@sema-agent/core 7.50.2 → 7.51.0

package/dist/core/synthetic-read-verdict.js

@@ -19,7 +19,6 @@ function probeFaceWord(face) {
         throw new Error(`synthetic probe id: the probe face must be a lowercase word (letters and hyphens), got ${JSON.stringify(face)}`);
     return face;
 }
-const ABORTED = AbortSignal.abort();
 function sameArguments(value, probed) {
     try {
         return deepJsonEqual(value, probed);
@@ -28,6 +27,22 @@ function sameArguments(value, probed) {
         return false;
     }
 }
+function layerWait(run) {
+    const wait = new AbortController();
+    const runEnded = () => wait.abort(run?.reason);
+    if (run?.aborted === true)
+        runEnded();
+    else
+        run?.addEventListener("abort", runEnded, { once: true });
+    return {
+        signal: wait.signal,
+        end: () => {
+            run?.removeEventListener("abort", runEnded);
+            if (!wait.signal.aborted)
+                wait.abort(new DOMException("the judgment stopped waiting for this layer", "TimeoutError"));
+        },
+    };
+}
 export function createSyntheticReadJudge(layers) {
     const judge = createProbeJudge(layers, "read");
     return async (call, face, budget) => {
@@ -61,9 +76,10 @@ export function createSyntheticWriteJudge(layers, facts) {
 }
 function createProbeJudge(layers, kind) {
     const everyAskHeld = kind === "write";
-    return async (probe, budget) => {
+    return async (unstated, budget) => {
         const deadlineAt = budget?.deadlineAt ?? Date.now() + ORG_ADJUDICATION_TIMEOUT_MS;
         const left = () => Math.max(0, Math.min(ORG_ADJUDICATION_TIMEOUT_MS, deadlineAt - Date.now()));
+        const probe = { ...unstated, approvalReach: "none" };
         const probedArgs = structuredClone(probe.args);
         const stamped = layers.stampCallTarget?.(probe, layers.signal);
         const req = stamped !== undefined ? await stamped : probe;
@@ -84,7 +100,7 @@ function createProbeJudge(layers, kind) {
             cannot(layer, "timed_out", "the judgment's wait budget was spent before this layer was asked");
             return true;
         };
-        const policyLayer = async (layer, policy, signal, ancestorOwned = false) => {
+        const policyLayer = async (layer, policy, ancestorOwned = false) => {
             if (spent(layer))
                 return undefined;
             const waitMs = left();
@@ -92,18 +108,22 @@ function createProbeJudge(layers, kind) {
             let thrown = undefined;
             const TIMEOUT = Symbol("timeout");
             let d;
+            const wait = layerWait(layers.signal);
             try {
                 d = await settleOrgVerdictWithin(Promise.resolve()
-                    .then(() => policy.check(req, signal))
+                    .then(() => policy.check(req, wait.signal))
                     .catch((err) => {
                     thrown = { err };
                     return TIMEOUT;
-                }), TIMEOUT, { ...(layers.signal !== undefined ? { signal: layers.signal } : {}), timeoutMs: waitMs, onFallback: () => void (timedOut = true) });
+                }), TIMEOUT, { signal: wait.signal, timeoutMs: waitMs, onFallback: () => void (timedOut = true) });
             }
             catch (err) {
                 cannot(layer, "threw", describeThrown(err));
                 return undefined;
             }
+            finally {
+                wait.end();
+            }
             if (thrown !== undefined) {
                 cannot(layer, "threw", describeThrown(thrown.err));
                 return undefined;
@@ -144,19 +164,19 @@ function createProbeJudge(layers, kind) {
             cannot("skill_rows", "threw", describeThrown(err));
         }
         if (layers.denyNarrowingPolicy !== undefined) {
-            const v = await policyLayer("narrowing", layers.denyNarrowingPolicy, layers.signal);
+            const v = await policyLayer("narrowing", layers.denyNarrowingPolicy);
             if (v !== undefined)
                 return v;
         }
         if (layers.callerPolicy !== undefined) {
-            const v = await policyLayer("caller_policy", layers.callerPolicy, ABORTED, (layers.inheritedPolicies ?? []).includes(layers.callerPolicy));
+            const v = await policyLayer("caller_policy", layers.callerPolicy, (layers.inheritedPolicies ?? []).includes(layers.callerPolicy));
             if (v !== undefined)
                 return v;
         }
         for (const parent of layers.inheritedPolicies ?? []) {
             if (parent === layers.callerPolicy)
                 continue;
-            const v = await policyLayer("inherited_constraint", parent, ABORTED, true);
+            const v = await policyLayer("inherited_constraint", parent, true);
             if (v !== undefined)
                 return v;
         }

package/dist/core/task-notification.d.ts

@@ -1,7 +1,11 @@
 import type { MailboxAppendMessage, MailboxStore } from "./mailbox-store.js";
+/** The TERMINAL words of {@link TaskNotificationStatus}: the one table every "is this frame a completion?"
+ *  reading asks, exported as a value so a consumer outside the package reads these words rather than its own list. */
+export declare const TASK_NOTIFICATION_TERMINAL_STATUSES: readonly ["completed", "failed", "killed", "cancelled"];
+export type TaskNotificationTerminalStatus = (typeof TASK_NOTIFICATION_TERMINAL_STATUSES)[number];
 /** design/135 G2: `"event"` is the ONE non-terminal member — a Monitor batch notification (new stdout
  *  lines from a still-running watch). Everything else is a terminal completion notification. */
-export type TaskNotificationStatus = "completed" | "failed" | "killed" | "cancelled" | "event";
+export type TaskNotificationStatus = TaskNotificationTerminalStatus | "event";
 export type SystemInjectionPriority = "now" | "next" | "later";
 /**
  * The outcome an injection entry settles with — what the session did with the frame:
@@ -84,8 +88,8 @@ export interface TaskNotificationPayload {
      *  `inlineUntrusted` + attribute-escaping, never as authority. Absent on every internal lane. */
     source?: string;
     /** design/134 §3.3: only on `status:"killed"` — who stopped it. MIRROR of task-registry `StopSource`
-     *  (the single source; inlined here to avoid an import cycle — task-registry imports this module;
-     *  third mirror: types.ts `BackgroundChildEvent.stoppedBy` — keep all three in sync). OPEN ENUM:
+     *  (the single source; inlined here to avoid an import cycle — task-registry imports this module);
+     *  `BackgroundChildEvent.stoppedBy` is typed by this member and projected from it. OPEN ENUM:
      *  consumers must tolerate unknown values (a future "timeout" etc. is not breaking) and fall back
      *  to default copy. */
     stoppedBy?: "user" | "parent" | "system" | (string & {});
@@ -507,6 +511,12 @@ export declare function terminalFrameFacets(facts: {
     warning?: string | undefined;
     compaction?: TaskNotificationPayload["compaction"] | undefined;
 }): Pick<TaskNotificationPayload, "spawnName" | "handback" | "compaction">;
+/**
+ * A delegated child's report as its completion frame carries it — the one value the parent's notification and the fleet
+ * terminal projected from that frame both read: redacted BEFORE the cut, with the pass the task row's copy uses (a token
+ * across the cut is never half-shown), then cut with an honest total. Absent in ⇒ absent out.
+ */
+export declare function notifyResultField(result: string | undefined): string | undefined;
 /** The codec version this engine writes into an `engine_frame` record and the highest it reads. */
 export declare const ENGINE_FRAME_CODEC_VERSION = 1;
 /** The engine's own lanes — the only frames the durable park may encode (an `external` event never is). */

package/dist/core/task-notification.js

@@ -1,7 +1,9 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { escapeEnvelopeTag, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
+import { egressText } from "./untrusted-egress.js";
 import { PEER_MESSAGE_NOTICE } from "../agents/peer-admission.js";
 import { buildCrossSessionEnvelope, CROSS_SESSION_MESSAGE_NOTICE, neutralizePeerBody } from "../agents/cross-session-envelope.js";
+export const TASK_NOTIFICATION_TERMINAL_STATUSES = Object.freeze(["completed", "failed", "killed", "cancelled"]);
 export const NOTIFICATION_INJECTION_OUTCOMES = Object.freeze(["queued", "parked", "parked_durably", "dropped_duplicate"]);
 export function isNotificationInjectionOutcome(value) {
     return typeof value === "string" && NOTIFICATION_INJECTION_OUTCOMES.includes(value);
@@ -175,6 +177,15 @@ export function terminalFrameFacets(facts) {
         ...(facts.compaction !== undefined ? { compaction: { passes: facts.compaction.passes, breakerOpen: facts.compaction.breakerOpen, ...(facts.compaction.kind !== undefined ? { kind: facts.compaction.kind } : {}) } } : {}),
     };
 }
+const COMPLETION_REPORT_MAX = 2_000;
+export function notifyResultField(result) {
+    if (!result)
+        return undefined;
+    const report = egressText("same-principal", result);
+    return report.length > COMPLETION_REPORT_MAX
+        ? `${report.slice(0, COMPLETION_REPORT_MAX)}\n[result truncated: ${report.length} chars total — ask the agent for it via SendMessage, or read it with TaskOutput where mounted]`
+        : report;
+}
 export const ENGINE_FRAME_CODEC_VERSION = 1;
 export const ENGINE_FRAME_TASK_TYPES = Object.freeze(["background_agent", "monitor", "workflow"]);
 const SHELL_LESS_CARRIERS = ["agentMessage", "crossSessionMessage", "crossSessionNotice", "inboxNotice", "_sema_provenance"];
@@ -257,7 +268,7 @@ export function engineFrameRecordOf(payload, priority, box) {
     };
 }
 const MAX_TOMBSTONES = 5_000;
-const TERMINAL_STATUSES = new Set(["completed", "failed", "killed", "cancelled"]);
+const TERMINAL_STATUSES = new Set(TASK_NOTIFICATION_TERMINAL_STATUSES);
 export function isDelegatedAgentTerminal(n) {
     return n.task_type === "background_agent" && TERMINAL_STATUSES.has(n.status);
 }

package/dist/core/task-spec.d.ts

@@ -478,10 +478,10 @@ export interface TaskSpec {
      *
      * Entries are read like {@link excludeTools}: a wire name or an alias it declares, `mcp__srv` / `mcp__srv__*` for every tool
      * of a server (including tools it lists later), a glob over the tool segment. The engine resolves the list against its OWN
-     * roster at prepare — a host passes the names it was given and never computes a complement. A name no tool answers to, a
-     * protocol-wide `mcp__*`, or an entry that is not a string is REFUSED at prepare (`config.tool_face_control`). The same
-     * compiled selector is applied on every later roster change (an MCP refresh or re-dial, the deferred-search lane): an exact name
-     * admits no new tool. Deferral is reached through ToolSearch, so a list that leaves it out defers nothing.
+     * roster at prepare — a host passes the names it was given. A spelling no tool name can have, `mcp__*`, or an entry that is not
+     * a string is REFUSED at prepare (`config.tool_face_control`); a name no tool answers to is kept and told once (`onError`, phase
+     * `"config"`). The same compiled selector is applied on every later roster change (an MCP refresh or re-dial, the
+     * deferred-search lane). Deferral is reached through ToolSearch, so a list that leaves it out defers nothing.
      *
      * A tool a leg relies on (a delegated child's ReportBlocked, a teammate's SendMessage, a goal iteration's DeclareDone, an
      * observer's report tool — the catalog's protocol column) is not an allowlist's to name; a denylist that reaches one on such a
@@ -494,8 +494,8 @@ export interface TaskSpec {
      * ships the schema bytes every request — measured at zero token savings). The DENY half of the run's tool selector, read
      * exactly as a sub-agent's denied tools are: a wire name or an alias it declares; `Tool(content)` names the whole `Tool`;
      * `mcp__srv` / `mcp__srv__*` / a glob over the tool segment for a server's tools, `mcp__*` for every MCP tool (including tools
-     * a server lists later). A name no tool answers to, `"*"`, or an entry that is not a string is REFUSED at prepare
-     * (`config.tool_face_control`) — a misspelt exclusion guards nothing. A deny wins over {@link allowTools}.
+     * a server lists later). A spelling no tool name can have, `"*"`, or an entry that is not a string is REFUSED at prepare; a name
+     * no tool answers to is kept (it hides a tool of that name mounted later) and told once. A deny wins over {@link allowTools}.
      * ⚠️ A list that reaches a tool this kind of leg relies on (see {@link allowTools}) is refused; excluding a host-requested
      * structural tool (the structured-output tool) can still strand the task — the caller owns that risk.
      */
@@ -610,15 +610,14 @@ export interface TaskSpec {
      * real model ref passed through — core carries no model-word vocabulary). When set (non-empty),
      * `prepareTask` REBUILDS the mounted delegation tool (via {@link ToolSpec.withAgents}) so its roster
      * is the UNION of the boot roster and these definitions — a same-name per-task definition WINS over
-     * the boot one. Validation contract (revision of the posture, dual-leg verified against
-     * upstream): an `allowTools` entry naming a tool that does not exist is ITEM-FILTERED at spawn (the
-     * agent stays listed and delegable; the only host disclosure is a prepare-time HEURISTIC advisory
-     * via `RunnerDeps.onError` phase `"config"` for entries unknown to the parent's assembled roster —
-     * zero model-facing warning, the verified upstream shape); a `denyTools` entry is read as the
-     * reference reads it (`Tool(content)` hides the whole `Tool`, with a host notice) and judged once, here and for the
-     * delegation tool's own lists alike: a spelling that names no tool, or a stale one (another case of a mounted tool, a
-     * retired name), is REJECTED at task start (`config.agent.unknown_tool`), any other name no tool carries is told to the
-     * host and hides nothing; and
+     * the boot one. Validation contract (the reference's shape — an agent's tool list filters by name,
+     * and a name nothing answers never fails the run): both lists are judged once, here and for the
+     * delegation tool's own lists alike; a `denyTools` entry is read as the reference reads it
+     * (`Tool(content)` hides the whole `Tool`, with a host notice); an entry whose spelling no tool name
+     * can have is REJECTED at task start (`config.agent.unknown_tool`); an entry naming a tool that does
+     * not exist (a server this deployment does not declare, a stale or misspelt name) is kept as written
+     * — it denies, or admits, a tool of that name if one is mounted later — and told to the host once
+     * via `RunnerDeps.onError` phase `"config"` (zero model-facing warning); and
      * providing this field with NO delegation tool mounted is rejected too
      * (`config.agents.no_delegation_tool`) — never a silent no-op. POLICY-NEUTRAL: a
      * roster listing only; the 1.294 tighten-only parent-policy inheritance is applied at spawn time,

package/dist/core/tool-name-readings.d.ts

@@ -126,10 +126,6 @@ export declare const NAME_READINGS: {
         readonly kind: "any";
         readonly file: string;
     };
-    readonly "policy.sessionRules": {
-        readonly kind: "any";
-        readonly file: string;
-    };
     readonly "policy.sessionRules.effect": {
         readonly kind: "wire";
         readonly file: string;

package/dist/core/tool-name-readings.js

@@ -33,7 +33,6 @@ export const NAME_READINGS = {
     "policy.nameLists": any(POLICY),
     "policy.shellToolsList": any(POLICY),
     "policy.projectionReplay": any(POLICY),
-    "policy.sessionRules": any("src/core/runner/session-rule-policy.ts"),
     "policy.sessionRules.effect": wire("src/core/runner/session-rule-policy.ts"),
     "allowEntry.names": any("src/core/allow-entry.ts"),
     "skillGrant.binding": wire("src/core/skill-grant.ts"),

package/dist/core/tool-policy.d.ts

@@ -130,6 +130,18 @@ export interface ToolCallRequest {
      * a Runner with no `memoryEngineDir` would stamp. Read-only, frozen.
      */
     exemptRoots?: readonly string[];
+    /**
+     * The request's statement that nobody can be asked about THIS call — the word of a run's own declaration
+     * (`TaskSpec.approvalReach`, the closed set `APPROVAL_REACH`), stated per request. Present (`"none"`) on every request the
+     * engine's synthetic probes hand a policy layer (the "would this call be refused outright?" judgments: the visibility
+     * probes of a file the model did not ask to read, the background memory consolidation's write probes); absent on a call
+     * the gate adjudicates, and on a bare request. A policy that would put the call to a person — an approval seat it awaits,
+     * a hook it invokes, a card or a message it sends — answers at once instead: the engine's own factories read this member
+     * before reaching a seat and answer {@link noApproverSeatDeny}; a deployment closure does the same. The signal handed
+     * beside such a request is LIVE (the judge's wait for that layer): an aborted one means only that the task ended.
+     * Read-only.
+     */
+    approvalReach?: import("./wiring-manifest.js").ApprovalReach;
     /**
      * design/80 D-E-core: read-only per-run budget snapshot so a STATELESS policy can self-limit against
      * state that survives suspend/resume (a fresh in-memory counter would reset every leg — the supervisor
@@ -272,11 +284,25 @@ export declare function attest<T extends object>(d: T, call: {
 }, members: AttestationMembers): T;
 /** `d` carrying `record` (a fresh object), or `d` itself when there is no record to put on it. */
 export declare function withAttestation<T extends object>(d: T, record: EngineAttestation | undefined): T;
+/** The `no_approver`-attested deny an engine policy answers on a request that states nobody can be asked about it
+ *  ({@link ToolCallRequest.approvalReach}) instead of reaching a seat — read by a probe as "would ask an approver". */
+export declare function noApproverSeatDeny(req: {
+    toolCallId: string;
+    toolName: string;
+}, message: string, origin: AskOrigin): PermissionResult;
 /** The `task_aborted`-attested deny an engine policy answers on an aborted signal instead of reaching a seat. */
 export declare function abortedSeatDeny(req: {
     toolCallId: string;
     toolName: string;
 }, message: string, origin: AskOrigin): PermissionResult;
+/** THE question every engine factory asks before it would reach a person (an approver it awaits, a hook it invokes): may the
+ *  seat be reached? Not when the task ended (an aborted signal ⇒ {@link abortedSeatDeny}, read first) nor when the request
+ *  states that nobody can be asked about the call ({@link ToolCallRequest.approvalReach} ⇒ {@link noApproverSeatDeny});
+ *  `undefined` ⇒ it may. `say` is the factory's own sentence for each. */
+export declare function unaskedSeatAnswer(req: Pick<ToolCallRequest, "toolCallId" | "toolName" | "approvalReach">, signal: AbortSignal | undefined, say: {
+    aborted: string;
+    unreachable: string;
+}, origin: AskOrigin): PermissionResult | undefined;
 /**
  * design/252 G-7 — how long an approver-attribution identifier may be.
  *
@@ -575,12 +601,14 @@ export declare function decisionText(d: PermissionResult): string | undefined;
  *
  * `check` may be async, which is also how **human-in-the-loop approval** works: a deployment can
  * hold the promise open until an operator approves/denies. `signal` fires when the task aborts
- * (timeout / max turns / cancel) or the asking turn is interrupted (design/384) — honor it to release a
- * pending approval (F4; the Runner also races `check` against it). An already-aborted one: see `check`.
+ * (timeout / max turns / cancel) or the asking turn is interrupted (design/384), and on a synthetic probe when the judge
+ * stops waiting for this layer — honor it to release a pending approval (F4; the Runner also races `check` against it). An
+ * already-aborted one: see `check`. A request that states nobody can be asked about it: {@link ToolCallRequest.approvalReach}.
  */
 export interface ToolPolicy {
     /** @contract policy.check.aborted_signal_reaches_nobody — handed an already-aborted signal, `check` reaches no person and
-     *  no external approval (it answers at once, or with a `task_aborted` deny); visibility probes rely on it. */
+     *  no external approval (it answers at once, or with a `task_aborted` deny). The engine's probes do not rely on it: they hand a
+     *  live signal and state on the request that nobody can be asked (`approvalReach: "none"`, answered with `noApproverSeatDeny`). */
     check(req: ToolCallRequest, signal?: AbortSignal): PermissionResult | Promise<PermissionResult>;
     /**
      * The policy's CONSTRAINT PROJECTION — its deterministic DENY-verdict half expressed as pure data
@@ -1295,10 +1323,12 @@ export interface AskRequest {
      *  mint site added later is covered by construction); optional on the type because a deployment may
      *  invoke its approver function directly. */
     readonly boundInputHash?: string;
-    /** A call to the engine's `Skill` tool: the hash of {@link boundGrants} — the digest a parked approval of the same card is judged by, so a live card reconciles against its parked row by `(toolCallId, boundGrantDigest)` and an answer is remembered by "this tool + this binding". Present exactly on that call (whoever asked, however the question was worded), absent on every other card; `message` renders the same lists narrowed to what releases in the leg's mode. Reconciliation metadata, never adjudication input. */
+    /** A call to the engine's `Skill` tool: the hash of {@link boundGrants} — the digest a parked approval of the same card is judged by, so a live card reconciles against its parked row by `(toolCallId, boundGrantDigest)` and an answer is remembered by "this tool + this binding". Present exactly on that call (whoever asked, however the question was worded); every other card carries {@link boundGrantAbsence} instead; `message` renders the same lists narrowed to what releases in the leg's mode. Reconciliation metadata, never adjudication input. */
     readonly boundGrantDigest?: string;
     /** The value {@link boundGrantDigest} hashes: `{ skill, allowedTools, disallowedTools }` in canonical spelling (de-duplicated, sorted), `skill: null` when no loaded skill is named; a fresh copy per ask; same presence. Display metadata (deployment text — render with contextual escaping). */
     readonly boundGrants?: import("./skill-grant-binding.js").BoundSkillGrants;
+    /** Why this card carries no {@link boundGrantDigest} — every card the engine mints carries exactly one of the two: `not_bindable` (the call is not an activation of the engine's `Skill` tool, so it binds no grant and an answer may be remembered by the tool) or `unreadable` (a Skill card whose binding cannot be read — said by a stored row's reader; a live card always has its digest). The same factory mints both members; the park row and the inbox projection carry the same member. Reconciliation metadata, never adjudication input. */
+    readonly boundGrantAbsence?: import("./skill-grant-binding.js").BoundGrantAbsence;
     /**
      * design/179 §4, re-formed by design/375 §3.1 (BREAKING — this seat REPLACES the retired
      * `ruleSuggestions` key, which is never emitted again; the new name is the safe failure posture for
@@ -1358,8 +1388,9 @@ export interface AskRequest {
      *    seat's to say: it is answered per ask by {@link readRootCandidate}, which is present exactly when
      *    widening the session's read directories would clear this one and absent for every other member of
      *    the family — so a surface reads that seat and never infers an answer from this word;
-     *  · `"shadowed"` — a rule the person already wrote is speaking and does not clear this ask (a
-     *    matching allow rule that the lane refuses to honor here, or their own explicit `ask` rule);
+     *  · `"allow_outranked"` — an allow-layer member already matched this call and this question outranks it
+     *    ({@link allowRuleShadowed} says which): another allow rule would be outranked the same way;
+     *  · `"ask_rule_matched"` — an explicit `ask` rule matched: it keeps asking while it stands;
      *  · `"lane_cannot_speak"` — the lane is armed and this ask IS clearable, but the offer lane
      *    produced no rule for this command. Usually because the grammar has no text for it (a
      *    substitution, a subshell, a backgrounded process, or a simple command carrying a redirection —
@@ -1381,7 +1412,7 @@ export interface AskRequest {
      * and a surface that ignores it renders exactly the card it rendered before. The durable park row
      * carries the same seat under the same contract, filled by the same one factory.
      */
-    readonly ruleOffersAbsence?: "mandated" | "lane_cannot_speak" | "shadowed";
+    readonly ruleOffersAbsence?: import("./ask-origin.js").RuleOffersAbsence;
     /** The human/model-readable prompt explaining what needs approval. */
     message: string;
     /** Runner-filled source identity (design S1d §1): the end-user {@link AskRequest} issuing task's
@@ -1444,7 +1475,7 @@ export interface AskRequest {
      * remembered from an earlier call, at any scope, a session included — can retire this question; it is
      * answered only for THIS call, by an answerer (see the ask-arm member of the same name for who may). ABSENT is not the inverse claim: a person's own explicit `ask` rule and a
      * matching allow rule the lane already refused both leave it absent and still block rule clearance
-     * ({@link ruleOffersAbsence} words those `shadowed`). The wire twin of the
+     * ({@link ruleOffersAbsence} words them `ask_rule_matched` / `allow_outranked`). The wire twin of the
      * {@link PermissionResult} ask-arm member of the same name, minted once by the engine at the gate's
      * origin stamp and copied here by the four mint stations. The DOORS are enumerated once, at
      * {@link import("./ask-origin.js").ruleClearanceOf}: the tool seat's own egress / irreversibility
@@ -1452,7 +1483,7 @@ export interface AskRequest {
      * that could not answer, a write the protection judge matched or could not resolve, governance
      * ({@link requiresRealApproval}), a hook's screening authority, and an ask an ANCESTOR's approver
      * decides. Not a door: a person's own explicit `ask` rule, which {@link ruleOffersAbsence} words
-     * `shadowed` — a rule they wrote is speaking, and a posture answering it crosses no mandate.
+     * `ask_rule_matched` — a rule they wrote is speaking, and a posture answering it crosses no mandate.
      *
      * WHY a surface must read THIS member and not its neighbour. {@link ruleOffersAbsence} answers what
      * the RULE-OFFER LANE has to give, and that lane is structurally silent for any tool it does not

package/dist/core/tool-policy.js

@@ -15,7 +15,7 @@ import { heldBy } from "./tool-name-readings.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
 import { describeRejectedValue } from "./tool-search-setting.js";
-import { thrownText } from "./thrown-value.js";
+import { egressText, egressThrownText } from "./untrusted-egress.js";
 import { assertNoRetiredToolPolicyKeys, RETIRED_DECISION_MEMBERS } from "./retired-keys.js";
 import { isEngineRefusal, nestedRecordsOf, receiveContract, receiveNestedRecords, refusedOutOfContract, screenContractValues } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
@@ -102,8 +102,25 @@ export function attest(d, call, members) {
 export function withAttestation(d, record) {
     return record === undefined ? d : { ...d, attestation: record };
 }
+const UNASKED_SEAT_SETTLEMENTS = new Set(["task_aborted", "no_approver"]);
+function seatNeverAsked(settlement) {
+    return settlement !== undefined && UNASKED_SEAT_SETTLEMENTS.has(settlement.kind);
+}
+function unaskedSeatDeny(req, kind, message, origin) {
+    return attest({ action: "deny", message }, req, { settlement: settledByNobody(kind), origin });
+}
+export function noApproverSeatDeny(req, message, origin) {
+    return unaskedSeatDeny(req, "no_approver", message, origin);
+}
 export function abortedSeatDeny(req, message, origin) {
-    return attest({ action: "deny", message }, req, { settlement: settledByNobody("task_aborted"), origin });
+    return unaskedSeatDeny(req, "task_aborted", message, origin);
+}
+export function unaskedSeatAnswer(req, signal, say, origin) {
+    if (signal?.aborted === true)
+        return abortedSeatDeny(req, say.aborted, origin);
+    if (req.approvalReach === "none")
+        return noApproverSeatDeny(req, say.unreachable, origin);
+    return undefined;
 }
 export const APPROVER_ATTRIBUTION_MAX_CHARS = 256;
 const APPROVER_REFUSED_CHARS_RE = /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]/u;
@@ -442,8 +459,9 @@ export function createApprovalPolicy(opts) {
             }
             if (nameListHolds(need, req) || namespacedCoveringHit(needCovering, req)) {
                 const attestOver = (inputDigest) => (d, settlement) => ({ ...d, attestation: mintAttestation(req, { settlement, origin: "policy", inputDigest }) });
-                if (signal?.aborted)
-                    return abortedSeatDeny(req, `approval aborted for "${req.toolName}" (run or turn interrupted)`, "policy");
+                const unasked = unaskedSeatAnswer(req, signal, { aborted: `approval aborted for "${req.toolName}" (run or turn interrupted)`, unreachable: `approval for "${req.toolName}" was not requested: nobody can be asked about this call` }, "policy");
+                if (unasked !== undefined)
+                    return unasked;
                 const shown = tryCloneArgs(req.args);
                 if (!shown.ok) {
                     return attestOver(boundInputHashOf(req.args))({ action: "deny", message: `approval for "${req.toolName}" could not present the args safely (unclonable value: ${shown.reason}) — denied fail-closed` }, settledByNobody("presentation_failed"));
@@ -565,7 +583,7 @@ export function combinePolicies(...policies) {
             for (const p of policies) {
                 const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
-                    if (attestationOf(d, current)?.settlement?.kind !== "task_aborted")
+                    if (!seatNeverAsked(attestationOf(d, current)?.settlement))
                         return settleDeny(d);
                     seatDeny ??= settleDeny(d);
                     continue;
@@ -854,10 +872,10 @@ export function tryCloneArgs(v) {
     }
 }
 export function describeThrown(err) {
-    const contained = containThrownText(thrownText(err));
+    const contained = containThrownText(egressThrownText("same-principal", err));
     if (contained !== "")
         return contained;
-    return containThrownText(describeRejectedValue(err));
+    return containThrownText(egressText("same-principal", describeRejectedValue(err)));
 }
 const THROWN_TEXT_MAX = 300;
 function containThrownText(text) {

package/dist/core/types.d.ts

@@ -18,7 +18,7 @@ export type { PermissionMode } from "./ask-origin.js";
 export type { ToolEffect, ToolContentOrigin, ReversibilityVerdict, ReadRootGrantCandidate, ToolSpec, ToolReturn, NestedUsage, NestedUsageAccum, ToolExecuteContext } from "./tool-spec.js";
 export type { BeforeWriteRequest, BeforeWriteResult, BeforeWriteHook, TrackEditRequest, TrackEditResult, TrackFileEditHook, FileEditedNotice, FileEditedHook, HandsBandOptions } from "./hands-band.js";
 export type { AgentDefinition, SkillSpec } from "./agent-definition.js";
-export type { McpServerSpec, A2aServerSpec, McpElicitRequest, McpElicitResponse, OnElicit } from "./mcp-server-spec.js";
+export type { McpServerSpec, A2aServerSpec, McpElicitRequest, McpElicitResponse, OnElicit, McpRevocationLedger, McpMountIdentity } from "./mcp-server-spec.js";
 export type { TaskLimits } from "./task-limits.js";
 export type { TaskStatus, RemoteEnvFailureNote, EffectiveMemoryScopes, TaskResult, HumanReviewGateRow } from "./task-result.js";
 export type { TerminalCause, PausedCause } from "./terminal-cause.js";
@@ -26,8 +26,8 @@ export type { TaskEventIdentity, BrainStatusPhase, BrainRetryErrClass, BrainStat
 export type { TaskStream } from "./task-stream.js";
 export type { WorkflowGovernanceBaseline, RuntimeCaps, AutoModeDenySource } from "./runtime-caps.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
-export type { BackgroundChildEvent, DelegationLifecycleEvent } from "./delegation-frames.js";
-export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle, emitsChildRowFrames, taskStartedFrame } from "./delegation-frames.js";
+export type { BackgroundChildEvent, BackgroundChildRow, DelegationLifecycleEvent } from "./delegation-frames.js";
+export { __resetMalformedDelegationSeatAnnouncement, backgroundChildTerminal, deliverDelegationLifecycle, emitsChildRowFrames, taskStartedFrame } from "./delegation-frames.js";
 export type { ProjectMemoryLoad, ResumePreflightInfo, ResumePreflightVerdict, RunnerDeps } from "./runner-deps.js";
 export type { EngineNotice, OwedUserInputAccount, UserInputUndrainedCause } from "./engine-notice.js";
 export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./engine-notice.js";

package/dist/core/types.js

@@ -1,4 +1,4 @@
 export { MODEL_ROLES } from "./model-seat.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
-export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle, emitsChildRowFrames, taskStartedFrame } from "./delegation-frames.js";
+export { __resetMalformedDelegationSeatAnnouncement, backgroundChildTerminal, deliverDelegationLifecycle, emitsChildRowFrames, taskStartedFrame } from "./delegation-frames.js";
 export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./engine-notice.js";

package/dist/core/untrusted-egress.d.ts

@@ -1,18 +1,67 @@
-import { type RedactionReport } from "./arg-summary.js";
-export type { RedactionFinding, RedactionReport, RedactionConfidence, RedactionSource, SummarizableFinding, } from "./arg-summary.js";
-export { summarizeRedactions } from "./arg-summary.js";
-export declare function redactSecrets(s: string, report?: RedactionReport): string;
-export declare function redactHostLeaks(s: string, report?: RedactionReport): string;
-/** Secret-redact + size-bound (NO injection fence) — the SAME-PRINCIPAL tier: workflow outputs/results/errors
- *  riding back to the launching model/script, run rows behind scope-gated observe. Paths/URLs survive
- *  (the assertion pattern depends on them); secrets never do. */
-export declare function boundedRedactedSummary(value: unknown, max: number): string;
+import { type RedactionReport } from "./redaction-passes.js";
+export type { RedactionFinding, RedactionReport, RedactionConfidence, RedactionSource, SummarizableFinding, } from "./redaction-passes.js";
+export { summarizeRedactions } from "./redaction-passes.js";
 /**
- * The FULL untrusted-egress transform (design/97 CORE-2): full host-leak redaction + size-bound + FENCE. Use
+ * Every exit that redacts — into a model's context, a host's event or error lane, a log line, a person's screen — does it
+ * with ONE pass, its tier's, and nothing else redacts: a text through {@link egressText}, a thrown value's text through
+ * {@link egressThrownText}, a value with members (a thrown error, a marks bag) through {@link egressValue}, which runs the
+ * same pass over every string member. What comes out is an {@link Egress}: a string the type checker knows came out of
+ * that tier. What a tool RETURNS is its content, read by the model that asked for it, and is not redacted (CC redacts
+ * nothing there either); what is redacted is what the engine itself words or carries: errors, summaries, run rows.
+ *
+ * Two tiers, because the faces have two audiences (CC 2.1.212 alignment):
+ *  - **`same-principal`** — the model, the script and the host that launched the work (tool results, workflow agent
+ *    outputs / results / errors, run rows behind the scope-gated observe API, host error lanes): the credential
+ *    vocabulary only. Paths and URLs in a worker's answer are the caller's OWN machine's paths — redacting them killed the
+ *    cross-agent assertion pattern ("return the file you wrote" → `[redacted-path]`) while protecting no one;
+ *    cross-tenant isolation on these faces is ACCESS CONTROL (scope gates), not string surgery. CC redacts nothing here;
+ *    sema keeps the credential pass as a declared superset.
+ *  - **`human`** — text shown to a person or exported beyond the launching principal: the credential vocabulary plus
+ *    every URL and absolute path — host internals, and exfil-lure links in untrusted text.
+ * {@link untrustedEgressForHuman} additionally FENCES its text (design/97 CORE-2), so untrusted content cannot pose as
+ * instructions to its reader.
+ */
+export type EgressTier = "same-principal" | "human";
+declare const EGRESS_TIER: unique symbol;
+/** A string that came out of tier `T`'s pass. Only this module mints one. */
+export type Egress<T extends EgressTier> = string & {
+    readonly [EGRESS_TIER]: T;
+};
+/** Tier `tier`'s one pass over a text. */
+export declare function egressText<T extends EgressTier>(tier: T, text: string, report?: RedactionReport): Egress<T>;
+/** The text a thrown value reads as (`thrownText`), through tier `tier`'s pass: the one form a thrown value's words take
+ *  on their way out of the engine. */
+export declare function egressThrownText<T extends EgressTier>(tier: T, err: unknown): Egress<T>;
+/** The `same-principal` tier's pass, under the name hosts call it by (the engine calls {@link egressText}). */
+export declare function redactSecrets(s: string, report?: RedactionReport): Egress<"same-principal">;
+/** The `human` tier's pass, under the name hosts call it by (the engine calls {@link egressText}). */
+export declare function redactHostLeaks(s: string, report?: RedactionReport): Egress<"human">;
+/**
+ * Tier `tier`'s pass over every string member of `value`, returned as a DATA SNAPSHOT — never the value itself, so nothing
+ * that leaves can run the value's code again (a getter, a serializer, a proxy trap): a host's serializer, a log's inspector
+ * and the loop's own readers (`thrownText`, `thrownMarksOf`) reach what was read, once, and passed. The rules, one each:
+ *  - a string goes through {@link egressText}, and so does every member NAME; a function is code, not data, and is not
+ *    carried at any depth (the value handed in included: it comes back `undefined`); any other primitive is itself;
+ *  - an error (any realm, any class) is re-minted as a plain `Error` — never on the thrown value's prototype, whose
+ *    serializers and accessors would run again — carrying EVERY own member (`message`, `stack`, `cause`, `errors`,
+ *    `details`, `code` …) and its `name`, `message`, `code` and `stack` read once through its chain, all as own data;
+ *  - any other object is what JSON reads: its `toJSON(name)` when it has one (a `URL` is its `href`, a `Date` its ISO
+ *    text; one that answers itself is read for its members), otherwise its own enumerable members;
+ *  - a member whose name is a credential name (the vocabulary's record-key view: `password`, `Authorization`,
+ *    `x-api-key`) and whose reading is a string is the marker whole;
+ *  - cycles and shared members stay shared on the snapshot.
+ */
+export declare function egressValue<T extends EgressTier, V>(tier: T, value: V): V;
+/** The `same-principal` tier's pass + size-bound (NO injection fence): workflow outputs/results/errors riding back to
+ *  the launching model/script, run rows behind scope-gated observe. Paths/URLs survive (the assertion pattern depends on
+ *  them); secrets never do. */
+export declare function boundedRedactedSummary(value: unknown, max: number): Egress<"same-principal">;
+/**
+ * The FULL untrusted-egress transform (design/97 CORE-2): the `human` tier's pass + size-bound + FENCE. Use
  * for any worker prompt/output (#5 transcript) or steer content (#6) shown to a HUMAN or exported beyond the
  * launching principal, so untrusted text can neither leak host internals nor pose as instructions.
  */
 export declare function untrustedEgressForHuman(value: unknown, opts: {
     label: string;
     max: number;
-}): string;
+}): Egress<"human">;