@sema-agent/core 7.51.1 → 7.52.0

package/dist/core/runner/contracts.d.ts

@@ -36,7 +36,9 @@ import type { CacheBreakDetector, ToolFingerprintInput } from "../cache-break-de
 import type { Checkpoint, CheckpointState, CheckpointStore, CheckpointToken, PendingSteerEntry, PlatformLimitReason, ReopenReason, ResourceLedger, ResourceLimitReason, ResumeOutcome, SerializedCheckpointState } from "../checkpoint-store.js";
 import type { ExecutionOutcomeRecordWord } from "../checkpoint-execution-record.js";
 import type { ClearedProjectionLedger, MicroCompactMachine, OccurrenceIndex } from "../context-edit.js";
-import type { HookInvocationIdentity, Hooks, OrgGateVerdict, PermissionDeniedPayload, PostToolBatchCall, PostToolBatchResult, ToolGateInput } from "../hooks.js";
+import type { ModBus } from "../mods/kernel/index.js";
+import type { LegModBus, LegMods, ModChainLink } from "../mods/stations.js";
+import type { HookInvocationIdentity, OrgGateVerdict, PermissionDeniedPayload, PostToolBatchCall, ToolGateInput } from "../hooks.js";
 import type { MaterializedMcp } from "../mcp.js";
 import type { MemoryEngine } from "../memory-engine/engine.js";
 import type { ResolvedSkillListingBudget } from "../skill-listing-budget.js";
@@ -62,6 +64,7 @@ import type { SessionReadFileStates } from "./session-read-file-states.js";
 import type { LegModeCeiling, SessionModeSeats } from "./session-mode-seats.js";
 import type { BlockedRef, OutputRef, SkillListingEntry } from "./synthetic-tools.js";
 import type { createAttachmentState, WriteFamily } from "./turn-attachments.js";
+import type { SideCallBook } from "./side-call-account.js";
 import type { cacheFamilyOf } from "./usage-accounting.js";
 /**
  * The frozen task-start copies of the caller's tool-face control arrays, as the config-doors phase takes them (synchronously,
@@ -99,6 +102,14 @@ export interface ToolFaceSnapshot {
  */
 export interface AnnounceOnceSink {
     onError: NonNullable<RunnerDeps["onError"]>;
+    /**
+     * The same operator sink for a fact about the DEPLOYMENT rather than the conversation (a built-in tool pair that
+     * declines to mount because of the deployment's own selector or roster): deduplicated per RUNNER by
+     * `(code, text)` instead of per session, because a serving layer that opens a fresh session per request would
+     * otherwise repeat a standing configuration fact on every request. Independent of the session record — it
+     * writes nothing to the transcript. Same signature as `RunnerDeps.onError`.
+     */
+    onErrorOncePerRunner: NonNullable<RunnerDeps["onError"]>;
 }
 /** Static per-tool irreversibility tier, resolved at prepare time by the safety scan. */
 export type IrreversibilityTier = Map<string, "never" | "maybe" | "always">;
@@ -524,6 +535,8 @@ export interface Prepared {
      * leg always knows its identity.
      */
     hookIdentity: HookInvocationIdentity;
+    /** The leg's mods bus: one per leg, admitted at this leg's prepare (both seats, `plugin.register` run once for this leg). Every classic station raises its event on it; its `records` are the manifest's `mods[]`. */
+    modBus: ModBus;
     /**
      * This session's DURABLE box, present iff this leg mounted the session-box drain (a top-level leg
      * over a cross-process-safe mailbox with a grammatical session id). The notification lane binds it
@@ -566,38 +579,18 @@ export interface Prepared {
     peerBoundaryRound?: (o: {
         continues: boolean;
     }) => Promise<void>;
-    /**
-     * The per-invocation TIME BOUND every hook seat of this leg runs under (`Hooks.timeoutMs`, already
-     * validated — a garbage value was refused to the default and disclosed ONCE, here, rather than on
-     * every tool call). Published for the same reason `hookIdentity` is: the seats live in two files, and
-     * a number each station re-derived would be two answers to one wiring question — including two
-     * chances to re-refuse the same bad value.
-     */
-    hookTimeoutMs: number;
+    /** The composition manifest (v3) the `prompt.assembled` frame reports (`trace.ts`, the same member types). */
     promptManifest: {
-        constitution: "core" | "replaced" | "provider-assembled";
+        identity: import("../trace.js").PromptManifestIdentity;
+        selectors: import("../trace.js").PromptManifestSelectors;
         blocks: Array<{
             id: string;
             chars: number;
             hash: string;
         }>;
-        /** Manifest v2 (stage S1, additive): the compiled-IR section view (slot/carrier/cadence/
-         *  cacheClass per section). `contentHash` is the
-         *  digest-tiering face: present ONLY on operator-declared sections (the typed
-         *  `stableBlocks` lane, owner "deployment") as an UNSALTED full sha256 of the section text —
-         *  the center-publish ↔ manifest end-to-end reconciliation anchor. Core-native sections (env
-         *  facts, memory tail, user role text) stay salted-only: a plain hash of a short guessable
-         *  block is a dictionary-preimage surface for trace readers ([E]). */
-        sections?: Array<{
-            id: string;
-            slot: string;
-            carrier: string;
-            cadence: string;
-            cacheClass: string;
-            chars: number;
-            hash: string;
-            contentHash?: string;
-        }>;
+        sections: import("../trace.js").PromptManifestSection[];
+        /** Each overlay the composition superseded; absent when none was. */
+        superseded?: import("../../prompt-assembly/overlay.js").SupersededOverlay[];
         /** S2 (additive): the mounted tools plane — contract identity, durable-replay aliases,
          *  presentation-invariant shape digest and full wire digest per tool (initial mount face). */
         tools?: ToolManifestRow[];
@@ -615,26 +608,18 @@ export interface Prepared {
          *  seat chose it. Absent when nothing is deferred (there is no disclosure to describe). */
         toolDisclosure?: ToolDisclosureManifest;
     };
-    /** This run's provider-declared prompt sections (epoch declaration axis),
-     *  threaded to every compaction-boundary epoch selection so boundary re-pins hash the same
-     *  artifact identity as the prepare-time pin. Empty on declaration-free runs. */
-    epochDeclaredSections: import("../../prompt-assembly/epoch.js").EpochDeclaredSections;
+    /** This run's prompt identity inputs and its pinned center layer's provenance, threaded to every compaction-boundary
+     *  epoch selection so a boundary restates the same identity the prepare-time record names. Replaced by a committed
+     *  compaction-boundary center change. */
+    promptIdentity: import("../../prompt-assembly/epoch.js").RunPromptIdentity;
     /** The LIVE nine-element identity face (refreshed by deferred materialization and
      *  the deferred-materialization adoption swap); the manifest holds the prepare-time initial copy. */
     turnSnapshot?: import("../../prompt-assembly/turn-snapshot.js").TurnPromptSnapshot;
-    /** The compaction-boundary center-adoption seam (undefined = no source
-     *  wired or session not center-pinned). Returns the maybeCompact `centerAdoption` fragment or
-     *  undefined; `apply` runs post-CAS only (auto-compaction owns the ordering). Both
-     *  `epochDeclaredSections` and `promptOverheadTokens` on THIS object are mutated by a successful
-     *  adoption (read them at call time, never capture early). */
-    centerCompactionCandidate?: () => {
-        centerArtifactDigest?: string;
-        sourceRevision?: string;
-        clear?: true;
-        declaredSections: import("../../prompt-assembly/epoch.js").EpochDeclaredSections;
-        overheadTokensAfter: number;
-        apply: (committedArtifactDigest?: string) => void;
-    } | undefined;
+    /** The compaction-boundary center-layer seam (undefined = no source wired, or a child run — a child composes its
+     *  parent's layer). Returns the maybeCompact `centerAdoption` fragment or undefined; `apply` runs post-CAS only
+     *  (auto-compaction owns the ordering). Both `promptIdentity` and `promptOverheadTokens` on THIS object are mutated by
+     *  a successful change (read them at call time, never capture early). */
+    centerCompactionCandidate?: () => NonNullable<import("../auto-compaction.js").MaybeCompactOptions["centerAdoption"]> | undefined;
     /** Deferred-tool disclosure: the monotonic set of activated deferred-tool names. Empty
      *  (and no `tool_search` injected) when nothing is deferred. Mutated by BOTH disclosure lanes across
      *  the run — the injected `tool_search` and the direct-call placeholder lane (default ON) —
@@ -924,6 +909,12 @@ export interface Prepared {
             walltimeMs: number;
         };
     };
+    /** The cell the run body binds with the leg's side-call door once `stats` exists; a lane built at prepare (the
+     *  permission classifier) books its replies through it. A lane that books before the run body bound it is an
+     *  engine defect and throws. */
+    sideCallBookRef: {
+        book?: SideCallBook;
+    };
     /** The per-task human-review accumulator (synchronous `resolveAsk` waits this leg + the carried
      *  prior-leg burden seeded from the resumed checkpoint). The run loop ADDS the durable-resume latency
      *  (`now() − cp.suspendedAt`) on a resume, then surfaces it as `stats.humanReview` at assembly (omitted when
@@ -1323,6 +1314,9 @@ export interface PrepareResume {
     /** The decision this resume carries (the gate word and, for a review, approve / edit / reject) — read by the mode seed
      *  (`modeRequestAfterResume`: an approved or edited `plan_review` exits a recorded plan to its pre-plan word). Absent on a prepare that resumes nothing. */
     outcome?: ResumeRun["outcome"];
+    /** The leg's mods bus, when the resume entrance already admitted it (a wake message's screen raises
+     *  `classic.UserPromptSubmit` before this leg prepares): prepare adopts it instead of admitting a second time. */
+    legMods?: LegMods;
     /** How many times this task already suspended (the resumed checkpoint's
      *  `suspendCount`). The next suspend mints `priorSuspendCount + 1`; past `maxSuspends` it fails
      *  (`suspend.loop`) instead of re-suspending. Absent/0 ⇒ no prior suspends. */
@@ -1544,24 +1538,23 @@ export interface InheritedGate extends InheritedAutoModeFace {
             };
         };
         /**
-         * Set ONLY on an entry whose `policy` is the folded form of an ancestor's PreToolUse screening face
-         * (issue #33 — the face used to stop at the task that installed it, so a call the ancestor had
-         * refused executed one level down). It carries the raw callback for ONE purpose: identity. A
-         * deployment-level face (`RunnerDeps.hooks`) is resolved by every task in the tree on its own, so
-         * each descendant's gate already runs it in phase 1 — folding it AGAIN as an inherited constraint
-         * would consult the same callback twice per call at depth 1 and once more per level below. Two
-         * identity tests keep that at exactly one consultation per call: chain assembly does not re-append a
-         * face already on the chain, and a descendant substitutes a pass-through for the entry naming the
-         * very callback its own gate will run. A per-task face (`TaskSpec.hooks`) is a different function in
-         * the descendant (or absent), so it folds and travels.
+         * Set by the constraint mint's caller on an entry whose `policy` is the folded form of an ancestor's
+         * `classic.PreToolUse` chain (`createPreToolUseConstraintPolicy`): the chain that leg's admission MOUNTED, as the
+         * entry declares it. It is read for ONE thing — a declaration that this entry carries a chain: beside a policy the
+         * mint did not make, a declared judging `tool.check` handler is refused (`config.mods_invalid`; the guard has no bus to
+         * be raised on), and such an entry is never treated as a caller policy (it licenses no ask grant). It is NEVER the
+         * entry's identity: the chain an entry stands for is read off the bus its policy was minted over (that bus's admission
+         * recorded it), so a host may hand any list here (`[]` included, or none) without moving what is judged.
          *
-         * Identity is the only sound test here, and it is deliberately the CONSERVATIVE one: an assembly that
-         * hands each task a freshly bound wrapper over one underlying callback (the `runSpec` mux does this)
-         * produces two distinct function objects, so the descendant both folds the ancestor's entry and runs
-         * its own — the callback is consulted twice rather than skipped. Erring toward a second screening,
-         * never toward a missed one, is what makes an identity miss a cost rather than a hole.
+         * The identity (`sameInstallation`) is that chain plus the context the entry's questions are settled in — the frozen
+         * approver, the two durable mandates, the environment, the classifier instance — and it is the CONSERVATIVE test:
+         * two chains over the same registrations in a different order, or a re-built registration object, compare unequal,
+         * and a bus no engine admission mounted is no leg's installation. Chain assembly does not re-append a leg already on
+         * the chain; a descendant's own gate stands in for an entry only when that identity holds under no mandate (the
+         * pass-through of its `classic.PreToolUse`, the skip of its `tool.check`); any other entry is judged on both events
+         * under its own context — judged twice rather than skipped, never toward a missed one.
          */
-        preToolUse?: Hooks["preToolUse"];
+        mods?: readonly ModChainLink[];
         /**
          * The environment this screening face was installed against — the source of the `HookEnvCapabilities`
          * handed to it, compared BY REFERENCE, `undefined` when the installation had no env face. Part of the
@@ -1646,14 +1639,21 @@ export interface RunInternals {
      */
     toolCeiling?: readonly import("../tool-face.js").ToolSelectorLayer[];
     /** Set by the delegation lane when the spawning run's prepare judged this leg's own tool lists (its spec's `allowTools` /
-     *  `excludeTools` — a definition's or the delegation tool's) where they were mounted: their digest (`toolListsDigest`), the evidence
-     *  bound to exactly those lists. A prepare whose own lists digest to it does not judge them again against its own, narrower universe,
-     *  and its rows record it (`CheckpointState.toolListsJudged`) so a resume that hands no internals keeps the judgment. Absent (a
-     *  workflow agent, a team member, a host's direct `runTask`), or lists that digest differently ⇒ the leg judges its own lists. */
+     *  `excludeTools` — a definition's or the delegation tool's) against a pool it could list: their digest (`toolListsDigest`), the
+     *  evidence bound to exactly those lists. A prepare whose own lists digest to it does not judge them again, and its rows record it
+     *  (`CheckpointState.toolListsJudged`) so a resume that hands no internals keeps the judgment. Absent (a delegation tool whose pool
+     *  cannot be listed, a workflow agent, a team member, a host's direct `runTask`), or lists that digest differently ⇒ the leg judges its own lists. */
     toolListsJudged?: string;
-    /** Set by the delegation lane: whose lists this leg's own are (`delegationListWhere` — the agent definition it was spawned as, or the
-     *  delegation tool's tool-level list), so a refusal at the leg's prepare names the list to fix. Absent ⇒ the leg's own `TaskSpec` seats. */
-    ownToolListsWhere?: string;
+    /** Set by the delegation lane: whose lists this leg's own are — the delegation tool that spawned it (its declared name, its mounted one), the
+     *  agent definition it was spawned as (absent ⇒ the tool's tool-level list) and `lists`, the digest of exactly the lists it wrote. A refusal
+     *  at the leg's prepare names that list (`delegationListWhere`), and the tool's name is a name of this leg's lineage: its own lists are
+     *  asked of a universe that carries it. Held only for the lists it wrote ({@link boundOwnToolLists}): other lists are the host's own
+     *  `TaskSpec` seats. Absent ⇒ no delegation tool behind the leg's own `TaskSpec` seats. */
+    ownToolLists?: {
+        readonly toolName: string;
+        readonly definition?: string;
+        readonly lists: string;
+    };
     /** Set only on an observer sidecar's legs: the leg kind whose protocol is the observer's report tool. */
     observerLeg?: true;
     /** The live repair bundle from a `runRepairLoop` attempt in flight (attemptCount>0). Serialized onto a
@@ -2647,6 +2647,8 @@ export interface ResumeRun {
      *  §4.3-3 reserves for the cross-process parked leg). Present only when a wake message passed a
      *  screen that supplied context. */
     wakeMessageHookContext?: string;
+    /** The resumed leg's bus when the wake-message screen admitted it before the claim — prepare adopts it. */
+    legMods?: LegMods;
     /** Compensation hook: called iff the resumed run fails with `resume.env_failed` (post-CAS
      *  workspace `resumeVM` failed) OR `resume.tool_unavailable` (P-7: the approved tool vanished) — in both
      *  the CAS already consumed the checkpoint but the pending action never ran. `resumeStream` supplies a
@@ -2695,11 +2697,12 @@ export interface SuspendReap {
 export interface TurnBoundaryDeps {
     spec: TaskSpec;
     queue: PushQueue<TaskEvent>;
-    /** The run loop's own latch — read for `userHalted` (the public `TaskStream.halt()` verb, which sets
-     *  the harness stop latch directly, not through the ctx primitive `Prepared.stopRequestedRef`
-     *  mirrors): a halted boundary has no next request either, so the bundle is not collected there. */
+    /** The run loop's own latch — read for `userHalted` (the `TaskStream.halt()` verb sets the harness stop latch directly,
+     *  not through the ctx primitive `Prepared.stopRequestedRef` mirrors: a halted boundary has no next request either, so
+     *  the bundle is not collected there) and for `callerStop`, the gate the boundary's compaction pass admits on and carries. */
     loopLatch: {
         readonly userHalted: boolean;
+        readonly callerStop: import("./caller-stop-gate.js").CallerStopGate;
     };
     manualCompactRef: {
         requested: boolean;
@@ -2722,9 +2725,8 @@ export interface TurnBoundaryDeps {
         parentToolCallId?: string;
         sourceTaskId?: string;
     };
-    postToolBatchHook: ((batch: PostToolBatchCall[], meta?: {
-        injectedThisTurn: "final_verification" | "finalize";
-    }, ctx?: import("../hooks.js").PostToolBatchContext) => PostToolBatchResult | undefined | Promise<PostToolBatchResult | undefined>) | undefined;
+    /** Whether a handler hangs on `classic.PostToolBatch` (the batch is collected only then). */
+    postToolBatchArmed: boolean;
     batchArgs: Map<string, unknown> | undefined;
     compactionBrain: Brain;
     withinTaskCompaction: () => boolean;
@@ -2784,9 +2786,8 @@ export interface HarnessHandlersDeps {
     toolProgress: ToolProgressLane;
     writeFamilyOf: (name: string) => WriteFamily | undefined;
     toolLabels: Map<string, string>;
-    postToolBatchHook: ((batch: PostToolBatchCall[], meta?: {
-        injectedThisTurn: "final_verification" | "finalize";
-    }, ctx?: import("../hooks.js").PostToolBatchContext) => PostToolBatchResult | undefined | Promise<PostToolBatchResult | undefined>) | undefined;
+    /** Whether a handler hangs on `classic.PostToolBatch` (the batch is collected only then). */
+    postToolBatchArmed: boolean;
     batchArgs: Map<string, unknown> | undefined;
     runnerHooks: {
         onError: RunnerDeps["onError"];
@@ -2841,10 +2842,9 @@ export interface RunnerSelfSeat {
      *  against the catalog in force): prepare hands its leg a call-time reader over it, because this is the one seat a
      *  running leg re-reads (geometry, not route — see `context-settings.ts`). */
     contextOverlayOf?(ref: import("../model-seat.js").ModelRef | undefined): import("../context-settings.js").ContextWindowOverlay | undefined;
-    /** The deployment-level gating baseline (deps toolPolicy / hooks) as delegate wrappers — for assemblers that compose with it. */
+    /** The deployment-level gating baseline (deps toolPolicy) as a delegate wrapper — for assemblers that compose with it. */
     readonly gateBaseline: {
         toolPolicy?: RunnerDeps["toolPolicy"];
-        hooks?: RunnerDeps["hooks"];
     };
     /** Whether a child task THIS runner runs can be placed in a tree other than the caller's (an explicit cwd, a worktree):
      *  true only when its deps carry an `executionEnvFactory` (live read — `swapDeps` replaces the deps). The delegation tool asks
@@ -2883,10 +2883,10 @@ export type PrepareTaskFn = (spec: TaskSpec, deps: RunnerDeps, sessions: Session
  */
 export interface InstallingPhaseResult {
 }
-/** The live-task handle `runLocked` publishes once the harness exists: the harness + abort
- *  controller, the loop-liveness latch (`ended` flips when the single `harness.prompt` settles; `userInterrupted`
- *  / `userHalted` are the interrupt and halt verbs' attribution seats), the run's reminder mark, its session and
- *  engine-minted run id, and the hook bound + identity envelope the steer entrance screen runs under. */
+/** The live-task handle `runLocked` publishes once the harness exists: the harness + abort controller, the loop latch
+ *  (`ended` flips when the single `harness.prompt` settles; `userInterrupted` / `userHalted` are the interrupt and halt
+ *  verbs' attribution seats; `callerStop` is the run's caller-stop gate the three stop verbs trip), the run's reminder
+ *  mark, its session and engine-minted run id, and the bus + identity envelope the steer entrance screen runs on. */
 export interface LiveHandle {
     harness: AgentHarness;
     abortController: AbortController;
@@ -2894,13 +2894,15 @@ export interface LiveHandle {
         ended: boolean;
         userInterrupted: boolean;
         userHalted: boolean;
+        callerStop: import("./caller-stop-gate.js").CallerStopGate;
     };
     reminderMark: string;
     sessionId: string;
     /** The run body's engine-minted run id, so the stream-layer verbs can name the run their disclosures are about. */
     runId: string;
-    hookTimeoutMs: number;
     hookIdentity: HookInvocationIdentity;
+    /** The leg's mods bus (the steer entrance raises `classic.UserPromptSubmit` on it). */
+    modBus: LegModBus;
     /** The leg's live permission-mode seat (`TaskStream.setPermissionMode` steers it). */
     permissionMode: PermissionModeController;
 }

package/dist/core/runner/credential-origin-seat.d.ts

@@ -0,0 +1,2 @@
+import type { NoticeSeatInput } from "./notice-seat-input.js";
+export declare function createCredentialOriginRefusalScope({ onNotice, sessionId, runId }: NoticeSeatInput): <T>(fn: () => Promise<T>) => Promise<T>;

package/dist/core/runner/credential-origin-seat.js

@@ -0,0 +1,19 @@
+import { runWithCredentialOriginRefusals } from "../../brain/status-sink.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+export function createCredentialOriginRefusalScope({ onNotice, sessionId, runId }) {
+    const announced = new Set();
+    return (fn) => runWithCredentialOriginRefusals(({ modelId, boundOrigin, requestOrigin }) => {
+        const key = `${modelId}\u0000${boundOrigin}\u0000${requestOrigin}`;
+        if (announced.has(key))
+            return;
+        announced.add(key);
+        deliverEngineNotice(onNotice, {
+            code: "route.credential_origin_mismatch",
+            message: `A request for model "${modelId}" was not sent: the model's own credential belongs to ${boundOrigin}, the host it was ` +
+                `first sent to, and this request was going to ${requestOrigin}. A credential does not follow its model to another host — ` +
+                `the deployment has to give the model a credential for ${requestOrigin} (or point it back at ${boundOrigin}). ` +
+                `Said once per run for this model and these two hosts.`,
+            detail: { modelId, boundOrigin, requestOrigin, sessionId, runId },
+        });
+    }, fn);
+}

package/dist/core/runner/extra-body-dropped-seat.d.ts

@@ -1,8 +1,4 @@
-import type { EngineNotice } from "../engine-notice.js";
+import type { NoticeSeatInput } from "./notice-seat-input.js";
 /** Where the announcement goes and whom it is attributed to — the same triple as the sibling `route.*` seats. */
-export interface ExtraBodyDroppedSeatInput {
-    onNotice: ((notice: EngineNotice) => void) | undefined;
-    sessionId: string;
-    runId: string;
-}
+export type ExtraBodyDroppedSeatInput = NoticeSeatInput;
 export declare function createExtraBodyDroppedScope({ onNotice, sessionId, runId }: ExtraBodyDroppedSeatInput): <T>(fn: () => Promise<T>) => Promise<T>;

package/dist/core/runner/gate-exit.d.ts

@@ -26,7 +26,7 @@ import type { AutoModeClassifierRound } from "../auto-mode.js";
 import { type Arbitration, type AskClassification, type AskFace, type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import type { SafeNotifier } from "../safe-notify.js";
-import type { HookSeatOutcome, PermissionDeniedPayload, PreToolUseResult, ToolGateInput, ToolGateResult } from "../hooks.js";
+import type { PermissionDeniedPayload, PreToolUseResult, ToolGateInput, ToolGateResult } from "../hooks.js";
 /** The ask a gate pass settled, as the gate captured it at its resolution site: the settlement the
  *  resolver composed and the origin word the ask carried. Both or neither (invariant I1). `licensed` is the engine record's
  *  digest of the bytes the settlement licensed: the allow exit keeps a settlement only for the bytes that run. */
@@ -126,32 +126,31 @@ export declare function cloneObserverInput(input: unknown): unknown;
  * freeze the call's input under the tool.
  */
 export declare function frozenInputSnapshot(input: unknown): unknown;
+/** What one `classic.PreToolUse` screening came to: an answer the receipt took (`undefined` = no opinion), or the
+ *  engine's fail-closed refusal of the call with its sentence (a handler that failed or broke the site's contract,
+ *  or a cancel). */
+/** A screen's outcome; an answer names the registration whose answer the chain returned (`answeredBy`, absent when no
+ *  handler spoke). */
+export type PreToolUseScreen = {
+    readonly kind: "answered";
+    readonly answer: PreToolUseResult | undefined;
+    readonly answeredBy?: string;
+} | {
+    readonly kind: "refused";
+    readonly reason: string;
+};
 /**
- * The PreToolUse screening face as the gate's stations see it — the hook machinery of `runToolGate` (the seat
- * runner, the per-call seat bound, the fresh per-screening context, the result screen, the two fail-closed
- * reason texts) behind three methods, so the approved-edit re-screen in the lanes runs the SAME screening the
- * phase-1 pass ran without the lanes module reaching into the hook machinery. Present on the pass exactly when
- * a `preToolUse` face is wired.
+ * The PreToolUse screening face as the gate's stations see it — `classic.PreToolUse` raised on the leg's bus, the
+ * per-screening e, the answer receipt and the fail-closed sentences behind one method, so the approved-edit re-screen
+ * in the lanes runs the SAME screening the phase-1 pass ran. Present on the pass exactly when a handler hangs on the
+ * event (an observe handler runs inside the screening too; it never decides).
  */
 export interface PreToolUseScreening {
-    /** Run the deployment's PreToolUse face over `args` under the seat bound. The answer is the SEAT's, unscreened —
-     *  the caller passes it through {@link PreToolUseScreening.screened} in the seat's own continuation. The seat
-     *  promise is returned as is (no wrapping `async`): what the gate does after the face answers — the policy in
-     *  phase 1, the re-check in the edit chain — runs on the tick the seat settles, as it did when this call was the
-     *  seat runner's own; a wrapper that screened the answer inside a second `async` cost one more tick there. An
-     *  expired seat is reported, not thrown; a crashing face rejects. */
-    screen(args: unknown): Promise<HookSeatOutcome<PreToolUseResult | undefined>>;
-    /** The result screen over an answered seat's value: an out-of-contract decision becomes the ordinary hook deny. */
-    screened(answer: PreToolUseResult | undefined): PreToolUseResult | undefined;
-    /** The model-facing text for a face that THREW while screening `subject`. */
-    crashReason(subject: string, err: unknown): string;
-    /** The model-facing text for a face that never ANSWERED while screening `subject` (the timeout arm also
-     *  reports on the deployment lane; a task-abort expiry does not). */
-    unansweredReason(subject: string, cause: "timeout" | "aborted"): Promise<string>;
-    /** The model-facing text for the face's OWN deny of this call (unwrapped; every exit wraps it with the leg's mark). */
+    /** Raise `classic.PreToolUse` over `args`; `subject` names what is screened in a fail-closed sentence. What the gate
+     *  does after the screen answers runs in the screen's own continuation. */
+    screen(args: unknown, subject: string): Promise<PreToolUseScreen>;
+    /** The model-facing text for the screen's OWN deny of this call (unwrapped; every exit wraps it with the leg's mark). */
     deniedReason(answer: PreToolUseResult): string;
-    /** The model-facing text for an answer the decision receipt refused (an ENGINE fail-closed, not the face's deny). */
-    refusedReason(answer: PreToolUseResult): string;
 }
 /** The FACE a pass's questions are put on ({@link askFaceOf} of the call's wire name) — the one reading of it the
  *  write-protection tighten (the fold) and every class derivation (the lanes) make. */
@@ -198,9 +197,9 @@ export interface GatePass {
     readonly ledger: SettlementLedger;
     /** borrowed-readonly — the ONE emission seat of the deny observer for this pass, bounded and contained like
      *  every other seat (the hook machinery owns the seat runner; the exits call this). */
-    readonly notifyPermissionDenied: (payload: Omit<PermissionDeniedPayload, "signal">) => Promise<void>;
-    /** borrowed-readonly — the PreToolUse screening face ({@link PreToolUseScreening}), or undefined when no
-     *  `preToolUse` face is wired (the edit chain then re-screens nothing, as before). */
+    readonly notifyPermissionDenied: (payload: PermissionDeniedPayload) => Promise<void>;
+    /** borrowed-readonly — the PreToolUse screening face ({@link PreToolUseScreening}), or undefined when no handler hangs
+     *  on `classic.PreToolUse` (the edit chain then re-screens nothing). */
     readonly screening: PreToolUseScreening | undefined;
     /** borrowed-readonly — the station group that runs AFTER the fold (the lanes: org layer, rule lane, classifier,
      *  parks, resolution, edit chain, and the exit they end in), handed the pass by the fold's LAST station on the
@@ -212,14 +211,14 @@ export interface GatePass {
      *  behind the policy's answer could not land in between. Returns the gate result (a park's suspension or the
      *  exit's record). Writer: the dispatch (`runToolGate`, which wires `runGateLanes`). Reader: the fold's tail. */
     readonly afterFold: (pass: GatePass) => Promise<ToolGateResult>;
-    /** borrowed-mutable — the FINAL args: the model's input, rewritten by the phase-1 hook, by the policy
-     *  rewrite on the ask path, by the content-ask lane's presented snapshot and by the exits' rewrite fold.
+    /** borrowed-mutable — the FINAL args, always the pass's own immutable value (`ownArgs`): the model's input as taken at
+     *  the entry, rewritten by the phase-1 hook, by the policy rewrite on the ask path and by the exits' rewrite fold.
      *  Writers: the dispatch (phase 1), the lanes, the exits. */
     currentInput: unknown;
-    /** borrowed-mutable — the adjudication request. Minted over the model's input so the record is whole from
+    /** borrowed-mutable — the adjudication request. Minted over the pass's args so the record is whole from
      *  the first station, and RE-MINTED by the adjudication station over the FINAL post-screen args (the
-     *  pre-existing `const req` site); `args` is re-pointed at the policy rewrite on the ask path and at the
-     *  content-ask lane's presented snapshot. Writers: the fold (mint), the lanes (`args`). */
+     *  pre-existing `const req` site); `args` is re-pointed at the policy rewrite on the ask path. Writers: the
+     *  fold (mint), the lanes (`args`). */
     req: ToolCallRequest;
     /** borrowed-mutable — the PreToolUse `additionalContext` collected for this call (pushed into; the binding
      *  is fixed). Writers: the dispatch (phase 1), the lanes (sandbox admission note, the edit re-screen). */
@@ -231,10 +230,14 @@ export interface GatePass {
     hookAsk: Extract<PermissionResult, {
         action: "ask";
     }> | undefined;
-    /** borrowed-mutable — the phase-1 hook answered its own `allow` (the exact word): the allow layer's hook member, which
-     *  speaks only while no policy rewrote the arguments after the hook saw them. Writer: the dispatch (phase 1). Reader: the
-     *  lanes' allow layer (its one reader). */
-    hookAllowed?: true;
+    /** borrowed-mutable — the phase-1 screen answered its own `allow` (the exact word), naming the registration that answered
+     *  it: the allow layer's hook member (its `entries`), which speaks only while no policy rewrote the arguments after the
+     *  screen saw them. Writer: the dispatch (phase 1). Reader: the lanes' allow layer (its one reader). */
+    hookAllowedBy?: readonly string[];
+    /** borrowed-mutable — `tool.check` was raised in this pass's first adjudication, which raises it once: set by the
+     *  raise in front of the ask branch, read by the raise behind the read-only arm (it then raises nothing). Writer and
+     *  reader: the lanes. */
+    toolCheckRaised?: true;
     /** borrowed-mutable — set by a park attempt that FAILED (see `ParkAttemptFailed`). Read at the single deny
      *  exit — whatever the fallback chain then decides to say, it says it knowing the park was tried first.
      *  Writers: the three park sites. */
@@ -335,8 +338,16 @@ export interface GatePass {
  * deployment's only evidence of a broken hook is a tool that mysteriously stops working.
  */
 export declare function engineFailClosedExit(pass: GatePass, reason: string): Promise<ToolGateResult>;
+/** The refusal sentence for args the gate could not take into its own copy (`ownArgs` refused them), naming what. */
+export declare const unownedArgsMessage: (subject: string, reason: string) => string;
+/**
+ * The model's args could not be taken into the pass's own copy (a function, a shared buffer, a typed array): nobody judged
+ * them, so nothing may run them. The single deny exit (the observer fires), in the policy layer's word — the value is the
+ * deployment's own (a host driving the gate; the runner's calls are always clonable).
+ */
+export declare function unownedArgsExit(pass: GatePass, reason: string): Promise<ToolGateResult>;
 /** The hook's OWN deny in phase 1. A PreToolUse hook deny does NOT fire `permissionDenied`
- *  (the exclusion recorded on `Hooks.permissionDenied`) — this return stays observer-free. */
+ *  (the exclusion recorded on `PermissionDeniedPayload`) — this return stays observer-free. */
 export declare function hookDenyExit(pass: GatePass, deniedReason: string): ToolGateResult;
 /**
  * The exit of the adjudicate chain — the pass has a standing `deny` or `allow` (every ask was resolved or

package/dist/core/runner/gate-exit.js

@@ -190,6 +190,12 @@ export async function engineFailClosedExit(pass, reason) {
     await notifyPermissionDenied({ toolName, input: cloneObserverInput(finalInput), toolCallId, reason, gate, ...(input.identity !== undefined ? { identity: input.identity } : {}) });
     return { block: true, reason: formatHookFeedback(reason, input.reminderMark), gate, finalInput, preToolContext: pass.preToolContext };
 }
+export const unownedArgsMessage = (subject, reason) => `${subject} could not be taken into the gate's own copy (${reason}) — denied fail-closed`;
+export async function unownedArgsExit(pass, reason) {
+    pass.decision = { action: "deny", message: unownedArgsMessage(`the arguments of "${pass.toolName}"`, reason) };
+    pass.deniedBy = "policy";
+    return await exitGate(pass);
+}
 export function hookDenyExit(pass, deniedReason) {
     const { input } = pass;
     return {
@@ -211,7 +217,7 @@ function unresolvableCauseOfSettlement(gate) {
     return undefined;
 }
 export async function exitGate(pass) {
-    const { input, event, toolName, toolCallId, ledger, notifyPermissionDenied } = pass;
+    const { input, toolName, toolCallId, ledger, notifyPermissionDenied } = pass;
     if (pass.decision.action === "deny") {
         if (pass.decision.updatedInput !== undefined) {
             pass.currentInput = pass.decision.updatedInput;
@@ -265,7 +271,7 @@ export async function exitGate(pass) {
     const release = pass.arbitration?.kind === "released" ? pass.arbitration : (() => { if (ledger.settled !== undefined)
         return undefined; const a = pass.arbitration === undefined ? input.ancestorArbitrationOf?.(toolCallId) : undefined; return a?.kind === "released" ? a : undefined; })();
     return {
-        updatedInput: pass.currentInput === event.input ? undefined : pass.currentInput,
+        updatedInput: pass.currentInput,
         gate: mintGateOutcome({ ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}), ...(release !== undefined ? { released: releaseRecordOf(release) } : {}) }),
         finalInput: frozenInputSnapshot(pass.currentInput),
         preToolContext: pass.preToolContext,

package/dist/core/runner/image.js

@@ -1,6 +1,5 @@
 import { isIP } from "node:net";
-import { imageMagicMatches } from "../../tools/fs/safety.js";
-import { ADMITTED_IMAGE_MIME_TYPES } from "../../tools/fs/image-admission.js";
+import { ADMITTED_IMAGE_MIME_TYPES, imageMagicMatches } from "../image-admission.js";
 import { admitInlineImage } from "./inline-image.js";
 function sniffImageMime(bytes) {
     return ADMITTED_IMAGE_MIME_TYPES.find((mime) => imageMagicMatches(bytes, mime));

package/dist/core/runner/inline-image.js

@@ -1,4 +1,4 @@
-import { admitImageBytes, ADMITTED_IMAGE_MIME_TYPES } from "../../tools/fs/image-admission.js";
+import { admitImageBytes, ADMITTED_IMAGE_MIME_TYPES } from "../image-admission.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../image-downsample.js";
 function inlineImageRefusal(detail) {
     const e = new Error(`TaskSpec.images: ${detail}`);

package/dist/core/runner/notice-seat-input.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The input a once-per-run NOTICE SEAT takes: the run's notice sink and the two ids a notice is attributed to. One shape, defined
+ * once, below every seat that takes it (the extra-body strip account, the per-model credential-origin refusal account) — a seat
+ * importing a sibling seat's type was a sideways edge on a stratum that allows none.
+ */
+import type { EngineNotice } from "../engine-notice.js";
+export interface NoticeSeatInput {
+    onNotice: ((notice: EngineNotice) => void) | undefined;
+    sessionId: string;
+    runId: string;
+}

package/dist/core/runner/notice-seat-input.js

@@ -0,0 +1 @@
+export {};

package/dist/core/runner/person-path-rows.js

@@ -258,6 +258,7 @@ export function createPersonPathRows(cfg) {
                 matchPath: (path, opts) => judging().readDeny.matchPath(path, opts),
                 matchTarget: (canonicalKey, lexicalView, opts) => judging().readDeny.matchTarget(canonicalKey, lexicalView, opts),
                 unexcludableUnder: (scope) => judging().readDeny.unexcludableUnder?.(scope) ?? false,
+                rowUnderRoot: (scope) => judging().readDeny.rowUnderRoot?.(scope) ?? null,
                 rowAtOrBelow: (path) => judging().readDeny.rowAtOrBelow?.(path) ?? null,
                 forCall: (id) => tablesFor(id).readDeny,
             });

package/dist/core/runner/prepare-acquire-reconcile.js

@@ -1,4 +1,6 @@
 import { StoredSession, isSessionConflict } from "../session.js";
+import { SessionError } from "../../internal/harness.js";
+import { readMember } from "../thrown-value.js";
 import { userAttachmentOf } from "../../internal/llm.js";
 import { lastAttachmentFrameOf } from "../user-attachment.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
@@ -33,7 +35,9 @@ export async function prepareAcquireReconcile(input) {
         }
         try {
             if (resume) {
-                await session.getStorage().setLeafId(resume.leafId);
+                await session.getStorage().setLeafId(resume.leafId).catch((cut) => {
+                    throw readMember(cut, "code") === "not_found" ? new SessionError("invalid_session", `session "${spec.sessionId}" no longer holds the entry its checkpoint was cut at ("${resume.leafId}")`, cut) : cut;
+                });
             }
             else if (spec.resumeAt !== undefined) {
                 const entry = await session.getEntry(spec.resumeAt);

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -2,7 +2,7 @@ import type { CallTargetStamp } from "../effective-path-target.js";
 import type { AgentTool } from "../../internal/harness.js";
 import type { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import type { AutoModeDenialTracker } from "../auto-mode.js";
-import { type Hooks } from "../hooks.js";
+import { type LegModBus } from "../mods/stations.js";
 import { type OnAsk, type ToolCallRequest, type ToolPolicy } from "../tool-policy.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
@@ -89,12 +89,10 @@ export interface PrepareAskLaneInput {
     sessionId: string;
     /** borrowed-readonly — the run's invocation id (the observer's tag). */
     runId: string;
-    /** borrowed-readonly — the resolved hook record; only `permissionDenied` is read (the deny observer's seat). */
-    hooks: Hooks | undefined;
-    /** borrowed-readonly — the validated per-prepare hook seat bound (the deny observer's timeout). */
-    hookTimeoutMs: number;
-    /** borrowed-readonly — the own hook-failure lane (`onError`, phase `hook`, swallow-guarded): the deny observer's report sink,
-     *  the gate's crashing-PreToolUse sink and the adjudicate seat's report of a policy chain that threw. */
+    /** borrowed-readonly — the leg's mods bus (the deny observer raises `classic.PermissionDenied` on it). */
+    modBus: LegModBus;
+    /** borrowed-readonly — the leg's own failure lane (`onError`, phase `hook`, swallow-guarded): the adjudicate seat's report
+     *  of a policy chain that threw. */
     notifyOwnHookCrash: (err: unknown) => void;
     /** borrowed-readonly — the hands phase's in-flight read-root widening (an approver's accepted `readRootGrant`), or undefined (hands-less). */
     grantReadRoot: GrantReadRoot | undefined;