@sema-agent/core 7.51.1 → 7.52.0

package/dist/core/runner/prepare-ask-lane.js

@@ -1,6 +1,6 @@
 import { cardDisclosureOf } from "../allow-entry.js";
 import { primaryActivityArg } from "../arg-summary.js";
-import { hookSeatExpiredError, runHookSeat } from "../hooks.js";
+import { classicEventBase, observeClassic } from "../mods/stations.js";
 import { advertisedWritableRootsSeat, exemptRootsSeat, attest, attestationOf, isLiveApproverSeat, resolveAsk } from "../tool-policy.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { composeCallSignal, raceSettlementAgainstSignal } from "./abort-race.js";
@@ -10,19 +10,10 @@ import { approvalCardMemberOf } from "../tool-roster.js";
 import { gateAskCarry, lateAskSettlementObserver } from "./denial-limit-arms.js";
 import { consumeInheritedAskGrant } from "./inherited-ask-grants.js";
 import { settleReadRootGrant } from "./read-root-grant.js";
-function createDenyObserverNotifier(hooks, hookTimeoutMs, signal, report) {
-    if (hooks?.permissionDenied === undefined)
+function createDenyObserverNotifier(bus, signal) {
+    if (bus === undefined || !bus.hasHandlers("classic.PermissionDenied"))
         return undefined;
-    return async (payload) => {
-        try {
-            const seat = await runHookSeat("permissionDenied", { timeoutMs: hookTimeoutMs, signal }, (sig) => hooks.permissionDenied({ ...payload, signal: sig }));
-            if (seat.expired)
-                report(hookSeatExpiredError("permissionDenied", hookTimeoutMs, seat.cause, "the deny observation was abandoned; the deny itself is unchanged"));
-        }
-        catch (err) {
-            report(err);
-        }
-    };
+    return (payload) => observeClassic(bus, "classic.PermissionDenied", { ...payload, ...classicEventBase(payload.identity, payload.permissionMode) }, signal);
 }
 const sanitizePreview = (node, depth = 0) => {
     if (depth > 6)
@@ -61,7 +52,7 @@ function resolveApprovalPreview(tools, toolName, args) {
     }
 }
 export function prepareAskLane(input) {
-    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, handsRoot, stampCallTarget, advertisedWritableDirs, exemptRoots, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot } = input;
+    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, handsRoot, stampCallTarget, advertisedWritableDirs, exemptRoots, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, grantReadRoot, modBus, notifyOwnHookCrash } = input;
     if (!gateMachineryActive)
         return { askLane: undefined };
     const composedCallSignal = (callSignal) => composeCallSignal(abortController.signal, callSignal);
@@ -142,6 +133,6 @@ export function prepareAskLane(input) {
         }
         return resolved;
     };
-    const notifyPermissionDenied = createDenyObserverNotifier(hooks, hookTimeoutMs, abortController.signal, notifyOwnHookCrash);
+    const notifyPermissionDenied = createDenyObserverNotifier(modBus, abortController.signal);
     return { askLane: { composedCallSignal, adjudicate, approvalPreviewOf, resolveAskBound, notifyPermissionDenied, notifyHookError: notifyOwnHookCrash } };
 }

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -21,7 +21,7 @@
 import type { AgentHarness, AgentTool, ThinkingLevel } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
 import { forkGovernanceDenial } from "../../agents/subagent.js";
-import type { PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
+import type { PromptArtifact } from "../../prompt-assembly/artifact.js";
 import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import { type PermissionModeController } from "../mode-policy.js";
@@ -131,6 +131,8 @@ export interface PrepareCapsAndWorkflowInput {
     peerLaneActive: boolean;
     /** borrowed-readonly — the leg's effective delegation fact (`effectiveDelegationFacts`): the classifier window shows its user lane as the launching agent's. */
     delegated: boolean;
+    /** borrowed-mutable — `Prepared.sideCallBookRef`: written by the run body (never here); the classifier books each of its replies through it. */
+    sideCallBookRef: Prepared["sideCallBookRef"];
     /** borrowed-readonly — whether the BUILT-IN SendMessage is on this face (the lane rule's second term). */
     peerSendMessageBuiltIn: boolean;
     /** borrowed-readonly — the trusted Runner self-reference the Workflow mount executes children through; undefined when
@@ -140,7 +142,7 @@ export interface PrepareCapsAndWorkflowInput {
     memoryEngineSession: () => Prepared["memoryEngineSession"];
     /** borrowed-readonly — LATE-BOUND: the adopted center artifact; the Workflow mount's two center getters read it at THEIR call time. */
     centerAdoption: () => {
-        artifact: PromptEpochArtifact;
+        artifact: PromptArtifact;
         sourceRevision?: string;
     } | undefined;
 }

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -117,7 +117,7 @@ function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, askSeat, runClampSource, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, delegated } = input;
+    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, askSeat, runClampSource, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, delegated, sideCallBookRef } = input;
     const roster = new RosterBuilder(toolEffects);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
@@ -254,13 +254,30 @@ export async function prepareCapsAndWorkflow(input) {
                 }
                 const classifierAuth = await spec.getApiKeyAndHeaders?.(rungModel);
                 const request = async (seat, suffix) => {
-                    const response = await classifierRuntime.completeSimple(rungModel, { systemPrompt: classifierSystemPrompt(), messages: [{ role: "user", content: userPrompt + suffix, timestamp: Date.now() }] }, {
-                        signal,
-                        maxRetries: AUTO_MODE_CLASSIFIER_MAX_RETRIES,
-                        ...seat,
-                        ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
-                        ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
-                    });
+                    const book = sideCallBookRef.book;
+                    if (book === undefined)
+                        throw new Error("the auto-mode classifier was asked before the run body bound the leg's usage account, which it does before any tool call");
+                    let replied = false;
+                    const cut = () => {
+                        if (!replied)
+                            book("classifier", rungModel, undefined);
+                    };
+                    signal?.addEventListener("abort", cut, { once: true });
+                    let response;
+                    try {
+                        response = await classifierRuntime.completeSimple(rungModel, { systemPrompt: classifierSystemPrompt(), messages: [{ role: "user", content: userPrompt + suffix, timestamp: Date.now() }] }, {
+                            signal,
+                            maxRetries: AUTO_MODE_CLASSIFIER_MAX_RETRIES,
+                            ...seat,
+                            ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
+                            ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
+                        });
+                    }
+                    finally {
+                        replied = true;
+                        signal?.removeEventListener("abort", cut);
+                    }
+                    book("classifier", rungModel, response);
                     const failure = classifierReplyFailure(response);
                     if (failure !== undefined)
                         throw failure;

package/dist/core/runner/prepare-config-doors.d.ts

@@ -31,6 +31,7 @@ import type { RunnerDeps, TaskLimits, TaskSpec } from "../types.js";
 import { type UsageWindow } from "../usage-window-store.js";
 import { type AskSeat } from "../wiring-manifest.js";
 import type { PrepareResume, RunInternals, ToolFaceLists } from "./contracts.js";
+import { resolveHost } from "../../prompt-assembly/select.js";
 import { type RosterSpec } from "./caller-roster.js";
 export declare function limitConfigError(code: string, message: string): Error & {
     code?: string;
@@ -143,6 +144,10 @@ export interface PrepareConfigDoorsResult {
     toolFaceLists: ToolFaceLists;
     /** owned — the profile half of the single decision point (model-independent by contract). */
     promptProfile: "simple" | "classic";
+    /** owned — the host selector values (`TaskSpec.promptRole` / `TaskSpec.promptForm`, validated) the assembly selects on. */
+    promptHost: ReturnType<typeof resolveHost>;
+    /** owned — the center binding (`TaskSpec.promptBinding`, validated) the center layer's scoped overlays select on. */
+    promptBinding: string | undefined;
     /** owned — the administrator lock snapshot; the rest of prepare reads guarded slots through it. */
     lockedPreflight: LockedPreflight;
     /** owned — the resolved interaction posture (spec > spawning run > deployment); the

package/dist/core/runner/prepare-config-doors.js

@@ -14,10 +14,13 @@ import { describeRejectedValue } from "../tool-search-setting.js";
 import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from "../tool-model-gate.js";
 import { resolveUsageWindows } from "../usage-window-store.js";
 import { deriveAskEffective, resolveAskSeat, resolveQuestionSeam } from "../wiring-manifest.js";
+import { resolveHost } from "../../prompt-assembly/select.js";
+import { resolvePromptBinding } from "../../prompt-assembly/overlay.js";
 import { assertPeerPresenceValue } from "../../agents/peer-directory.js";
 import { snapshotDefinitionLists } from "../../agents/tool-filter.js";
 import { TOTAL_TOKENS_REMINDER_MODES } from "./turn-attachments.js";
 import { rosterFaceOf } from "./caller-roster.js";
+import { refuseRenamedDelegationMounts } from "./sub-agent-deny-lists.js";
 const TASK_LIMIT_KEY_DICT = {
     maxTokens: true,
     maxCostUsd: true,
@@ -184,6 +187,8 @@ export function prepareConfigDoors(input) {
                 : undefined,
     };
     const promptProfile = resolveModelPromptTraits({ id: "" }, spec, internals).promptProfile;
+    const promptHost = resolveHost(spec);
+    const promptBinding = resolvePromptBinding(spec);
     if (spec.resumeAt !== undefined) {
         if (resume) {
             const e = new Error("resumeAt cannot be combined with a durable resume");
@@ -358,6 +363,7 @@ export function prepareConfigDoors(input) {
     const usageWindows = resolveUsageWindows(deps.usageWindows);
     const brainCallGuardrailRef = {};
     const brainCallGuardrailMs = resolveBrainCallGuardrailMs(spec.limits?.brainCallGuardrailMs ?? deps.brainCallGuardrailMs);
+    const mountedRoster = spec.tools;
     if (spec.agents !== undefined && spec.agents.length > 0) {
         const pool = spec.tools ?? [];
         if (!pool.some((t) => typeof t.withAgents === "function")) {
@@ -377,6 +383,7 @@ export function prepareConfigDoors(input) {
             }),
         };
     }
+    refuseRenamedDelegationMounts(mountedRoster, spec.tools);
     const resolvedRoleRaw = resolveTaskModel(spec, deps);
     const resolvedRole = internals?.inheritedModelRef !== undefined ? { ...resolvedRoleRaw, modelRef: internals.inheritedModelRef } : resolvedRoleRaw;
     const model = resolvedRole.model;
@@ -438,6 +445,8 @@ export function prepareConfigDoors(input) {
         spec,
         toolFaceLists,
         promptProfile,
+        promptHost,
+        promptBinding,
         lockedPreflight,
         resolvedInteractionPosture,
         askSeat,

package/dist/core/runner/prepare-defer-classify.js

@@ -3,6 +3,7 @@ import { FULL_SHELL_CONTRACT_ID } from "../../tools/fs/index.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
 import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
+import { announceMemoryNotMounted } from "./announce-once-ledger.js";
 import { protocolOf } from "../protocol-table.js";
 import { classifyDeferredWithGate } from "./tool-defer-gate.js";
 import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
@@ -87,8 +88,7 @@ export function prepareDeferClassify(input) {
             const retractNames = memoryGroupRetractionSet(builtinDeferPairNames, memoryEnginePair.length > 0);
             roster.unmountWhere((t) => retractNames.has(t.name));
             if (sharedMemoryPair.length > 0) {
-                onceLedger.onError(new Error(`Shared memory tools ${SHARED_MEMORY_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
-                    `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — the pair mounts together or not at all.`), { phase: "config", sessionId, classification: "shared-memory-not-mounted" });
+                announceMemoryNotMounted(onceLedger, sessionId, "shared", SHARED_MEMORY_TOOL_NAMES, `mounting them would inject the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares`);
             }
             if (memoryEnginePair.length > 0) {
                 if (memoryBlock !== undefined && memoryRecallSegment !== undefined) {
@@ -100,8 +100,7 @@ export function prepareDeferClassify(input) {
                     else if (memoryBlock.startsWith(`${segment}\n\n`))
                         memoryBlock = memoryBlock.slice(segment.length + 2);
                 }
-                onceLedger.onError(new Error(`Memory tools ${MEMORY_ENGINE_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
-                    `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — these tools mount together or not at all.`), { phase: "config", sessionId, classification: "memory-tools-not-mounted" });
+                announceMemoryNotMounted(onceLedger, sessionId, "engine", MEMORY_ENGINE_TOOL_NAMES, `mounting them would inject the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares`);
             }
             deferred = d0;
         }

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -30,7 +30,8 @@ import type { Arbitration, ToolMarkSource } from "../ask-origin.js";
 import { type PermissionModeController } from "../mode-policy.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type ComplianceCapability } from "../compliance.js";
-import { type HookEnvCapabilities, type HookInvocationIdentity, type Hooks } from "../hooks.js";
+import type { InheritedToolCheck, LegModBus } from "../mods/stations.js";
+import { type HookEnvCapabilities, type HookInvocationIdentity } from "../hooks.js";
 import type { ToolPolicy } from "../tool-policy.js";
 import { type GateOutcome } from "../gate-outcome.js";
 import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
@@ -95,9 +96,11 @@ export interface PrepareGateStationsInput {
     };
     /** borrowed-readonly — the policy chain's effective policy, or undefined; presence only (the arming predicate). */
     effectivePolicy: ToolPolicy | undefined;
-    /** borrowed-readonly — the resolved hook record: `preToolUse` presence (arming), the two post seats and the failure seat
-     *  (the `tool_result` station), called through the record so a class-instance keeps its receiver. */
-    hooks: Hooks | undefined;
+    /** borrowed-readonly — the leg's mods bus: `classic.PreToolUse` presence arms the gate; the screenings and the post-call
+     *  events are raised on it. */
+    modBus: LegModBus;
+    /** borrowed-readonly — the inherited installations the gate raises `tool.check` on after `modBus` (the inherited-gate phase's). */
+    inheritedToolChecks: readonly InheritedToolCheck[];
     /** borrowed-readonly — the egress vocabulary: arming, and the per-call `egress` flag handed to the gate. */
     egressTools: ReadonlySet<string>;
     /** borrowed-readonly — the irreversible vocabulary: arming only. */
@@ -138,7 +141,7 @@ export interface PrepareGateStationsInput {
     batchHaltRef: Prepared["batchHaltRef"];
     /** borrowed-readonly — whether blocked/suspended ids are tracked at all (the post-tool callbacks exist). */
     blockedTracked: boolean;
-    /** borrowed-readonly — the leg's identity envelope every HookToolContext and PermissionDeniedPayload carries. */
+    /** borrowed-readonly — the leg's identity envelope every classic event and PermissionDeniedPayload carries. */
     hookIdentity: HookInvocationIdentity;
     /** borrowed-readonly — the leg's reminder provenance mark (every model-facing deny reason and hook context carries it). */
     reminderMark: string;
@@ -146,10 +149,6 @@ export interface PrepareGateStationsInput {
     hostTaskId: string;
     /** borrowed-readonly — the acquired session id (the settlement defects' error tag). */
     sessionId: string;
-    /** borrowed-readonly — the screening face as the gate must see it (the observational wrapper or the face itself). */
-    ownGatePreToolUse: Hooks["preToolUse"] | undefined;
-    /** borrowed-readonly — the validated per-prepare hook seat bound. */
-    hookTimeoutMs: number;
     /** borrowed-readonly — the hand's live tracked cwd, or undefined; `current` is read per screening / per post seat. Not
      *  written here. */
     handsCwdRef: CwdRef | undefined;
@@ -237,8 +236,6 @@ export interface PrepareGateStationsInput {
     delegation: {
         isDelegatedChild: boolean;
     };
-    /** borrowed-readonly — the own hook-crash reporter (an expired post seat is reported through it). */
-    notifyOwnHookCrash: (err: unknown) => void;
     /** borrowed-mutable — the leg's settlement seam. Writer here: the `tool_result` station marks a carrier whose output
      *  a host hook rewrote (`noteHostRewrite`), so a frame the rewrite removed settles as the host's decision. */
     frameSettlement: FrameSettlement;

package/dist/core/runner/prepare-gate-stations.js

@@ -1,9 +1,9 @@
 import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { mountedToolRequiresUserInteraction } from "../mode-policy.js";
 import { complianceCallDenial } from "../compliance.js";
-import { cloneObserverInput, formatHookFeedback, runToolGate } from "../hooks.js";
+import { formatHookFeedback, runToolGate } from "../hooks.js";
 import { screenGateOutcome } from "../gate-outcome.js";
-import { directDeny, frozenInputSnapshot } from "./gate-exit.js";
+import { cloneObserverInput, directDeny, frozenInputSnapshot } from "./gate-exit.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
@@ -46,8 +46,7 @@ export function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, stampCallTarget, hookEnvFace, writeProtectionCheck, shellReadCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement, seatInputsFor } = input;
-    const gatePreToolUse = ownGatePreToolUse !== undefined ? (name, args, ctx) => ownGatePreToolUse(name, args, { ...ctx, permissionMode: permissionMode.observed }) : undefined;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, handsCwdRef, stampCallTarget, hookEnvFace, writeProtectionCheck, shellReadCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, frameSettlement, seatInputsFor, modBus, inheritedToolChecks } = input;
     const releasesAnnounced = new Map();
     const onModeReleased = (info) => {
         const table = info.readUnestablished === true ? input.readDenyInForce(info.toolCallId) : undefined;
@@ -81,7 +80,7 @@ export function prepareGateStations(input) {
         const writeProtectionArmed = writeProtectionCheck !== undefined && tools.some((t) => PATH_CONFINABLE_WRITE_TOOLS.has(t.name));
         toolCallGateArmedRef.armed =
             effectivePolicy !== undefined ||
-                hooks?.preToolUse !== undefined ||
+                modBus.hasHandlers("classic.PreToolUse") ||
                 egressTools.size > 0 ||
                 irreversibleTools.size > 0 ||
                 spec.enablePlanMode === true ||
@@ -119,8 +118,9 @@ export function prepareGateStations(input) {
                         ...(e.signal !== undefined ? { callSignal: e.signal } : {}),
                         identity: hookIdentity,
                         reminderMark,
-                        ...(gatePreToolUse !== undefined ? { preToolUse: gatePreToolUse } : {}),
-                        hookTimeoutMs,
+                        modBus,
+                        ...(inheritedToolChecks.length > 0 ? { inheritedToolChecks } : {}),
+                        observedPermissionMode: () => permissionMode.observed,
                         ...(handsCwdRef !== undefined ? { trackedCwd: () => handsCwdRef.current } : {}),
                         ...(stampCallTarget !== undefined ? { stampCallTarget } : {}),
                         ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
@@ -137,7 +137,6 @@ export function prepareGateStations(input) {
                         irreversibility: tierSeat?.value,
                         reversibilityProbe: tierSeat?.read(reversibilityProbes),
                         abortSignal: abortController.signal,
-                        ...(notifyPermissionDenied ? { permissionDenied: (p) => notifyPermissionDenied({ ...p, permissionMode: permissionMode.observed }) } : {}),
                         onHookError: notifyHookError,
                         shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
                         ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), route: approvalRouteOf(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
@@ -241,13 +240,15 @@ export function prepareGateStations(input) {
                     }
                     return { block: true, reason: result.reason, ...details };
                 }
+                if (result.suspend === undefined)
+                    toolOccurrences.release(e.toolCallId);
                 return result.updatedInput !== undefined ? { updatedInput: result.updatedInput } : undefined;
             });
         }
     }
-    const toolResultStation = createToolResultStation({ hooks, blockedToolCalls, toolRosterDeltas, preToolContexts, hookTimeoutMs, abortController, spec, handsCwdRef, hookEnvFace, hookIdentity, permissionMode, notifyOwnHookCrash, reminderMark, frameSettlement });
+    const toolResultStation = createToolResultStation({ modBus, blockedToolCalls, toolRosterDeltas, preToolContexts, abortController, spec, handsCwdRef, hookEnvFace, hookIdentity, permissionMode, reminderMark, frameSettlement });
     if (toolResultStation !== undefined)
         harness.on("tool_result", toolResultStation);
-    const approvedCallScreen = createApprovedCallScreen({ preToolUse: gatePreToolUse, hookTimeoutMs, abortController, handsCwdRef, hookEnvFace, hookIdentity, notifyOwnHookCrash, preToolContexts });
+    const approvedCallScreen = createApprovedCallScreen({ modBus, permissionMode, abortController, handsCwdRef, hookEnvFace, hookIdentity, preToolContexts });
     return { toolCallStationArmed: toolCallGateArmedRef.armed, toolResultStationArmed: toolResultStation !== undefined, ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}) };
 }

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -31,14 +31,15 @@ import type { AgentHarness, ExecutionEnv } from "../../internal/harness.js";
 import type { SubagentWorktreeIsolation } from "../../agents/subagent.js";
 import { forkGovernanceDenial } from "../../agents/subagent.js";
 import type { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import type { PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
+import type { PromptArtifact } from "../../prompt-assembly/artifact.js";
 import type { ContainmentFace } from "../../tools/fs/index.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type OnQuestion } from "../ask-question.js";
 import { type ParentSpecSeat } from "../parent-spec-seat.js";
+import { type HookEnvCapabilities } from "../hooks.js";
+import { type LegModBus, type ModChainLink } from "../mods/stations.js";
 import { type ChildClampSource } from "../child-clamp-seats.js";
-import { type HookEnvCapabilities, type Hooks } from "../hooks.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { OwnOrgAdmissionVerdict } from "../memory-admission.js";
 import type { DelegationContentSafety } from "../memory-engine/delegation-provenance.js";
@@ -157,13 +158,10 @@ export interface PrepareInheritedGateInput {
     /** borrowed-readonly — LATE-BOUND: the per-principal entitlements the caps phase resolves after this one; read only inside
      *  `inheritedGateForChildren` (the two mandate tests), at spawn time. */
     runtimeCaps: () => RuntimeCaps | undefined;
-    /** borrowed-readonly — LATE-BOUND: the resolved hook record (`spec.hooks ?? deps.hooks`), read inside the chain assembly for
-     *  this task's own screening face. */
-    hooks: () => Hooks | undefined;
-    /** borrowed-readonly — LATE-BOUND: whether the deployment declared its screening face observational (then it rides no entry). */
-    preToolUseObservational: () => boolean;
-    /** borrowed-readonly — LATE-BOUND: the validated per-invocation hook bound the screening-face entry's policy runs under. */
-    hookTimeoutMs: () => number;
+    /** borrowed-readonly — the leg's mods bus: the chain assembly mints this leg's screening entry over its `classic.PreToolUse` chain. */
+    modBus: LegModBus;
+    /** borrowed-readonly — this leg's chain identity as its admission recorded it (`chainOfBus`) — the installation identity's chain term. */
+    ownModChain: readonly ModChainLink[];
     /** borrowed-readonly — LATE-BOUND: the hook-env capability face the screening-face entry's policy resolves paths in. */
     hookEnvFace: () => HookEnvCapabilities | undefined;
     /** borrowed-readonly — LATE-BOUND: the armed classifier (undefined = not armed), read where the chain freezes it onto both
@@ -192,7 +190,7 @@ export interface PrepareInheritedGateInput {
     handsLessResolvedWriteFace: () => WriteFaceSeat | undefined;
     /** borrowed-readonly — LATE-BOUND: the adopted center artifact (ctx `centerArtifactDigest` / `centerSourceRevision`). */
     centerAdoption: () => {
-        artifact: PromptEpochArtifact;
+        artifact: PromptArtifact;
         sourceRevision?: string;
     } | undefined;
     /** borrowed-readonly — LATE-BOUND: the memory-engine session (the ctx's capture-floor getters read it at THEIR call time). */
@@ -296,8 +294,6 @@ export interface PrepareInheritedGateResult {
     /** owned — the env the screening face sees through `ctx.env` (identity half of a chain entry's `hookEnv`); the policy-chain
      *  station's pass-through arm compares against it. */
     hookEnvSource: unknown;
-    /** owned — the deployment lane for a screening face that crashes while screening a descendant's call (phase "hook"). */
-    notifyOwnHookCrash: (err: unknown) => void;
     /** owned — the FROZEN question seat (spec over deps), the content-ask twin of `frozenOnAsk`. */
     frozenOnQuestion: OnQuestion | undefined;
     /** owned — the parent SPEC seat this run hands its children (`parentSpecSeatOf(spec, frozenOnQuestion)`): the ctx seat and the Workflow mount dep are this one value; both lanes apply it with `applyParentSpecSeat` (one law). */

package/dist/core/runner/prepare-inherited-gate.js

@@ -1,11 +1,12 @@
 import { forkGovernanceDenial, resolveDelegationEntryCaps } from "../../agents/subagent.js";
 import { isLiveQuestionFace } from "../ask-question.js";
 import { parentSpecSeatOf } from "../parent-spec-seat.js";
-import { childClampSeats, clampSourceOf } from "../child-clamp-seats.js";
 import { createPreToolUseConstraintPolicy } from "../hooks.js";
+import { chainJudges, sameInstallation } from "../mods/stations.js";
+import { childClampSeats, clampSourceOf } from "../child-clamp-seats.js";
 import { continuesLineage } from "../session-policy-store.js";
 import { StubExecutionEnv } from "../stub-env.js";
-import { askApproverIdentity, durableMandateSourceOf } from "../tool-policy.js";
+import { durableMandateSourceOf } from "../tool-policy.js";
 import { chainAnchorRecords } from "./child-tree.js";
 import { deliverEngineNotice } from "../types.js";
 import { PermissionModeController, autoModeFaceOf, modeRequestAfterResume } from "../mode-policy.js";
@@ -13,7 +14,6 @@ import { SessionModeSeats } from "./session-mode-seats.js";
 import { recordedModeSeed } from "../checkpoint-store.js";
 import { frozenSkillGrants } from "../skill-grant.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
-import { asThrownError } from "../thrown-value.js";
 export function prepareInheritedGate(input) {
     const { spec, deps, askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, pathRuleAnchors, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
     const liveInheritedGate = internals?.inheritedGate;
@@ -117,13 +117,6 @@ export function prepareInheritedGate(input) {
     const skillGrantCheckpointSection = () => frozenSkillGrants(skillGrants);
     const frozenOnAsk = askSeat.value;
     const hookEnvSource = (ownedEnv ?? deps.executionEnv) != null ? executionEnv : undefined;
-    const notifyOwnHookCrash = (err) => {
-        try {
-            deps.onError?.(asThrownError(err), { phase: "hook", sessionId });
-        }
-        catch {
-        }
-    };
     const frozenOnQuestion = spec.onQuestion ?? deps.onQuestion;
     const parentSpecSeat = parentSpecSeatOf(spec, frozenOnQuestion);
     const provenanceForChildrenRef = {};
@@ -142,18 +135,12 @@ export function prepareInheritedGate(input) {
         const durableMandate = durableMandateSourceOf({ forceDurableGate: input.runtimeCaps()?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined, onAsk: frozenOnAsk }) !== undefined;
         const contentMandate = input.runtimeCaps()?.forceDurableGate === true ||
             (spec.durableApproval !== undefined && !isLiveQuestionFace(frozenOnQuestion));
-        const ownPreToolUse = input.preToolUseObservational() ? undefined : input.hooks()?.preToolUse;
-        const hookConstraint = ownPreToolUse !== undefined &&
-            !(inheritedParentConstraints ?? []).some((pc) => pc.preToolUse === ownPreToolUse &&
-                askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
-                (pc.durableMandate === true) === durableMandate &&
-                (pc.contentMandate === true) === contentMandate &&
-                pc.hookEnv === hookEnvSource &&
-                pc.autoMode?.decider === autoModeDecider)
+        const ownInstallation = { chain: input.ownModChain, onAsk: frozenOnAsk, durableMandate, contentMandate, hookEnv: hookEnvSource, decider: autoModeDecider };
+        const hookConstraint = chainJudges(input.modBus) && !(inheritedParentConstraints ?? []).some((pc) => sameInstallation(pc, ownInstallation))
             ? [
                 {
-                    policy: createPreToolUseConstraintPolicy(ownPreToolUse, input.hookEnvFace(), notifyOwnHookCrash, input.hookTimeoutMs()),
-                    preToolUse: ownPreToolUse,
+                    policy: createPreToolUseConstraintPolicy(input.modBus, input.hookEnvFace()),
+                    mods: input.ownModChain,
                     ...(hookEnvSource !== undefined ? { hookEnv: hookEnvSource } : {}),
                     ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
                     ...(durableMandate ? { durableMandate: true } : {}),
@@ -305,5 +292,5 @@ export function prepareInheritedGate(input) {
             ...(spec.enablePlanMode === true ? { enterPlanMode } : {}),
         };
     };
-    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, runClampSource, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
+    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, runClampSource, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, frozenOnAsk, hookEnvSource, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
 }

package/dist/core/runner/prepare-memory-engine-session.js

@@ -5,7 +5,7 @@ import { recordSyncUnattestable, sessionSettlements } from "../memory-engine/del
 import { protocolOf } from "../protocol-table.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { fileArgPath } from "../../tools/fs/safety.js";
+import { fileArgPath } from "../tool-registry.js";
 import { RosterBuilder } from "../tool-roster.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareMemoryEngineSession(input) {

package/dist/core/runner/prepare-park-ask.js

@@ -9,7 +9,7 @@ import { pauseOf } from "../pause-registry.js";
 import { askCarryRowMembers } from "../hooks.js";
 import { askMandateMember, ownedClearanceFacts } from "../ask-origin.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { advertisedWritableRootsSeat, exemptRootsSeat, isLiveApproverSeat, carriesBidiControls, describeThrown, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, exemptRootsSeat, isLiveApproverSeat, carriesBidiControls, describeThrown, ownArgs, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
 import { InMemoryToolResultStore, ScopedToolResultStore, isVolatileOffloadStore } from "../tool-result-store.js";
 import { raceAbort, raceSettlementAgainstSignal } from "./abort-race.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
@@ -43,11 +43,7 @@ export function prepareParkAsk(input) {
                 return;
             contentAskBindings.set(req.toolCallId, { ...entry, questionsHash, deliveryId });
         };
-        const refuseBeforeDelivery = (code, presentedInput) => ({
-            kind: "delivery_failure",
-            code,
-            ...(presentedInput !== undefined ? { presentedInput } : {}),
-        });
+        const refuseBeforeDelivery = (code) => ({ kind: "delivery_failure", code });
         let retained;
         let presented;
         try {
@@ -59,13 +55,13 @@ export function prepareParkAsk(input) {
         }
         const retainedQuestionsHash = boundInputHashOf(retained.questions);
         if (!Value.Check(mountedQuestionTool.parameters, retained) || validateAskQuestions(presented) !== undefined) {
-            return refuseBeforeDelivery("question.malformed_request", retained);
+            return refuseBeforeDelivery("question.malformed_request");
         }
         if (contentAskBindings.size >= CONTENT_ASK_BINDING_CAP && !contentAskBindings.has(req.toolCallId)) {
             return { kind: "unavailable", parkDeclined: true };
         }
         if (contentAskSignal.aborted) {
-            return { kind: "delivery_failure", code: "question.aborted", presentedInput: retained };
+            return { kind: "delivery_failure", code: "question.aborted" };
         }
         try {
             const facePromise = (async () => liveQuestionFace({
@@ -90,13 +86,13 @@ export function prepareParkAsk(input) {
                 const reading = classifyQuestionOutcome(outcome);
                 if (reading.shape === "contradictory") {
                     bindOutcome({ kind: "failed", error: new Error("the question channel returned a contradictory outcome (an unavailable answer)") }, retainedQuestionsHash);
-                    return { kind: "delivery_failure", code: "question.human_channel_failed", presentedInput: retained };
+                    return { kind: "delivery_failure", code: "question.human_channel_failed" };
                 }
                 if (reading.shape === "unavailable")
-                    return { kind: "unavailable", parkDeclined: true, presentedInput: retained };
+                    return { kind: "unavailable", parkDeclined: true };
                 const answerSnapshot = reading.answer;
                 bindOutcome({ kind: "answered", answer: answerSnapshot }, retainedQuestionsHash);
-                return { kind: "answered", presentedInput: retained };
+                return { kind: "answered" };
             }
             const error = settlement.tag === "threw"
                 ? settlement.error
@@ -105,12 +101,11 @@ export function prepareParkAsk(input) {
             return {
                 kind: "delivery_failure",
                 code: settlement.tag === "aborted" || contentAskSignal.aborted ? "question.aborted" : "question.human_channel_failed",
-                presentedInput: retained,
             };
         }
         catch (err) {
             bindOutcome({ kind: "failed", error: err }, retainedQuestionsHash);
-            return { kind: "delivery_failure", code: "question.human_channel_failed", presentedInput: retained };
+            return { kind: "delivery_failure", code: "question.human_channel_failed" };
         }
     };
     const suspendAsk = parkLaneArmed && checkpointStore !== undefined
@@ -180,7 +175,8 @@ export function prepareParkAsk(input) {
                     if (reprojectedRaced.tag === "threw")
                         throw reprojectedRaced.error;
                     const reprojected = refuseOutOfContractDecision(reprojectedRaced.value);
-                    const rewroteTheFiledValue = reprojected.updatedInput !== undefined && !samePlainValue(reprojected.updatedInput, parkedArgs);
+                    const filedAsHeld = ownArgs(parkedArgs);
+                    const rewroteTheFiledValue = reprojected.updatedInput !== undefined && !(filedAsHeld.ok && samePlainValue(reprojected.updatedInput, filedAsHeld.value));
                     if (reprojected.action === "deny" || rewroteTheFiledValue) {
                         throw new ParkRefusal(`the arguments of "${req.toolName}" change shape when stored by this checkpoint backend, and the deployment's tool policy does not accept the stored shape` +
                             `${reprojected.action === "deny" && reprojected.message ? `: ${reprojected.message}` : ""} — ` +