@sema-agent/core 7.50.2 → 7.51.1

package/dist/core/runner/construction-doors.js

@@ -1,29 +1,18 @@
 import { checkedAgentConfigDir } from "../agent-config-dir.js";
 import { checkedMediaByteCap } from "../media-byte-cap.js";
+import { receiveOwnProperties, refuseProxy } from "../own-property-receipt.js";
 import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
+import { copyReadDenySeat, READ_DENY_DEPLOYMENT_SEATS } from "../read-face-seats.js";
 export function retainRunnerDeps(deps) {
+    const words = { subject: "RunnerDeps", unit: "seat", moment: "at new Runner" };
+    refuseProxy(deps, words);
     assertNoRetiredRunnerDeps(deps);
-    const refusal = (message) => {
-        const e = new Error(message);
-        e.code = "config.invalid_argument";
-        return e;
-    };
-    const proto = Object.getPrototypeOf(deps);
-    if (proto !== Object.prototype && proto !== null) {
-        throw refusal("RunnerDeps must be a plain object (its prototype is neither Object.prototype nor null): every seat is read once as an own property, and a seat its prototype would supply is not read — refused rather than wired without it");
-    }
-    const retained = Object.create(Object.prototype);
-    for (const name of Object.getOwnPropertyNames(deps)) {
-        let value;
-        try {
-            value = Reflect.get(deps, name);
-        }
-        catch {
-            throw refusal(`RunnerDeps.${name} threw while it was read at new Runner — a seat is read once, here; refused rather than wired without it`);
-        }
-        Object.defineProperty(retained, name, { value, enumerable: true, writable: true, configurable: true });
-    }
+    const retained = receiveOwnProperties(deps, words);
     checkedAgentConfigDir(retained.agentConfigDir, "RunnerDeps.agentConfigDir");
     checkedMediaByteCap(retained.mediaByteCapBytes, "RunnerDeps.mediaByteCapBytes");
+    for (const seat of READ_DENY_DEPLOYMENT_SEATS) {
+        if (Object.hasOwn(retained, seat))
+            Object.defineProperty(retained, seat, { value: copyReadDenySeat(Reflect.get(retained, seat)), enumerable: true, writable: true, configurable: true });
+    }
     return retained;
 }

package/dist/core/runner/contracts.d.ts

@@ -53,7 +53,7 @@ import type { OnAsk, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy
 import type { RemoteExecutionEnv, SnapshotId, WorkspaceHandle } from "../remote-env.js";
 import type { ToolDisclosureManifest } from "../trace.js";
 import type { AgentDefinition, Brain, CompactOutcome, ModelRef, ModelRoles, NestedUsageAccum, PermissionMode, RunnerDeps, ShellGateDoctrine, TaskEvent, TaskEventIdentity, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
-import type { PermissionModeController } from "../mode-policy.js";
+import type { InheritedAutoModeFace, PermissionModeController } from "../mode-policy.js";
 import type { WiringManifest } from "../wiring-manifest.js";
 import type { SkillGateSeats, SkillGrantLane, SkillGrantRecord, SkillGrantSource } from "../skill-grant.js";
 import type { BudgetAxis } from "./assemble-result.js";
@@ -450,8 +450,8 @@ export interface Prepared {
     };
     /** The deployment's caller policy, re-checked on a durable resume when the bytes to execute are not the bytes the gate saw. */
     basePolicyForResumeEdit?: ToolPolicy;
-    /** The WRITE face of the run's synthetic judge (the settle tail's background consolidation asks it): an `ask` is an objection. */
-    syntheticWriteVerdict: import("../synthetic-read-verdict.js").SyntheticWriteJudge;
+    /** The leg's consolidation write judge (`createConsolidationWriteJudge`, the settle tail's background consolidation asks it). */
+    consolidationWriteJudge: import("../memory-engine/consolidation-driver.js").ConsolidationWriteJudge;
     approvedCallScreen?: (call: {
         toolCallId: string;
         toolName: string;
@@ -1390,7 +1390,7 @@ export interface PrepareResume {
  * hook, deduped by full installation so a deps-level hook is consulted once per call at any depth).
  * Depth-N delegation is therefore a linear chain, each layer evaluated at most once per tool call.
  */
-export interface InheritedGate {
+export interface InheritedGate extends InheritedAutoModeFace {
     /** Serializable ancestor session-rule snapshots (data half), ancestors first. */
     ancestorRules?: ReadonlyArray<{
         sessionId: string;

package/dist/core/runner/gate-exit.js

@@ -1,4 +1,4 @@
-import { screenGateOutcome, SETTLEMENT_IS_REFUSAL, releasePolicyDefects } from "../gate-outcome.js";
+import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
 import { askFaceOf, classifyAsk, headlessApprovalRemedy } from "../ask-origin.js";
 import { wireOf } from "../tool-name-readings.js";
 import { isProtectedWrite } from "../tool-registry.js";
@@ -23,7 +23,7 @@ export function mintGateOutcome(facts) {
             : { kind: "allowed", ...(attribution !== undefined ? { classifier: attribution } : {}), ...(facts.released !== undefined ? { released: Object.freeze({ ...facts.released, classes: Object.freeze([...facts.released.classes]) }) } : {}) }),
         ...(facts.settled !== undefined ? { settlement: settlement, origin: facts.settled.origin } : {}),
     });
-    const defects = [...screenGateOutcome(outcome), ...releasePolicyDefects(outcome)];
+    const defects = screenGateOutcome(outcome, { reading: "producer" });
     if (defects.length > 0)
         throw new Error(`the tool gate composed an outcome that violates its own record: ${defects.join("; ")}`);
     return outcome;

package/dist/core/runner/memory-consolidation-write-judge.d.ts

@@ -1,17 +1,61 @@
 /**
- * The Runner's half of the consolidation driver's write judge: the leg's synthetic write judge as the seat
- * `runMemoryConsolidationDriver` asks (for the library directory before it claims anything, then for each file a commit
- * lands), and the refusal's notice dialect for the auto lane. The judgment itself is `createSyntheticWriteJudge` — the layers
- * a model's own `Write` meets; nothing here judges.
+ * The consolidation driver's write judge — the seat `runMemoryConsolidationDriver` asks (for the library directory before it
+ * claims anything, then for each file a commit lands) — minted by ONE constructor, {@link createConsolidationWriteJudge}, for
+ * every caller: the Runner's auto lane (a leg, with every layer a model's own `Write` meets on it) and a host's own
+ * consolidation valve (no leg: its rule store, the person, the local-owner declaration, its caller policy). The judgment is
+ * `createSyntheticWriteJudge`'s over the person's and the org's rows read through the gate's own lanes; nothing here judges.
+ * Beside it, the refusal's notice dialect ({@link deliverWriteRefusal}).
  */
-import type { SyntheticWriteJudge } from "../synthetic-read-verdict.js";
+import { type SyntheticReadLayers, type SyntheticWriteFacts } from "../synthetic-read-verdict.js";
 import { type ConsolidationWriteJudge } from "../memory-engine/consolidation-driver.js";
 import { type EngineNotice } from "../engine-notice.js";
+import type { PermissionRuleStoreProvider } from "../permission-rule-provider.js";
+import { type ToolPolicy } from "../tool-policy.js";
+import type { ExecutionEnv } from "../../internal/harness-types.js";
+import { createPermissionRuleLanes } from "./permission-rule-lanes.js";
+/** What every caller states: the layers a host has. */
+export interface ConsolidationWriteJudgeInput {
+    /** The deployment's permission-rule store (`RunnerDeps.permissionRuleStore`): the person's standing rows and the org's. */
+    ruleStoreProvider?: PermissionRuleStoreProvider;
+    /** Whose rows are read: the principal the library belongs to. Absent or empty ⇒ the anonymous floor (no personal row),
+     *  or the local owner's bucket where `localOwnerDeclared`. */
+    principal?: string;
+    /** `RunnerDeps.localOwnerRules`: a declaration a store cannot honor is refused at construction, loudly. */
+    localOwnerDeclared?: boolean;
+    /** The deployment's caller policy (`RunnerDeps.toolPolicy`), asked with a live signal and a request that states nobody can
+     *  be asked about it (`ToolCallRequest.approvalReach: "none"`) — never an approver. */
+    callerPolicy?: ToolPolicy;
+    /** The session the person's session-scoped rows are read under. Absent ⇒ the judgment is no session's: no session row applies. */
+    sessionId?: string;
+    /** Where the person's relative and `~/` rows anchor: the project root (also which project rows apply) and the home. Absent ⇒
+     *  such a row cannot be anchored, and a deny or ask it holds is an OBJECTION (fail closed) — the judge never guesses where a
+     *  row would have pointed. */
+    anchors?: {
+        root?: string;
+        home?: string;
+    };
+    /** The environment the library's paths and the rows' heads resolve in — the one a leg of this deployment judges in (links
+     *  followed both ways: a row spelled through a link binds the target's real location, a target spelled through one is judged
+     *  where it leads). Absent ⇒ the engine process's own filesystem, where an in-process file backend writes the library. */
+    executionEnv?: ExecutionEnv;
+}
+/** What a leg adds — the Runner's prepare passes it; a host has none of it. */
+export interface ConsolidationWriteJudgeLeg {
+    /** The leg's reader of the person's rows, one the run's cut does not end (the judge is asked after the run). */
+    rows: Parameters<typeof createPermissionRuleLanes>[0]["rows"];
+    /** The leg's facts the lanes judge against: its session, root and anchors, its resolution of rule heads, its sinks. */
+    lanes: Omit<Parameters<typeof createPermissionRuleLanes>[0], "provider" | "localOwnerDeclared" | "principal" | "rows">;
+    /** The layers only a leg has: its skill rows, its narrowing fold, the live inherited policies, its target stamp. */
+    layers: Omit<SyntheticReadLayers, "callerPolicy" | "persistedRuleLane" | "orgRuleLane" | "signal">;
+    /** The facts a live write carries on the leg, read at each judgment. */
+    facts: () => SyntheticWriteFacts;
+}
 /**
- * The leg's write judge as the consolidation driver's seat: each target the run asks about is put to the leg's synthetic
- * Write judge as one `Write` of that path, under a deadline of its own. The answer is the judge's, unchanged — nothing here
- * decides, merges or defaults.
+ * The consolidation write judge: each target the run asks about is put, as one `Write` of that path under a deadline of its
+ * own, to the synthetic Write judge over the caller policy, the person's and the org's rows (the gate's own lanes over a
+ * reader of the store) and whatever layers `leg` adds. The answer is the judge's, unchanged. A host passes `input` alone; the
+ * engine's leg passes the same `input` and its `leg`, so the same rows give the same answer on both.
  */
-export declare function consolidationWriteJudgeOfLeg(judge: SyntheticWriteJudge): ConsolidationWriteJudge;
+export declare function createConsolidationWriteJudge(input: ConsolidationWriteJudgeInput, leg?: ConsolidationWriteJudgeLeg): ConsolidationWriteJudge;
 /** Deliver a write-judge refusal as the verb's refusal notice; false (nothing delivered) for any other error. */
 export declare function deliverWriteRefusal(err: unknown, scope: string, onNotice: ((notice: EngineNotice) => void) | undefined): boolean;

package/dist/core/runner/memory-consolidation-write-judge.js

@@ -1,11 +1,49 @@
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
+import { createSyntheticWriteJudge } from "../synthetic-read-verdict.js";
 import { CONSOLIDATION_WRITE_REFUSED_CODE } from "../memory-engine/consolidation-driver.js";
 import { ConsolidationRefusedError } from "../memory-engine/consolidation.js";
 import { memoryConsolidationRefusedNotice } from "../memory-engine/engine.js";
 import { deliverEngineNotice } from "../engine-notice.js";
-export function consolidationWriteJudgeOfLeg(judge) {
+import { toolPolicyPathRules } from "../tool-policy.js";
+import { RosterBuilder, toolCallFaceOf } from "../tool-roster.js";
+import { createHeadLeads } from "../path-rule-binding.js";
+import { legCallTargetStamp } from "../effective-path-target.js";
+import { createWriteFileTool } from "../../tools/fs/fs-write.js";
+import { whereItsAnsweredPrefixLeads } from "../../tools/fs/read-deny-home.js";
+import { NodeExecutionEnv } from "../../engine/execution-env/node-execution-env.js";
+import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
+import { createPermissionRuleLanes } from "./permission-rule-lanes.js";
+import { createPersonPathRows } from "./person-path-rows.js";
+const noLine = () => undefined;
+let engineWrite;
+function engineWriteFace() {
+    if (engineWrite === undefined) {
+        const roster = new RosterBuilder(new Map());
+        roster.mount(createWriteFileTool(new NodeExecutionEnv({ cwd: "/" }), new Map(), "/"), { source: "builtin", mountedBy: "hands" });
+        engineWrite = toolCallFaceOf(roster.snapshot({ effects: new Map(), egress: new Set(), irreversibilityTier: new Map(), reversibilityProbes: new Map(), deferred: new Set(), trustedTools: new Set() }), "Write");
+    }
+    return engineWrite;
+}
+export function createConsolidationWriteJudge(input, leg) {
+    const owner = { provider: input.ruleStoreProvider, localOwnerDeclared: input.localOwnerDeclared === true, principal: input.principal };
+    const { rows, lanes, layers, facts } = leg ?? hostLeg(input, owner);
+    const { personal, org } = createPermissionRuleLanes({ ...owner, ...lanes, rows });
+    const judge = createSyntheticWriteJudge({ ...layers, ...(input.callerPolicy !== undefined ? { callerPolicy: input.callerPolicy } : {}), ...(personal !== undefined ? { persistedRuleLane: personal } : {}), ...(org !== undefined ? { orgRuleLane: org } : {}) }, facts);
     return (target) => judge({ file_path: target.path }, "memory-consolidation", { deadlineAt: Date.now() + ORG_ADJUDICATION_TIMEOUT_MS });
 }
+function hostLeg(input, owner) {
+    const { root, home } = input.anchors ?? {};
+    const env = input.executionEnv ?? new NodeExecutionEnv({ cwd: root ?? "/" });
+    const leads = createHeadLeads((part) => whereItsAnsweredPrefixLeads(env, part));
+    const chainTop = { ...(root !== undefined ? { root } : {}), ...(home !== undefined ? { home } : {}) };
+    const sessionId = input.sessionId;
+    return {
+        rows: createPersonPathRows({ ...owner, sessionId, root, rootCanonical: undefined, leads, chainTop, onDisclosure: noLine, onUnread: noLine, onRowsDropped: noLine }),
+        lanes: { sessionId, root, rootCanonical: undefined, chainTop, leads, liveCwd: () => root, home, questionToolMounted: false, questionToolName: ASK_USER_QUESTION_TOOL_NAME, onRevisionDefect: noLine, onDisclosure: noLine },
+        layers: { stampCallTarget: legCallTargetStamp({ env, root: root ?? "/", cwd: () => root, judgesPaths: () => true, leads: () => leads.resolve(toolPolicyPathRules([input.callerPolicy], chainTop)) }) },
+        facts: () => ({ face: engineWriteFace(), ...(root !== undefined ? { root, cwd: root } : {}) }),
+    };
+}
 export function deliverWriteRefusal(err, scope, onNotice) {
     if (!(err instanceof ConsolidationRefusedError) || err.code !== CONSOLIDATION_WRITE_REFUSED_CODE)
         return false;

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -24,7 +24,7 @@
  * silence the ungated-write warning for deployments that wired no policy at all.
  */
 import type { AskRuleEvidence, ToolCallRequest } from "../tool-policy.js";
-import { persistedRuleMandateOf, type RuleClearanceFacts } from "../ask-origin.js";
+import { persistedRuleMandateOf, type RuleClearanceFacts, type RuleOffersAbsence } from "../ask-origin.js";
 import { type OrgGateVerdict, type PersistedRuleAnswer, type PersistedRuleHit, type PersistedRuleUnreadable } from "../hooks.js";
 import type { PersistedRule, PersistedRuleVerdict, RuleOffer, ScopeRootIdentity, SegmentCoverage } from "../permission-rule-model.js";
 import { type PathRuleBases } from "../permission-rule-model.js";
@@ -146,10 +146,12 @@ export declare function createPermissionRuleLanes(cfg: {
     provider: PermissionRuleStoreProvider | undefined;
     localOwnerDeclared: boolean;
     principal: string | undefined;
-    sessionId: string;
+    /** The session whose session-scoped rows apply; `undefined` (a judgment no session makes) ⇒ none does. */
+    sessionId: string | undefined;
     /** The isolation-aware task root — the same value the file fence, the prompt cwd and the session rules
-     *  use, so a project-scoped rule agrees with every other place that says "this project" (which project rows apply). */
-    root: string;
+     *  use, so a project-scoped rule agrees with every other place that says "this project" (which project rows apply).
+     *  `undefined` (a judgment outside any task) ⇒ no project row applies and a row anchored at the root cannot be anchored. */
+    root: string | undefined;
     /** The same root's canonical spelling (`undefined`: none could be read): a project row applies when its scope root covers
      *  either spelling of it — the row's root resolved where it leads ({@link projectScopeIdentity}). */
     rootCanonical: string | undefined;
@@ -180,12 +182,6 @@ export declare function createPermissionRuleLanes(cfg: {
     /** The allow layer's auto strip over a stored ALLOW row (true ⇒ out of this call's table BEFORE the coverage is chosen). */
     stripsAllow?: (rule: PersistedRule, req: ToolCallRequest) => boolean;
 }): PermissionRuleLanes;
-/** The closed reason set for the rule-offer factory's empty answer — the same three
- *  spellings the `AskRequest` and durable-row seats declare, kept at the one factory that fills both.
- *  Deliberately not exported: this is a wire vocabulary, and its two faces declare it literally (the
- *  `previewWithheld` precedent) so a consumer reads the closed set on the type it is holding rather
- *  than through an import. */
-type RuleOffersAbsence = "mandated" | "lane_cannot_speak" | "shadowed";
 /** The surviving-ask facts the rule-offer factory reads (see {@link createRuleOffersOf}): the
  *  synchronous mint sites spread the surviving decision, which carries them; the park leg threads
  *  each as its own parameter. The clearance half is {@link RuleClearanceFacts} — the SAME declaration
@@ -242,9 +238,8 @@ interface RuleOffersAskFacts extends RuleClearanceFacts {
  * cannot disagree). The doctrine it serves is the loud-bad-value one, applied to an absence: a
  * surface reading an empty card could not tell "there is nothing this lane could offer" from
  * "offers were deliberately suppressed", and a person reading it could not tell "write the rule
- * yourself" from "no rule can excuse this approval". The seat is CLOSED
- * (`mandated | lane_cannot_speak | shadowed`), mutually exclusive with `ruleOffers` by
- * construction, and structural-door silent (see the first two guards).
+ * yourself" from "no rule can excuse this approval". The seat is CLOSED ({@link RuleOffersAbsence}),
+ * mutually exclusive with `ruleOffers` by construction, and structural-door silent (see the first two guards).
  */
 export declare function createRuleOffersOf(cfg: {
     /** `permissionRuleLane !== undefined` at wiring time — the armed-lane structural door. */

package/dist/core/runner/person-path-rows.d.ts

@@ -131,9 +131,10 @@ export interface PersonPathRowsConfig {
     provider: PermissionRuleStoreProvider | undefined;
     localOwnerDeclared: boolean;
     principal: string | undefined;
-    sessionId: string;
-    /** The leg's own root: which project rows apply (either spelling of it — {@link projectScopeIdentity}). */
-    root: string;
+    /** The session whose session-scoped rows are read; `undefined` ⇒ none. */
+    sessionId: string | undefined;
+    /** The leg's own root: which project rows apply (either spelling of it — {@link projectScopeIdentity}); `undefined` ⇒ none. */
+    root: string | undefined;
     rootCanonical: string | undefined;
     /** The leg's resolution of locations (a project row's scope root, where it leads). */
     leads: HeadLeads;

package/dist/core/runner/policy-throw.js

@@ -1,8 +1,8 @@
-import { thrownLabel, thrownText } from "../thrown-value.js";
-import { redactSecrets } from "../untrusted-egress.js";
+import { thrownLabel } from "../thrown-value.js";
+import { egressText, egressThrownText } from "../untrusted-egress.js";
 import { inlineUntrusted, PROBE_REASON_MAX } from "../untrusted-text.js";
 export function policyThrowLine(err) {
-    const line = inlineUntrusted(redactSecrets(thrownText(err)), PROBE_REASON_MAX);
+    const line = inlineUntrusted(egressThrownText("same-principal", err), PROBE_REASON_MAX);
     return line === "" ? "(no message)" : line;
 }
 export function policyCheckAbortedDeny() {
@@ -18,7 +18,7 @@ export function reportPolicyThrow(report, seat, call, err, signal) {
     if (signal?.aborted === true)
         return;
     try {
-        report(new Error(`${seat} threw while judging "${call.toolName}" (toolCallId ${call.toolCallId}); the call was denied fail-closed: ${redactSecrets(thrownLabel(err))}`));
+        report(new Error(`${seat} threw while judging "${call.toolName}" (toolCallId ${call.toolCallId}); the call was denied fail-closed: ${egressText("same-principal", thrownLabel(err))}`));
     }
     catch {
     }

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -24,7 +24,7 @@ import { forkGovernanceDenial } from "../../agents/subagent.js";
 import type { PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
 import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
-import type { PermissionModeController } from "../mode-policy.js";
+import { type PermissionModeController } from "../mode-policy.js";
 import { type AutoModeDecider, type AutoModeDenialTracker } from "../auto-mode.js";
 import { type CheckpointSeat } from "../checkpoint-seat.js";
 import { type ComplianceCapability } from "../compliance.js";
@@ -55,8 +55,9 @@ export interface PrepareCapsAndWorkflowInput {
      *  config doors): the plan-pair face reads the store it names, the Workflow mount hands the seat itself to its children. */
     checkpointSeat: CheckpointSeat | undefined;
     /** borrowed-readonly — the trusted spawn-side channel; the Workflow mount forwards `rootSessionId`, `placementRoot`,
-     *  `onTaskNotification`, `workflowDepth`, and the capture-floor getter reads `memoryCaptureAncestors`. */
-    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume" | "questionFaceStripped"> | undefined;
+     *  `onTaskNotification`, `workflowDepth`, the capture-floor getter reads `memoryCaptureAncestors`, and the arming reads
+     *  the chain's auto-mode face (`inheritedGate.autoModeFace`). */
+    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume" | "questionFaceStripped" | "inheritedGate"> | undefined;
     /** borrowed-readonly — the acquired session; the classifier leg rebuilds its transcript window from `buildContext`. */
     session: Pick<StoredSession, "buildContext">;
     /** borrowed-readonly — the acquired session id (operator-line context, the refusal codes' phase record). */

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -9,6 +9,7 @@ import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-
 import { autoModeArmingRecipeOf } from "../auto-mode-arming.js";
 import { AUTO_MODE_CLASSIFIER_MAX_RETRIES } from "../auto-mode-defaults.js";
 import { buildAutoModePrompt, readDenyClassifierRules, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
+import { autoModeFaceOf } from "../mode-policy.js";
 import { autoModeClassifierFallbackOf, createAutoModeDecider, createAutoModeDenialTracker, screenAutoModeKnobs } from "../auto-mode.js";
 import { checkpointStoreOfSeat } from "../checkpoint-seat.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, resolveComplianceDenies } from "../compliance.js";
@@ -210,15 +211,16 @@ export async function prepareCapsAndWorkflow(input) {
     const autoModeDeciderRef = { current: undefined };
     const autoModeDenialTrackingRef = { current: undefined };
     const autoModeArmingRef = { current: undefined };
-    const autoModeArmReason = () => autoModeArmReasonOf(permissionMode.declared === "auto", deps.autoMode !== undefined, runtimeCaps, runtimeCapsFaulted);
-    if (deps.autoMode !== undefined)
-        screenAutoModeKnobs(deps.autoMode);
+    const autoModeFace = autoModeFaceOf(deps, internals?.inheritedGate);
+    const autoModeArmReason = () => autoModeArmReasonOf(permissionMode.declared === "auto", autoModeFace !== undefined, runtimeCaps, runtimeCapsFaulted);
+    if (autoModeFace !== undefined)
+        screenAutoModeKnobs(autoModeFace);
     const armAutoMode = async () => {
         if (autoModeDeciderRef.current !== undefined)
             return;
-        if (permissionMode.declared !== "auto" || deps.autoMode === undefined || runtimeCaps?.autoMode === false)
+        if (permissionMode.declared !== "auto" || autoModeFace === undefined || runtimeCaps?.autoMode === false)
             return;
-        const am = deps.autoMode;
+        const am = autoModeFace;
         const classifierSeat = classifierSeatModel({ deps, main: model });
         let classifierModel = classifierSeat.model;
         if (await derivedRouteFallsBack({ seat: "auto-mode-classifier", derived: classifierModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice, sessionId, runId, onBrokenPairing: autoModeClassifierFallbackOf(am.classifierFallback) === "none" ? "refuse" : "fall_back" })) {
@@ -277,7 +279,7 @@ export async function prepareCapsAndWorkflow(input) {
         autoModeDenialTrackingRef.current = denialTracking;
         autoModeArmingRef.current = arming;
     };
-    permissionMode.bindArming({ caps: runtimeCaps, autoFacePresent: deps.autoMode !== undefined, armAuto: armAutoMode, onArmFault: (e) => deps.onError?.(asThrownError(e), { phase: "config", sessionId }) });
+    permissionMode.bindArming({ caps: runtimeCaps, autoFacePresent: autoModeFace !== undefined, armAuto: armAutoMode, onArmFault: (e) => deps.onError?.(asThrownError(e), { phase: "config", sessionId }) });
     const deploymentWorkflowReady = runnerSelf !== undefined && isSelfOrchestrationActive(spec, deps);
     const selfOrchestrationActive = deploymentWorkflowReady && runtimeCaps?.allowWorkflows !== false;
     if (deploymentWorkflowReady && runtimeCaps?.allowWorkflows === false) {

package/dist/core/runner/prepare-gate-stations.js

@@ -2,12 +2,12 @@ import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { mountedToolRequiresUserInteraction } from "../mode-policy.js";
 import { complianceCallDenial } from "../compliance.js";
 import { cloneObserverInput, formatHookFeedback, runToolGate } from "../hooks.js";
-import { screenGateOutcome, releasePolicyDefects } from "../gate-outcome.js";
+import { screenGateOutcome } from "../gate-outcome.js";
 import { directDeny, frozenInputSnapshot } from "./gate-exit.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
-import { askReachesPerson } from "../wiring-manifest.js";
+import { approvalRouteOf } from "../wiring-manifest.js";
 import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
 import { callFaceSeat, rosterToolName, survivorsByName, toolCallFaceOf } from "../tool-roster.js";
@@ -20,7 +20,7 @@ function screenGateResult(result) {
     const gate = result.gate;
     if (gate === undefined)
         return { defects: ["a tool-gate result carried no outcome record on a terminal exit — every terminal exit mints one; the frame carries none"] };
-    const defects = [...screenGateOutcome(gate), ...releasePolicyDefects(gate)];
+    const defects = screenGateOutcome(gate, { reading: "producer" });
     const blocked = result.block === true;
     if ((gate.disposition.kind === "denied") !== blocked) {
         defects.push(`a tool-gate result's outcome reads "${gate.disposition.kind}" on ${blocked ? "a blocked" : "an executing"} call — the two faces of one verdict disagree; the frame carries no outcome`);
@@ -140,7 +140,7 @@ export function prepareGateStations(input) {
                         ...(notifyPermissionDenied ? { permissionDenied: (p) => notifyPermissionDenied({ ...p, permissionMode: permissionMode.observed }) } : {}),
                         onHookError: notifyHookError,
                         shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
-                        ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), approvalSeat: askReachesPerson(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
+                        ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), route: approvalRouteOf(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
                         permissionMode: () => permissionMode.current, askSeatForm: askRoute.form,
                         ...(markSources.size > 0 ? { toolMarkSources: markSources } : {}),
                         ...seatInputsFor(e.toolName, wireOf("gate.skillActivationSeat", call)),

package/dist/core/runner/prepare-hands-readface.js

@@ -19,6 +19,7 @@ import { sessionSeatAnchorHolds } from "./session-read-file-states.js";
 import { rebaseWorkspacePath } from "./workspace-path.js";
 import { RosterBuilder } from "../tool-roster.js";
 import { unionAddOnly } from "../child-clamp-seats.js";
+import { assertStringArraySeat } from "../read-face-seats.js";
 import { modePolicyOf } from "../mode-policy.js";
 const faceClampAnnouncedSinks = { read: new WeakSet(), write: new WeakSet() };
 const faceClampConsoleAnnounced = { read: false, write: false };
@@ -39,25 +40,6 @@ export function __resetReadFaceClampAnnouncement() {
     faceClampConsoleAnnounced.read = false;
     faceClampConsoleAnnounced.write = false;
 }
-function assertStringArraySeat(value, seat, entryLaw) {
-    if (value === undefined)
-        return;
-    if (!Array.isArray(value)) {
-        const e = new Error(`${seat} must be an array or absent (got ${value === null ? "null" : typeof value}) — a non-array here would be iterated character by character, so it refuses loudly instead.`);
-        e.code = "config.read_face_seat";
-        throw e;
-    }
-    if (entryLaw !== "strings")
-        return;
-    const entries = value;
-    for (const entry of entries) {
-        if (typeof entry !== "string") {
-            const e = new Error(`${seat} entries must be strings (got ${entry === null ? "null" : typeof entry}).`);
-            e.code = "config.read_face_seat";
-            throw e;
-        }
-    }
-}
 function writeFaceReader(input, onDeploymentClamp) {
     const { spec, deps, resume, fullShellReachable, permissionMode } = input;
     const seats = { kind: "write", readOnlyMount: spec.handsReadOnly === true, orgGoverned: deps.permissionRuleStore?.partitions.org === true, fullShellReachable };

package/dist/core/runner/prepare-inherited-gate.js

@@ -8,7 +8,7 @@ import { StubExecutionEnv } from "../stub-env.js";
 import { askApproverIdentity, durableMandateSourceOf } from "../tool-policy.js";
 import { chainAnchorRecords } from "./child-tree.js";
 import { deliverEngineNotice } from "../types.js";
-import { PermissionModeController, modeRequestAfterResume } from "../mode-policy.js";
+import { PermissionModeController, autoModeFaceOf, modeRequestAfterResume } from "../mode-policy.js";
 import { SessionModeSeats } from "./session-mode-seats.js";
 import { recordedModeSeed } from "../checkpoint-store.js";
 import { frozenSkillGrants } from "../skill-grant.js";
@@ -42,22 +42,22 @@ export function prepareInheritedGate(input) {
         const policy = pathRuleAnchors.onLeg(pc.policy, position);
         return policy === pc.policy ? pc : { ...pc, policy };
     });
-    const inheritedParentConstraints = attachRebuiltDenialTrackers(chainView, deps.autoMode?.denialLimit);
+    const autoModeFace = autoModeFaceOf(deps, liveInheritedGate);
+    const inheritedParentConstraints = attachRebuiltDenialTrackers(chainView, autoModeFace?.denialLimit);
     const parentSeat = liveInheritedGate?.permissionModeCeiling;
     const ceiling = parentSeat ?? liveInheritedGate?.permissionMode;
-    const announceModeFold = (receipt) => {
+    const announceModeFold = (receipt, folded) => {
         if (receipt.foldedBy === undefined)
             return;
-        const requested = receipt.requested ?? "default";
         const because = receipt.foldedBy === "operator_deny" ? "the deployment denies it for this principal" : receipt.foldedBy === "face_absent" ? "no auto-mode classifier face is wired on this deployment" : `the parent leg's mode is the ceiling a child's declaration is clamped under`;
-        const message = `permission mode "${requested}" is not available on this leg (${because}) — it runs under "${receipt.effective}"`;
-        deliverEngineNotice(deps.onNotice, { code: "config.permission_mode_unavailable", message, detail: { requested, effective: receipt.effective, by: receipt.foldedBy, sessionId, runId } });
-        if (receipt.foldedBy === "inherited_ceiling" && parentSeat !== undefined) {
-            deliverEngineNotice(deps.onNotice, { code: "config.permission_mode_unavailable", message: `${message} (a child leg, ${sessionId})`, detail: { requested, effective: receipt.effective, by: receipt.foldedBy, sessionId: parentSeat.sessionId, childSessionId: sessionId, runId } });
+        const message = `permission mode "${folded}"${receipt.requested === undefined ? " (inherited)" : ""} is not available on this leg (${because}) — it runs under "${receipt.effective}"`;
+        deliverEngineNotice(deps.onNotice, { code: "config.permission_mode_unavailable", message, detail: { requested: folded, effective: receipt.effective, by: receipt.foldedBy, sessionId, runId } });
+        if (parentSeat !== undefined) {
+            deliverEngineNotice(deps.onNotice, { code: "config.permission_mode_unavailable", message: `${message} (a child leg, ${sessionId})`, detail: { requested: folded, effective: receipt.effective, by: receipt.foldedBy, sessionId: parentSeat.sessionId, childSessionId: sessionId, runId } });
         }
     };
     const permissionMode = new PermissionModeController(modeRequestAfterResume(permissionModeSeat, modeSeed, resume?.outcome), ceiling, { onFold: announceModeFold, ...(modeSeed.prePlanMode !== undefined ? { prePlanMode: modeSeed.prePlanMode } : {}) });
-    announceModeFold(permissionMode.receipt());
+    permissionMode.announceStart();
     const { ceiling: legModeCeiling, commit: commitLegModeCeiling, end: endModeCeiling } = (internals?.sessionModeSeats ?? new SessionModeSeats()).legCeiling(sessionId, permissionMode);
     const commitModeSeats = (legSignal) => {
         commitLegModeCeiling();
@@ -186,6 +186,7 @@ export function prepareInheritedGate(input) {
             ...(effectiveShellGate !== undefined ? { shellGate: effectiveShellGate } : {}),
             permissionMode: permissionMode.current,
             permissionModeCeiling: legModeCeiling,
+            ...(autoModeFace !== undefined ? { autoModeFace } : {}),
             ...(parentConstraints.length > 0 ? { parentConstraints } : {}),
             ...chainAnchorRecords(pathRuleAnchors.chainTop, parentConstraints),
             admittedOrgScopes: memoryAdmittedOrgScopesRef.current,

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -107,8 +107,6 @@ export interface PreparePolicyChainInput {
     /** borrowed-readonly — the run's one reader of the person's rules (`person-path-rows.ts`): the lanes take each call's
      *  pinned read from it. */
     personRows: import("./person-path-rows.js").PersonPathRows;
-    /** borrowed-readonly — a reader of the same rows the run's cut does not end (the same notices), for the lane asked after the run. */
-    personRowsBeyondRun: import("./person-path-rows.js").PersonPathRows;
     /** borrowed-readonly — whether the question tool mounted (the lanes' question-tool exclusion). */
     questionToolMounted: boolean;
     /** borrowed-readonly — the resolved per-principal entitlements; only `forceDurableGate` (the mandate-park facility and
@@ -241,9 +239,9 @@ export interface PreparePolicyChainResult {
     grantBindingOf: GrantBindingOf;
     /** owned — the personal permission-rule lane, or undefined. */
     permissionRuleLane: PermissionRuleLanes["personal"];
-    /** owned — the same two lanes (personal and org) over the reader the run's cut does not end, for the one judgment asked after the
-     *  run has ended (the synthetic write face). */
-    ruleLanesBeyondRun: PermissionRuleLanes;
+    /** owned — the leg's facts the two lanes judge against (session, root and anchors, head leads, sinks), for the consolidation
+     *  write judge, which builds its own two lanes over the reader the run's cut does not end (it is asked after the run). */
+    ruleLaneFacts: import("./memory-consolidation-write-judge.js").ConsolidationWriteJudgeLeg["lanes"];
     /** owned — the org permission-rule lane (`Prepared.permissionRuleOrg`), or undefined. */
     permissionRuleOrgLane: PermissionRuleLanes["org"];
     /** owned — whether the sandbox-admission mode armed (declared isolation with its park prerequisites). */

package/dist/core/runner/prepare-policy-chain.js

@@ -20,13 +20,14 @@ import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-polic
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
 import { headlessDenyAtFold, headlessDenyAtRecheck, INHERITED_STATION_FACTS, inheritedAskCarry, inheritedAskFallbackMessage, judgeInheritedClassifier, lateAskSettlementObserver, resolveInheritedAsk, settleDenialLimitFallback } from "./denial-limit-arms.js";
 import { settleReadRootGrant } from "./read-root-grant.js";
+import { frozenApproverRoute } from "../wiring-manifest.js";
 import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
 import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-policy.js";
 import { policyThrowLine, reportPolicyThrow } from "./policy-throw.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, pathRuleAnchors, headLeads, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, personRowsBeyondRun, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, readFace, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, pathRuleAnchors, headLeads, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, readFace, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
     const arbitrateInherited = (ask, toolCallId, judged) => {
         const verdict = arbitrateByMode(permissionMode.current, judged.classification, { origin: judged.origin, ...askMandateMember(ancestorFacts(judged.ask.action === "ask" ? judged.ask : undefined)) });
@@ -124,7 +125,7 @@ export async function preparePolicyChain(input) {
                 rules: row,
             };
         };
-        sessionRulePolicy = createSessionRulePolicy({ seed, read: createLiveSessionRules(store, { ...sessionRuleKey, seed }, { onUnreadable: announceSessionRulesUnreadable, onEnforced: publishOwnRules }) }, { env: executionEnv, rootPath: taskRootFinal, toolEffects });
+        sessionRulePolicy = createSessionRulePolicy({ seed, read: createLiveSessionRules(store, { ...sessionRuleKey, seed }, { onUnreadable: announceSessionRulesUnreadable, onEnforced: publishOwnRules }) }, { env: executionEnv, rootPath: taskRootFinal, toolEffects, anchors: pathRuleAnchors.leg });
         if (rules)
             publishOwnRules(rules);
     }
@@ -145,7 +146,7 @@ export async function preparePolicyChain(input) {
             ...(deps.sessionPolicyStore
                 ? { read: createLiveSessionRules(deps.sessionPolicyStore, { sessionId: snap.sessionId, ...(snap.principal !== undefined ? { principal: snap.principal } : {}), seed }, { onUnreadable: announceSessionRulesUnreadable, onEnforced: publishAncestorRules }) }
                 : {}),
-        }, { env: executionEnv, rootPath: taskRootFinal, toolEffects }));
+        }, { env: executionEnv, rootPath: taskRootFinal, toolEffects, anchors: pathRuleAnchors.leg }));
     }
     const frozenConstraintLayers = (seedInheritedGate?.constraintChain ?? [])
         .filter((e) => !("opaque" in e))
@@ -321,10 +322,7 @@ export async function preparePolicyChain(input) {
     const listFacts = { root: taskRootFinal, sessionId, liveCwd: () => handsCwdRef?.current, anchors: pathRuleAnchors.leg };
     const skillGrantLane = skillGrants.lane(listFacts);
     const allowEntryLanes = { request: allowedToolTables.request.lane(listFacts), deployment: allowedToolTables.deployment.lane(listFacts) };
-    const ruleLaneConfig = {
-        provider: deps.permissionRuleStore,
-        localOwnerDeclared: deps.localOwnerRules === true,
-        principal: spec.principal,
+    const ruleLaneFacts = {
         sessionId,
         root: taskRootFinal,
         rootCanonical: pathRuleAnchors.leg.root,
@@ -338,8 +336,7 @@ export async function preparePolicyChain(input) {
         onDisclosure: (message) => emitTrace(deps.tracer, () => ({ kind: "permission.rule_store_unreadable", version: 1, taskId: hostTaskId, message, ts: Date.now() })),
         stripsAllow: (rule, req) => permissionMode.current === "auto" && autoStrippedRule(rule, req),
     };
-    const { personal: permissionRuleLane, org: permissionRuleOrgLane } = createPermissionRuleLanes({ ...ruleLaneConfig, rows: personRows });
-    const ruleLanesBeyondRun = createPermissionRuleLanes({ ...ruleLaneConfig, rows: personRowsBeyondRun });
+    const { personal: permissionRuleLane, org: permissionRuleOrgLane } = createPermissionRuleLanes({ provider: deps.permissionRuleStore, localOwnerDeclared: deps.localOwnerRules === true, principal: spec.principal, ...ruleLaneFacts, rows: personRows });
     const ruleOffersOf = createRuleOffersOf({
         laneArmed: permissionRuleLane !== undefined,
         principal: spec.principal,
@@ -386,7 +383,7 @@ export async function preparePolicyChain(input) {
             }
             if (re.updatedInput !== undefined)
                 editArgs = re.updatedInput;
-            const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
+            const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), route: frozenApproverRoute(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
             if (judged.kind === "allow") {
                 return onApproval(judged.result);
             }
@@ -461,7 +458,7 @@ export async function preparePolicyChain(input) {
                             return first;
                         return mandateUnreconstructibleDeny(creq);
                     }
-                    const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call", facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
+                    const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call", facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), route: frozenApproverRoute(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
                     if (judged.kind === "allow")
                         return judged.result;
                     if (judged.kind === "deny")
@@ -537,7 +534,7 @@ export async function preparePolicyChain(input) {
                     return mandateUnreconstructibleDeny(creq);
                 }
                 const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), approvalSeat: isLiveApproverSeat(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
+                const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), route: frozenApproverRoute(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
                 if (judged.kind === "allow")
                     return judged.result;
                 if (judged.kind === "deny")
@@ -679,7 +676,7 @@ export async function preparePolicyChain(input) {
             return decision;
         })
         : foldedPolicy;
-    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, ruleLanesBeyondRun, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
+    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, ruleLaneFacts, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
 }
 const advisedPolicyNames = new WeakMap();
 const ADVISED_KEYS_CAP = 64;