict: { disposition: "refuse", finding: "none", sentence }, unbelieved: true };
+}
 export function silencedBy(verdict, d) {
     const environment = verdict.environmentSilent === true || (verdict.finding === "unanswered" && verdict.rowsUnread !== true);
     const rows = verdict.rowsUnread === true && d.ruleUnreadable === undefined ? { ruleUnreadable: "persisted_rows" } : {};

package/dist/core/side-query.d.ts

@@ -63,17 +63,16 @@ export interface SideQuerySpec {
      * Per-model auth — MIRRORS {@link TaskSpec.getApiKeyAndHeaders} (same signature, resolved per
      * call against the RESOLVED model, exactly like the task path's per-call hook). The brain
      * contract is the route pairing law (route-adjudicator.ts): a per-model credential (this hook,
-     * or an auth header on `Model.headers`) always rides; the deployment credential rides only where
-     * its pairing is verifiable-or-unpinned — a declared `config.baseUrl` with an off-root model is
-     * refused (`route.credential_mismatch` / `route.credential_missing`), never silently followed.
+     * or an auth header on `Model.headers`) always rides; the deployment credential rides only to the
+     * deployment's own root — a model carrying a root of its own is refused
+     * (`route.credential_mismatch` / `route.credential_missing`), never silently followed.
      * Historically the fallback was unconditional (`options.apiKey ?? config.apiKey`, with a model's
      * own `baseUrl` outranking the brain's), so a side query routed to a model carrying its own
      * `baseUrl` + per-model key sent the GATEWAY key to the per-model (possibly external) URL — the
-     * credential leak the pairing law now stops. Absent seat ⇒ no options are minted (byte-identical
-     * to before): on an UNDECLARED root the construction-time credential still applies (the
-     * quick-start posture), while a declared-root brain + off-root model hard-fails the side query
-     * with the loud refusal (`stopReason: "error"`) instead of leaking — there is no primary model
-     * for a side query to fall back to.
+     * credential leak the pairing law now stops. Absent seat ⇒ no options are minted: the
+     * construction-time credential applies on the deployment's own root, and a model rooted elsewhere
+     * hard-fails the side query with the loud refusal (`stopReason: "error"`) instead of leaking —
+     * there is no primary model for a side query to fall back to.
      */
     getApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
     signal?: AbortSignal;

package/dist/core/skill-grant-binding.d.ts

@@ -15,30 +15,51 @@ export interface BoundSkillGrants {
     /** The skill's `disallowed-tools` entries — what activating it refuses for the rest of the run. */
     readonly disallowedTools: readonly string[];
 }
+/**
+ * Why a card carries no binding digest — the closed set of `boundGrantAbsence`: `not_bindable` (the call is not an
+ * activation of the engine's `Skill` tool: it binds no grant) or `unreadable` (the card binds a grant and what it binds
+ * cannot be read: a stored row whose digest is not a string, or that says neither).
+ */
+export declare const BOUND_GRANT_ABSENCES: readonly ["not_bindable", "unreadable"];
+export type BoundGrantAbsence = (typeof BOUND_GRANT_ABSENCES)[number];
 /**
  * A stored value read as a {@link BoundSkillGrants}, whole or not at all: a fresh copy of the three members and nothing else,
  * or `undefined` when any member is not of its type. Every member is read ONCE, so the value screened is the value published.
  */
 export declare function readBoundSkillGrants(raw: unknown): BoundSkillGrants | undefined;
-/** The card members a call to the engine's `Skill` tool carries on every face its card has — empty for any other call. */
-export interface SkillGrantBindingMembers {
-    /** The hash of {@link boundGrants}: the binding a parked approval of the card is judged by. */
-    boundGrantDigest?: string;
-    boundGrants?: BoundSkillGrants;
-}
+/** The card members every ask carries about its binding — exactly one arm: a call to the engine's `Skill` tool carries the
+ *  digest and the value it hashes, every other call the absence word. */
+export type SkillGrantBindingMembers = {
+    readonly boundGrantDigest: string;
+    readonly boundGrants: BoundSkillGrants;
+    readonly boundGrantAbsence?: never;
+} | {
+    readonly boundGrantAbsence: BoundGrantAbsence;
+    readonly boundGrantDigest?: never;
+    readonly boundGrants?: never;
+};
+/** The members of a card that is not a `Skill` activation: the factory's other arm, and what a tool's own consent card (never a
+ *  `Skill` call) spreads. */
+export declare const NOT_BINDABLE: Readonly<{
+    readonly boundGrantAbsence: "not_bindable";
+}>;
 /** The leg's binding factory ({@link SkillGrantBindingMembers} for a call over `args`), the one every ask-mint site spreads. */
 export type GrantBindingOf = (call: {
     readonly toolName: string;
 }, args: unknown) => SkillGrantBindingMembers;
 /**
- * The binding members of a stored parked row, as the inbox projection publishes them: the digest when it is a string, and the lists
- * only as the value that digest hashes — {@link readBoundSkillGrants} whole, and equal to the digest by hash. A pair that
- * disagrees, or lists beside no digest, would show an approver one list while the approval binds another: the lists read as absent.
+ * The binding members of a stored parked row, as the inbox projection publishes them — exactly one of three: the digest when it
+ * is a string (and the lists only as the value that digest hashes — {@link readBoundSkillGrants} whole, and equal to the digest by
+ * hash; a pair that disagrees, or lists beside no digest, would show an approver one list while the approval binds another), else
+ * the row's absence word when it is a member of the set, else `unreadable` — the row does not say what it binds.
  */
 export declare function readBoundBinding(row: {
     readonly boundGrantDigest?: unknown;
     readonly boundGrants?: unknown;
-} | undefined): {
-    boundGrantDigest?: string;
+    readonly boundGrantAbsence?: unknown;
+}): {
+    boundGrantDigest: string;
     boundGrants?: BoundSkillGrants;
+} | {
+    boundGrantAbsence: BoundGrantAbsence;
 };

package/dist/core/skill-grant-binding.js

@@ -1,4 +1,7 @@
 import { boundInputHashOf } from "./canonical-json.js";
+export const BOUND_GRANT_ABSENCES = Object.freeze(["not_bindable", "unreadable"]);
+const BOUND_GRANT_ABSENCE_SET = new Set(BOUND_GRANT_ABSENCES);
+const isBoundGrantAbsence = (v) => BOUND_GRANT_ABSENCE_SET.has(v);
 export function readBoundSkillGrants(raw) {
     if (typeof raw !== "object" || raw === null)
         return undefined;
@@ -15,8 +18,13 @@ export function readBoundSkillGrants(raw) {
     const disallowedTools = entries(disallowed);
     return allowedTools !== undefined && disallowedTools !== undefined ? { skill, allowedTools, disallowedTools } : undefined;
 }
+export const NOT_BINDABLE = Object.freeze({ boundGrantAbsence: "not_bindable" });
 export function readBoundBinding(row) {
-    const digest = row?.boundGrantDigest;
-    const grants = readBoundSkillGrants(row?.boundGrants);
-    return { ...(typeof digest === "string" ? { boundGrantDigest: digest } : {}), ...(grants !== undefined && typeof digest === "string" && boundInputHashOf(grants) === digest ? { boundGrants: grants } : {}) };
+    const digest = row.boundGrantDigest;
+    if (typeof digest === "string") {
+        const grants = readBoundSkillGrants(row.boundGrants);
+        return { boundGrantDigest: digest, ...(grants !== undefined && boundInputHashOf(grants) === digest ? { boundGrants: grants } : {}) };
+    }
+    const word = row.boundGrantAbsence;
+    return { boundGrantAbsence: digest === undefined && isBoundGrantAbsence(word) ? word : "unreadable" };
 }

package/dist/core/skill-grant.d.ts

@@ -2,7 +2,7 @@ import type { PermissionResult, ToolCallRequest } from "./tool-policy.js";
 import type { PermissionMode } from "./ask-origin.js";
 import { type PermissionSeatInputs, type PermissionSeatReading } from "./mode-policy.js";
 import type { AgentTool } from "../internal/harness-types.js";
-import type { SkillGrantBindingMembers } from "./skill-grant-binding.js";
+import { type SkillGrantBindingMembers } from "./skill-grant-binding.js";
 import { type AllowEntryGateSeats, type AllowEntryInert, type AllowEntryJudgeContext, type CompiledAllowEntry } from "./allow-entry.js";
 /** Who wrote a row: the `Skill` tool on a successful activation, prepare for a skill the person invoked by name, or a
  *  delegated child's seed from its parent. */
@@ -53,8 +53,9 @@ export declare function skillGrantDigest(skill: Pick<SkillGrantSource, "name" |
  * `AskRequest` an approver is handed, an ancestor's, the parked row and (through the row) the inbox projection.
  * `boundGrants` is the skill's name and canonical lists, `boundGrantDigest` its hash — the same value, so what a person was
  * shown and what an approving resume is judged by cannot differ. The binding is a property of the CALL, whoever asked and
- * however the question was worded. Empty for any other call, and when no skill is loaded (no engine `Skill` tool is
- * mounted, so a call by that name is not an activation).
+ * however the question was worded. Every other call — and any call when no skill is loaded (no engine `Skill` tool is
+ * mounted, so a call by that name is not an activation) — carries the absence word `not_bindable` instead: one of the two,
+ * always, so no reader infers the binding from a tool name.
  */
 export declare function skillGrantBindingMembers(call: {
     readonly toolName: string;

package/dist/core/skill-grant.js

@@ -3,8 +3,9 @@ import { parsePermissionRule } from "./permission-rules.js";
 import { mountedToolPermissionSeat } from "./mode-policy.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { boundInputHashOf } from "./canonical-json.js";
+import { NOT_BINDABLE } from "./skill-grant-binding.js";
 import { readToolNameList } from "./tool-name-list.js";
-import { allowingRows, autoStripped, compileAllowEntry, compileAllowList, inertEntryPhrase, judgeAllowEntries, nonListValueLabel, nonStringMemberLabel, renderListEntry } from "./allow-entry.js";
+import { allowingRows, autoStripped, compileAllowList, readRuleEntry, inertEntryPhrase, judgeAllowEntries, nonListValueLabel, nonStringMemberLabel, renderListEntry } from "./allow-entry.js";
 export const SKILL_GRANT_ORIGINS = Object.freeze(["model", "user", "inherited"]);
 const FROZEN_SKILL_GRANT_ORIGINS = new Set(["model", "inherited"]);
 export function skillNamedBy(args, skills) {
@@ -25,13 +26,13 @@ export function skillGrantDigest(skill) {
     return skillGrantBinding(skill).boundGrantDigest;
 }
 export function skillGrantBindingMembers(call, args, skills, skillToolName) {
-    return isSkillActivationCall(call, skills, skillToolName) ? skillGrantBinding(skillNamedBy(args, skills)) : {};
+    return isSkillActivationCall(call, skills, skillToolName) ? skillGrantBinding(skillNamedBy(args, skills)) : NOT_BINDABLE;
 }
 function isSkillActivationCall(call, skills, skillToolName) {
     return skills.length > 0 && wireOf("skillGrant.binding", call) === skillToolName;
 }
 export function parkedSkillApprovalRefusal(row, args, skills, skillToolName, site = "claim") {
-    if (row.boundGrantDigest === undefined && skillGrantBindingMembers(row, args, skills, skillToolName).boundGrantDigest === undefined)
+    if (row.boundGrantDigest === undefined && !isSkillActivationCall(row, skills, skillToolName))
         return undefined;
     if (skillGrantDigest(skillNamedBy(args, skills)) === row.boundGrantDigest)
         return undefined;
@@ -244,7 +245,7 @@ function readCarriedRecords(raw, carrier) {
         const { skill, behavior, entry, origin } = r;
         if (typeof skill !== "string" || typeof entry !== "string" || (behavior !== "allow" && behavior !== "deny"))
             return undefined;
-        if (typeof compileAllowEntry(entry, behavior) === "string")
+        if (readRuleEntry(entry, behavior).kind === "inert")
             return undefined;
         if (carrier === "capture") {
             out.push({ skill, behavior, entry });

package/dist/core/skills-directory.d.ts

@@ -51,7 +51,9 @@ export type SkillsDirectoryWarningCode =
 /** An attachment was left out (non-text bytes, over budget, unreadable, or resolving outside the skill). */
  | "attachment_skipped"
 /** A file or directory entry existed but could not be read/resolved. */
- | "read_failed";
+ | "read_failed"
+/** A skill directory or its `SKILL.md` resolves outside {@link SkillsDirectoryOptions.containWithin} — skipped. */
+ | "outside_root";
 /** One non-fatal diagnostic from a load. Safe to log: no file contents, only names/reasons. */
 export interface SkillsDirectoryWarning {
     code: SkillsDirectoryWarningCode;
@@ -69,6 +71,15 @@ export interface SkillsDirectoryOptions {
      * ride a separate delivery cap at invoke time, so a generous value here does not enlarge the prompt.
      */
     maxAttachmentBytes?: number;
+    /**
+     * The directory this root's skills must physically lie inside. Declared ⇒ every skill directory, and every
+     * `SKILL.md`, resolves (links followed) inside it or is skipped with an `outside_root` warning; the attachments
+     * already lie inside their skill directory, so they are inside it too. Absent ⇒ each root entry is a mount the
+     * deployment declared, trusted like the root itself. A root a third party writes (a repository's skills
+     * directory) declares the repository root here, so a link in it cannot load a skill from elsewhere on disk.
+     * Must name an existing directory; anything else throws, like an unreadable root.
+     */
+    containWithin?: string;
 }
 /**
  * Load every `SKILL.md`-bearing subdirectory of `dir` into a {@link SkillSpec}, ready for

package/dist/core/skills-directory.js

@@ -1,6 +1,7 @@
 import { readFileSync, readdirSync, statSync } from "node:fs";
-import { isAbsolute, join, relative } from "node:path";
+import { join } from "node:path";
 import { physicalPathOf } from "./physical-path.js";
+import { isPhysicallyWithin } from "../tools/fs/path-containment.js";
 import { assertNoRetiredKeys } from "./retired-keys.js";
 import { thrownText } from "./thrown-value.js";
 const SKILL_FILE = "SKILL.md";
@@ -167,12 +168,6 @@ function unquote(value) {
     const inner = value.slice(1, -1);
     return q === '"' ? inner.replace(/\\t/g, "\t").replace(/\\n/g, "\n") : inner;
 }
-function isInsideRoot(root, p) {
-    if (p === root)
-        return true;
-    const rel = relative(root, p);
-    return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
-}
 function listRelativeFiles(base, dir, prefix, out, walk) {
     let entries;
     try {
@@ -222,7 +217,7 @@ function resolveInsideSkill(abs, rel, walk) {
         walk.warn({ code: "attachment_skipped", skill: walk.skill, detail: `${rel}: could not be resolved (${errText(err)})` });
         return undefined;
     }
-    if (!isInsideRoot(walk.realRoot, real)) {
+    if (!isPhysicallyWithin(walk.realRoot, real)) {
         walk.warn({
             code: "attachment_skipped",
             skill: walk.skill,
@@ -337,6 +332,18 @@ export function createSkillsFromDirectory(dir, options = {}) {
     catch (err) {
         throw new Error(`skills directory could not be read: ${dir} (${errText(err)})`);
     }
+    const containWithin = options.containWithin;
+    if (containWithin !== undefined) {
+        const isDir = typeof containWithin === "string" && statSync(containWithin, { throwIfNoEntry: false })?.isDirectory() === true;
+        if (!isDir)
+            throw new Error(`skills directory containment root is not a readable directory: ${String(containWithin)}`);
+    }
+    const outside = (skill, path, what) => {
+        if (containWithin === undefined || isPhysicallyWithin(containWithin, path))
+            return false;
+        warn({ code: "outside_root", skill, detail: `${what} resolves outside ${containWithin} — skipped` });
+        return true;
+    };
     const dirNames = [];
     for (const e of entries) {
         if (e.isDirectory()) {
@@ -357,6 +364,8 @@ export function createSkillsFromDirectory(dir, options = {}) {
     const skills = [];
     for (const name of dirNames) {
         const skillDir = join(dir, name);
+        if (outside(name, skillDir, "its directory") || outside(name, join(skillDir, SKILL_FILE), SKILL_FILE))
+            continue;
         let text;
         try {
             text = readFileSync(join(skillDir, SKILL_FILE), "utf8");

package/dist/core/store-contracts/checkpoint-store-contract.d.ts

@@ -61,6 +61,7 @@ export declare const EXPECTED_LISTBYSCOPE_SUMMARIES: ({
     mandated: boolean;
     mandate: string;
     origin: string;
+    boundGrantAbsence: string;
     spentMicroUsd?: undefined;
 } | {
     token: string;
@@ -79,4 +80,5 @@ export declare const EXPECTED_LISTBYSCOPE_SUMMARIES: ({
     mandated?: undefined;
     mandate?: undefined;
     origin?: undefined;
+    boundGrantAbsence?: undefined;
 })[];

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -18,6 +18,7 @@ export function createCheckpointFixture(over = {}) {
             toolName: "Write",
             args: { path: "/x", content: "y" },
             boundInputHash: "h0",
+            boundGrantAbsence: "not_bindable",
             batchToolCallIds: ["call-3"],
             completedCallIds: [],
         },
@@ -461,6 +462,7 @@ export async function checkpointListByScopeSummaries(store) {
             origin: "policy",
             mandated: true,
             mandate: "tool_marks",
+            boundGrantAbsence: "not_bindable",
             toolCallId: "call-pr",
             toolName: "open_pr",
             args: { repo: "x" },
@@ -503,6 +505,7 @@ export const EXPECTED_LISTBYSCOPE_SUMMARIES = [
         mandated: true,
         mandate: "tool_marks",
         origin: "policy",
+        boundGrantAbsence: "not_bindable",
     },
     {
         token: "tok-resource",

package/dist/core/swappable-deps.d.ts

@@ -38,6 +38,7 @@
  */
 import type { AssertAllKeysHandled } from "./ask-origin.js";
 import type { RunnerDeps } from "./runner-deps.js";
+import { type ReadDenyDeploymentSeat } from "./read-face-seats.js";
 /**
  * The closed set of hot-swappable deployment seats.
  *  - `models`   — the model catalog generation (the same-name redirect, re-pricing and retirement rules
@@ -59,8 +60,12 @@ import type { RunnerDeps } from "./runner-deps.js";
  *  - `contextSettings` — the per-model context-window overlay ({@link RunnerDeps.contextSettings}); screened
  *                 by the same value gate construction applies (`assertContextSettingsValue`). THE ONE SEAT
  *                 IN-FLIGHT LEGS RE-READ — see the header: it carries geometry, not route.
+ *  - `readDenyPatterns` / `readDenyBuiltinTiers` / `readDenyBuiltinExclude` — the deployment's read-deny
+ *                 declaration (additions, built-in tier selection, built-in row removal); screened by the
+ *                 gates a prepare applies ({@link screenReadDenySeat}). A resumed leg compiles against the
+ *                 seats in force at its prepare (the checkpoint keeps additions only, stricter-wins).
  */
-export declare const SWAPPABLE_DEP_SEATS: readonly ["models", "tiers", "readFace", "writeFace", "contextSettings"];
+export declare const SWAPPABLE_DEP_SEATS: readonly ["models", "tiers", "readFace", "writeFace", "contextSettings", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude"];
 export type SwappableDepSeat = (typeof SWAPPABLE_DEP_SEATS)[number];
 /** The candidate a swap takes: the swappable seats of {@link RunnerDeps}, each optional (presence = instruction). */
 export type SwappableDeps = Pick<RunnerDeps, SwappableDepSeat>;
@@ -77,6 +82,9 @@ export declare const SWAP_SEAT_NOTICE: {
     readonly readFace: "config.read_face_swapped";
     readonly writeFace: "config.write_face_swapped";
     readonly contextSettings: "config.context_settings_swapped";
+    readonly readDenyPatterns: "config.read_deny_swapped";
+    readonly readDenyBuiltinTiers: "config.read_deny_swapped";
+    readonly readDenyBuiltinExclude: "config.read_deny_swapped";
 };
 /** The fence over the notice table: `never` while every seat has a row. */
 export type SwapNoticeTableCoversEverySeat = AssertAllKeysHandled<Exclude<SwappableDepSeat, keyof typeof SWAP_SEAT_NOTICE>>;
@@ -106,3 +114,9 @@ export interface ScreenedSwappableDeps {
  * `assertContainmentFaceValue`), so a value the door admits is a value every later prepare admits.
  */
 export declare function screenSwappableDeps(next: unknown): ScreenedSwappableDeps;
+/**
+ * Announce a swap of the deployment's read-deny declaration, after the write: ONE `config.read_deny_swapped`
+ * line however many of its three seats the swap named (the line's contract lives at the notice catalog,
+ * `EngineNotice.code`).
+ */
+export declare function announceReadDenySwap(onNotice: RunnerDeps["onNotice"], seats: readonly SwappableDepSeat[], inForce: Pick<RunnerDeps, ReadDenyDeploymentSeat>): void;

package/dist/core/swappable-deps.js

@@ -1,6 +1,9 @@
 import { assertContainmentFaceValue } from "../tools/fs/containment-face.js";
 import { assertContextSettingsValue } from "./context-settings.js";
-export const SWAPPABLE_DEP_SEATS = Object.freeze(["models", "tiers", "readFace", "writeFace", "contextSettings"]);
+import { READ_DENY_DEPLOYMENT_SEATS, screenReadDenySeat } from "./read-face-seats.js";
+import { deliverEngineNotice } from "./engine-notice.js";
+import { uuidv7 } from "../internal/harness.js";
+export const SWAPPABLE_DEP_SEATS = Object.freeze(["models", "tiers", "readFace", "writeFace", "contextSettings", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude"]);
 const SWAPPABLE_DEP_SEAT_SET = new Set(SWAPPABLE_DEP_SEATS);
 export function isSwappableDepSeat(k) {
     return SWAPPABLE_DEP_SEAT_SET.has(k);
@@ -11,6 +14,9 @@ export const SWAP_SEAT_NOTICE = {
     readFace: "config.read_face_swapped",
     writeFace: "config.write_face_swapped",
     contextSettings: "config.context_settings_swapped",
+    readDenyPatterns: "config.read_deny_swapped",
+    readDenyBuiltinTiers: "config.read_deny_swapped",
+    readDenyBuiltinExclude: "config.read_deny_swapped",
 };
 export function screenSwappableDeps(next) {
     if (next === null || typeof next !== "object" || Array.isArray(next)) {
@@ -54,6 +60,11 @@ export function screenSwappableDeps(next) {
             case "contextSettings":
                 candidate.contextSettings = assertContextSettingsValue(v, "swapDeps");
                 break;
+            case "readDenyPatterns":
+            case "readDenyBuiltinTiers":
+            case "readDenyBuiltinExclude":
+                candidate[seat] = screenReadDenySeat(seat, v);
+                break;
             default: {
                 const _exhaustive = seat;
                 throw new Error(`swapDeps: unhandled seat ${String(_exhaustive)}`);
@@ -62,3 +73,16 @@ export function screenSwappableDeps(next) {
     }
     return { seats: present, candidate: candidate };
 }
+export function announceReadDenySwap(onNotice, seats, inForce) {
+    const named = READ_DENY_DEPLOYMENT_SEATS.filter((s) => seats.includes(s));
+    if (named.length === 0)
+        return;
+    const patterns = inForce.readDenyPatterns?.length ?? null;
+    const tiers = inForce.readDenyBuiltinTiers !== undefined ? [...inForce.readDenyBuiltinTiers] : null;
+    const exclude = inForce.readDenyBuiltinExclude?.length ?? null;
+    deliverEngineNotice(onNotice, {
+        code: "config.read_deny_swapped",
+        message: `deployment read-deny declaration swapped (${named.join(", ")}): ${patterns ?? "no"} addition(s), built-in tiers ${tiers === null ? "(default)" : `[${tiers.join(", ")}]`}, ${exclude ?? "no"} built-in row removal(s); in-flight legs keep the deny face they prepared under, new legs compile against the new declaration`,
+        detail: { seats: named, patterns, tiers, exclude, occurrenceId: uuidv7() },
+    });
+}

package/dist/core/synthetic-read-verdict.d.ts

@@ -52,20 +52,22 @@
  *   | any layer                   | the judgment's budget (one dependency timeout, or a  | unanswerable `timed_out`      |
  *   |                             | batch's shared deadline) is spent                    |                               |
  *
- * NEVER AN APPROVER. A deployment policy (the caller's, an inherited parent's) is consulted with an
- * ALREADY-ABORTED signal and no approver seat: the `ToolPolicy.check` contract is that an aborted signal
- * releases a pending approval, and every engine policy factory checks it before reaching a seat (the
- * approval factory answers a deny attested `task_aborted`, read here as `approval_seat`; the inherited
- * PreToolUse constraint does the same before invoking its hook). A deny that carries no engine settlement
- * is a rule's deny and stands. RESIDUALS (stated, not closed): a deployment closure that reaches an
- * approver before it reads its signal can still be asked; a deployment wrapper that answers an aborted
- * signal with a deny of its own (no settlement) is read as a deny — the attachment face then withholds,
- * the notice face stays silent. The engine's own layers (narrowing, skill rows, the two lanes) get the
- * run's real signal: they are pure matchers and store reads.
+ * NEVER AN APPROVER. Every probe STATES that nobody can be asked about it — `approvalReach: "none"` on the request
+ * (`ToolCallRequest.approvalReach`) — and every policy layer is handed a LIVE signal of its own: it ends when the judge stops
+ * waiting for that layer (the layer answered, or its share of the judgment's budget is spent) or when the run's signal ends.
+ * An abort means only that: the task ended, or the judge no longer waits — never "there is no approver". Every engine
+ * policy factory reads the statement before reaching a seat (the approval factory answers a deny attested `no_approver`,
+ * read here as `approval_seat`; the inherited PreToolUse constraint does the same before invoking its hook), and the
+ * engine's own guards composed into a deployment's policy judge the probe as they judge a call — a lookup bounded by a
+ * live deadline answers. A deny that carries no engine settlement is a rule's deny and stands. RESIDUALS (stated, not
+ * closed): a deployment closure that ignores the statement and reaches an approver IS asked — the judge waits for it at
+ * most the judgment's budget (`timed_out`: the write face refuses, the notice face stays silent), then its signal ends
+ * so a closure that honors it releases its approval; a deployment wrapper that answers the statement with a deny of its
+ * own (no settlement) is read as a deny — the attachment face then withholds, the notice face stays silent.
  *
- * THE PROBE'S IDENTITY. Every layer sees the probed tool's name (`Read` / `Write`), the probed arguments, and a stable
- * synthetic call id (`<face>-visibility-probe` for a read, `<face>-write-probe` for a write; {@link syntheticReadProbeId},
- * {@link syntheticWriteProbeId}), so a deployment's audit can tell a probe from a model's call. The write face stamps the
+ * THE PROBE'S IDENTITY. Every layer sees the probed tool's name (`Read` / `Write`), the probed arguments, the statement
+ * above, and a stable synthetic call id (`<face>-visibility-probe` for a read, `<face>-write-probe` for a write;
+ * {@link syntheticReadProbeId}, {@link syntheticWriteProbeId}), so a deployment's audit can tell a probe from a model's call. The write face stamps the
  * facts the live gate stamps on a write (the roster's `Write` face, the tracked cwd and root, the advertised writable
  * directories, the data root's exemption): a containment fence and a data-root exemption judge the probe as they judge the call.
  */
@@ -120,7 +122,7 @@ export interface SyntheticReadLayers {
     };
     /** The leg's target-reading stamp: the probe's request carries a reading of its target, as the live gate's does. */
     stampCallTarget?: CallTargetStamp;
-    /** The run's signal, for the engine's own layers. */
+    /** The run's signal: its end ends the judgment's every wait (each policy layer's own signal ends with it). */
     signal?: AbortSignal;
 }
 /** The arguments a synthetic `Read` carries, and the facts a request stamps. */