@sema-agent/core 7.51.2 → 7.52.0

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -23,7 +23,7 @@ import type { AgentTool } from "../../internal/harness.js";
 import type { ExecutionEnv } from "../../internal/harness.js";
 import { type AskClass } from "../ask-class.js";
 import type { AutoModeDecider } from "../auto-mode.js";
-import { type Hooks } from "../hooks.js";
+import { type InheritedToolCheck, type LegModBus, type ModChainLink } from "../mods/stations.js";
 import type { LockedPreflight } from "../locked-config.js";
 import { type SessionPermissionRules } from "../session-policy-store.js";
 import { type OnAsk, type ToolPolicy } from "../tool-policy.js";
@@ -34,6 +34,7 @@ import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { ReadDenyMatcher } from "../../tools/fs/read-deny.js";
 import { type SkillGrantLane, type SkillGrantSource, type SkillGrantTable } from "../skill-grant.js";
 import type { GrantBindingOf } from "../skill-grant-binding.js";
+import type { ToolSelector } from "../tool-face.js";
 import { type AllowEntryLane, type AllowEntryTable } from "../allow-entry.js";
 import type { InheritedGate, IrreversibilityTier, PrepareResume, RunInternals, StopForDenialLimit } from "./contracts.js";
 import { type Arbitration } from "../ask-origin.js";
@@ -43,14 +44,14 @@ import { createRuleOffersOf, type PermissionRuleLanes } from "./permission-rule-
 import type { ToolCallLike } from "../tool-registry.js";
 export interface PreparePolicyChainInput {
     /** borrowed-readonly — the REBOUND spec. Read: `sessionId` / `principal` (the session-rule read and the lanes' identity),
-     *  `hooks` (spec over deps), `durableApproval` / `checkpointStore` (the mandate-park facility test and the sandbox arming's park prerequisites), `taskId` (the late-ask observer's detail).
-     *  Never mutated. */
-    spec: Pick<TaskSpec, "sessionId" | "principal" | "hooks" | "durableApproval" | "taskId" | "checkpointStore">;
-    /** borrowed-readonly — the deployment seats: `sessionPolicyStore` (the rule reads), `hooks` (the fallback record),
+     *  `durableApproval` / `checkpointStore` (the mandate-park facility test and the sandbox arming's park prerequisites), `taskId` (the late-ask observer's detail),
+     *  `tools` (the names the caller mounted, for the name audit). Never mutated. */
+    spec: Pick<TaskSpec, "sessionId" | "principal" | "durableApproval" | "taskId" | "checkpointStore" | "tools">;
+    /** borrowed-readonly — the deployment seats: `sessionPolicyStore` (the rule reads),
      *  `permissionRuleStore` / `localOwnerRules` (the lanes and the offer factory), `onError` / `onNotice` (the advisories,
      *  the refusal disclosures, the late-ask observer), `tracer` (the admission and rule-store frames), `checkpointStore` (the park facility). Receiver preserved;
      *  the advisory dedupe is KEYED on this object's identity. */
-    deps: Pick<RunnerDeps, "sessionPolicyStore" | "hooks" | "permissionRuleStore" | "localOwnerRules" | "onError" | "onNotice" | "tracer" | "checkpointStore" | "a2a">;
+    deps: Pick<RunnerDeps, "sessionPolicyStore" | "permissionRuleStore" | "localOwnerRules" | "onError" | "onNotice" | "tracer" | "checkpointStore" | "a2a">;
     /** borrowed-readonly — the trusted spawn-side channel: `parentTaskId` (the from-subagent bit), `explicitAgentName` /
      *  `agentName` (the source agent name) — the ask source identity's local, trusted facts. */
     internals: Pick<RunInternals, "parentTaskId" | "explicitAgentName" | "agentName"> | undefined;
@@ -82,6 +83,8 @@ export interface PreparePolicyChainInput {
     tools: ReadonlyArray<AgentTool>;
     /** borrowed-readonly — the harness list (placeholders keep their deferred names), the audit universe's second half. */
     harnessTools: ReadonlyArray<AgentTool>;
+    /** borrowed-readonly — the leg's compiled tool selector: the name audit reads the delegation tools it leaves ({@link delegationPoolReading}). */
+    selector: Pick<ToolSelector, "admits">;
     /** borrowed-readonly — the effect collection, read by the narrowing layers (path-confinable write tools). */
     toolEffects: ReadonlyMap<string, ToolEffect>;
     /** borrowed-readonly — the egress mark set (the risk axes, the boundary predicate, the offer factory). */
@@ -146,8 +149,12 @@ export interface PreparePolicyChainInput {
     frozenOnAsk: OnAsk | undefined;
     /** borrowed-readonly — the identity of this task's hook-env source (the pass-through test's environment term). */
     hookEnvSource: unknown;
-    /** borrowed-readonly — the own-hook crash reporter (the timeout seat's bad-value disclosure). */
+    /** borrowed-readonly — the leg's own failure lane (`onError`, phase `hook`, swallow-guarded): an inherited policy that threw. */
     notifyOwnHookCrash: (err: unknown) => void;
+    /** borrowed-readonly — the leg's mods bus (whether this leg's own phase 1 judges with `classic.PreToolUse` — the pass-through test). */
+    modBus: LegModBus;
+    /** borrowed-readonly — this leg's chain identity as its admission recorded it (`chainOfBus`) — the stand-in test's chain term. */
+    ownModChain: readonly ModChainLink[];
     /** borrowed-readonly — LATE-BOUND: this task's own classifier instance (the pass-through test's decider term), read at chain
      *  assembly (the arming runs after this phase, and again on a steer into `auto`). */
     autoModeDecider: () => AutoModeDecider | undefined;
@@ -182,14 +189,6 @@ export interface PreparePolicyChainInput {
     };
 }
 export interface PreparePolicyChainResult {
-    /** owned — the resolved hook record (`spec.hooks ?? deps.hooks`), or undefined. */
-    hooks: Hooks | undefined;
-    /** owned — the per-leg hook timeout, resolved and validated ONCE (`Prepared.hookTimeoutMs`). */
-    hookTimeoutMs: number;
-    /** owned — whether the deployment declared its screening face observational. */
-    preToolUseObservational: boolean;
-    /** owned — the screening face this task's OWN gate runs in phase 1 (the observational wrapper when declared). */
-    ownGatePreToolUse: Hooks["preToolUse"] | undefined;
     /** owned — the resume-edit base policy (`Prepared.basePolicyForResumeEdit`), or undefined. */
     basePolicyForResumeEdit: ToolPolicy | undefined;
     /** owned — the deny-narrowing fold (`Prepared.denyNarrowingPolicy`), or undefined when no layer exists. */
@@ -208,6 +207,9 @@ export interface PreparePolicyChainResult {
     /** borrowed-mutable — the inherited-unavailable marker channel. Writers: the inherited arms here (mark); the gate station
      *  (the lifecycle-end sweep) and the park lane's consumers (delete on consumption). */
     inheritedUnavailableAsks: Set<string>;
+    /** owned — the inherited installations THIS leg's gate raises `tool.check` on after its own bus (every screening entry the
+     *  leg's own gate does not stand in for — the fold's pass-through test), each with the settlement its question takes. */
+    inheritedToolChecks: readonly InheritedToolCheck[];
     /** owned — the inherited stations' MODE ARBITRATIONS by tool call (a release or a refusal made inside the fold,
      *  where an ancestor's ask is arbitrated before its frozen approver). Writers: the three inherited stations here; the gate's
      *  exit reads it onto the disposition and the gate station deletes it at the call's end. */

package/dist/core/runner/prepare-policy-chain.js

@@ -3,19 +3,19 @@ import { policyAskClassOf } from "../ask-class.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
-import { cloneObserverInput, resolveHookTimeoutMs } from "../hooks.js";
-import { assertHookSeatsCallable } from "../hook-seats.js";
+import { chainJudges, inheritedToolChecks, screeningInstallationsOf, standsInFor } from "../mods/stations.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
 import { earlierGrammarAdvisory } from "../session-policy-store.js";
-import { askApproverIdentity, attest, attestationOf, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, mergeAttestation, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, withAttestation, wrapToolPolicy } from "../tool-policy.js";
+import { attest, attestationOf, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, mergeAttestation, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, withAttestation, wrapToolPolicy } from "../tool-policy.js";
 import { judgeRuleToolName, mountedToolNames } from "../tool-name-aliases.js";
 import { approvalCardMemberOf } from "../tool-roster.js";
 import { NAMESPACED_NAME_SHAPES } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
 import { skillGrantBindingMembers } from "../skill-grant.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
-import { autoStrippedRule, cardDisclosureOf } from "../allow-entry.js";
+import { delegationPoolReading } from "./sub-agent-deny-lists.js";
+import { autoStrippedRule, cardDisclosureOf, nearMissSpellingOf, rootFacingToolNames } from "../allow-entry.js";
 import { arbitrateByMode, askClassMembersOf, askFaceOf, askMandateMember } from "../ask-origin.js";
 import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
@@ -28,7 +28,7 @@ import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-
 import { policyThrowLine, reportPolicyThrow } from "./policy-throw.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, pathRuleAnchors, headLeads, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, readFace, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, pathRuleAnchors, headLeads, tools, harnessTools, selector, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, modBus, ownModChain, autoModeDecider, readFace, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
     const arbitrateInherited = (ask, toolCallId, judged) => {
         const verdict = arbitrateByMode(permissionMode.current, judged.classification, { origin: judged.origin, ...askMandateMember(ancestorFacts(judged.ask.action === "ask" ? judged.ask : undefined)) });
@@ -40,32 +40,40 @@ export async function preparePolicyChain(input) {
         return { action: "deny", message: `refused by the ${verdict.mode} permission mode at an inherited ancestor layer (${verdict.askClass})`, decisionReason: "mode" };
     };
     const policy = lockedPreflight.toolPolicy;
-    const auditPolicyNames = (auditee) => {
+    const auditPolicyNames = (auditee, inherited = false) => {
         const nameGroups = toolPolicyNameSets(auditee);
         if (nameGroups.length > 0) {
             const known = mountedToolNames(tools);
             for (const t of harnessTools)
                 known.add(t.name);
+            const pool = delegationPoolReading(spec.tools ?? [], selector);
+            const callerNames = mountedToolNames(spec.tools ?? []);
+            const rootFacing = rootFacingToolNames([...known, ...callerNames, ...pool.names]);
             const unmatched = new Set();
             for (const g of nameGroups) {
                 for (const [kind, list] of [["deny", g.deny], ["ask", g.ask], ["allow", g.allow]]) {
                     for (const n of list ?? []) {
                         const verdict = judgeRuleToolName(n, known);
-                        if (verdict.kind !== "current") {
+                        const twin = verdict.kind === "current" && !inherited ? nearMissSpellingOf(n, rootFacing) : undefined;
+                        const stale = verdict.kind !== "current" ? verdict : twin !== undefined ? { kind: "case_twin", twin, carrier: known.has(twin) || callerNames.has(twin) ? "run" : pool.names.has(twin) ? "pool" : "catalog" } : undefined;
+                        if (stale !== undefined) {
                             const entry = `tool policy ${kind}-list entry "${n}"`;
                             let message;
-                            switch (verdict.kind) {
+                            switch (stale.kind) {
                                 case "retired":
-                                    message = `${entry} is a RETIRED tool name (${verdict.guidance}) and matches nothing in this run's roster — legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Update the deployment's rule to the current name.`;
+                                    message = `${entry} is a RETIRED tool name (${stale.guidance}) and matches nothing in this run's roster — legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Update the deployment's rule to the current name.`;
                                     break;
                                 case "unprefixed_namespace":
                                     message = `${entry} carries the "__" namespace separator but no protocol prefix, and matches nothing in this run's roster — protocol tools are named ${NAMESPACED_NAME_SHAPES}, and legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Prefix the entry with the owning protocol's marker.`;
                                     break;
                                 case "unmintable_segment":
-                                    message = `${entry} can match no tool, ever (${verdict.guidance}), so it would silently guard nothing.${verdict.currentName !== undefined ? ` Write "${verdict.currentName}".` : ""}`;
+                                    message = `${entry} can match no tool, ever (${stale.guidance}), so it would silently guard nothing.${stale.currentName !== undefined ? ` Write "${stale.currentName}".` : ""}`;
+                                    break;
+                                case "case_twin":
+                                    message = `${entry} differs from ${stale.carrier === "run" ? "the mounted tool" : stale.carrier === "pool" ? "the tool a delegation pool carries" : "the engine's catalog tool"} "${stale.twin}" only in case, and a policy compares tool names exactly, so it matches nothing in this run's roster and would silently guard nothing. Write "${stale.twin}".`;
                                     break;
                                 default: {
-                                    const exhaustive = verdict;
+                                    const exhaustive = stale;
                                     return exhaustive;
                                 }
                             }
@@ -111,7 +119,7 @@ export async function preparePolicyChain(input) {
         catch {
         }
     };
-    const announceEarlierGrammar = (rulesSessionId) => (entries) => deps.onError?.(Object.assign(new Error(earlierGrammarAdvisory(rulesSessionId, entries)), { code: "config.session_rules_earlier_grammar" }), { phase: "config", sessionId });
+    const announceEarlierGrammar = (rulesSessionId) => (entries, field, grammar) => deps.onError?.(Object.assign(new Error(earlierGrammarAdvisory(rulesSessionId, entries, field, grammar)), { code: "config.session_rules_earlier_grammar" }), { phase: "config", sessionId });
     let sessionRulePolicy;
     if (deps.sessionPolicyStore && spec.sessionId) {
         const store = deps.sessionPolicyStore;
@@ -156,31 +164,12 @@ export async function preparePolicyChain(input) {
         check: (creq) => checkToolPolicyProjection(entry, creq) ?? { action: "allow" },
     }));
     const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, ...frozenConstraintLayers].filter((p) => p !== undefined);
-    for (const layer of narrowingLayers)
-        auditPolicyNames(layer);
+    auditPolicyNames(sessionRulePolicy);
+    for (const layer of ancestorRulePolicies)
+        auditPolicyNames(layer, true);
     const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
     const basePolicyForResumeEdit = lockedPreflight.basePolicyForResumeEdit ?? lockedPreflight.toolPolicy;
-    const hooks = spec.hooks ?? deps.hooks;
-    assertHookSeatsCallable(hooks, spec.hooks !== undefined ? "spec" : "deps");
-    const hookTimeoutMs = resolveHookTimeoutMs(hooks?.timeoutMs, notifyOwnHookCrash, hooks);
-    const preToolUseObservational = hooks?.preToolUse !== undefined && hooks.preToolUseObservational === true;
-    const ownGatePreToolUse = !preToolUseObservational
-        ? hooks?.preToolUse
-        : async (toolName, input, ctx) => {
-            const r = await hooks.preToolUse(toolName, cloneObserverInput(input), ctx);
-            if (r === undefined)
-                return undefined;
-            try {
-                const action = typeof r.action === "string" ? r.action : "(non-string action)";
-                deps.onError?.(new Error(`a PreToolUse hook declared observational (Hooks.preToolUseObservational) returned a decision ("${action}") while screening ` +
-                    `"${toolName}" — the decision was NOT adopted and the call proceeded as if the hook had no opinion. ` +
-                    `A declared-observational face must return undefined; drop the declaration if its verdicts are meant to count ` +
-                    `(they then also travel to delegated children as an inherited screening constraint).`), { phase: "hook", sessionId, classification: "observational-hook-verdict-ignored" });
-            }
-            catch {
-            }
-            return undefined;
-        };
+    const ownChainJudges = chainJudges(modBus);
     const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
     const sharedFirstDecision = new Map();
     const SHARED_FIRST_DECISION_CAP = 256;
@@ -422,14 +411,66 @@ export async function preparePolicyChain(input) {
             editArgs = rr.updatedInput;
         }
     };
-    const parentConstraintWrappers = (inheritedParentConstraints ?? []).map((pc) => pc.preToolUse !== undefined &&
-        pc.preToolUse === hooks?.preToolUse &&
-        !preToolUseObservational &&
-        pc.durableMandate !== true &&
-        pc.contentMandate !== true &&
-        askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
-        pc.hookEnv === hookEnvSource &&
-        pc.autoMode?.decider === autoModeDecider()
+    const settleInstallationAsk = async (pc, decision, creq, csignal) => {
+        const settledAs = (result) => ({ kind: "settled", result });
+        if (isDelegatedQuestion(creq)) {
+            if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
+                return settledAs(decision);
+            return settledAs({
+                action: "deny",
+                message: `inherited parent policy requires durable handling of the question raised for "${creq.toolName}" and the marker channel is at capacity — ` +
+                    `denied fail-closed (tighten-only)`,
+            });
+        }
+        if (pc.durableMandate === true) {
+            if (mandatedCallFloats(creq.toolCallId))
+                return settledAs(decision);
+            return settledAs(mandateUnreconstructibleDeny(creq));
+        }
+        const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
+        const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), route: frozenApproverRoute(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
+        if (judged.kind === "allow")
+            return settledAs(judged.result);
+        if (judged.kind === "deny")
+            return settledAs(judged.result);
+        const { ask: inheritedAsk, fallback } = judged;
+        if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
+            recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
+            return settledAs(decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput, decisionReason: "sandbox" } : { action: "allow", decisionReason: "sandbox" });
+        }
+        const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId, judged);
+        if (arbitrated !== undefined)
+            return settledAs(arbitrated);
+        const askT0 = now();
+        const { resolved, judged: settled } = await resolveInheritedAsk(judged, (j) => resolveAsk({
+            toolName: creq.toolName,
+            toolCallId: creq.toolCallId,
+            args: presentedArgs,
+            ...ruleOffersOf(creq, presentedArgs, ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
+            ...cardDisclosureOf(j.ask, inheritedAskFallbackMessage(creq.toolName)),
+            ...askSourceIdentity(),
+            ...riskAxesOf(creq),
+            ...approvalCardMemberOf(creq),
+            ...grantBindingOf(creq, presentedArgs),
+            ...(j.ask.action === "ask" && j.ask.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+            ...askMandateMember(ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
+            ...inheritedAskCarry(j, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
+            ruleEvidence: inheritedAskEvidence,
+        }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), pc.autoMode?.denialTracking, creq, inheritedStationFacts(creq));
+        void settleReadRootGrant(resolved.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
+        const askWaitMs = Math.max(0, now() - askT0);
+        if (resolved.action === "deny" && resolved.approverUnavailable === true) {
+            if (markInheritedUnavailable(creq.toolCallId))
+                return settledAs(settled.ask);
+            return settledAs(markerChannelFullDeny(creq));
+        }
+        settleDenialLimitFallback({ fallback: settled.fallback, mintedHere: settled.mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
+        if (resolved.action !== "allow")
+            return settledAs(resolved);
+        return { kind: "approved", resolved, askWaitMs, classes: askClassMembersOf(judged.classification).classes };
+    };
+    const legStandsIn = (pc) => standsInFor(pc, { chain: ownModChain, onAsk: frozenOnAsk, hookEnv: hookEnvSource, decider: autoModeDecider() }, ownChainJudges);
+    const parentConstraintWrappers = (inheritedParentConstraints ?? []).map((pc) => legStandsIn(pc)
         ? { check: () => ({ action: "allow" }) }
         : policy !== undefined && pc.policy === policy
             ? {
@@ -521,70 +562,24 @@ export async function preparePolicyChain(input) {
                 }
                 if (decision.action !== "ask")
                     return decision;
-                if (isDelegatedQuestion(creq)) {
-                    if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
-                        return decision;
-                    return {
-                        action: "deny",
-                        message: `inherited parent policy requires durable handling of the question raised for "${creq.toolName}" and the marker channel is at capacity — ` +
-                            `denied fail-closed (tighten-only)`,
-                    };
-                }
-                if (pc.durableMandate === true) {
-                    if (mandatedCallFloats(creq.toolCallId))
-                        return decision;
-                    return mandateUnreconstructibleDeny(creq);
-                }
-                const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), route: frozenApproverRoute(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
-                if (judged.kind === "allow")
-                    return judged.result;
-                if (judged.kind === "deny")
-                    return judged.result;
-                const { ask: inheritedAsk, fallback } = judged;
-                if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
-                    recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
-                    return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput, decisionReason: "sandbox" } : { action: "allow", decisionReason: "sandbox" };
-                }
-                const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId, judged);
-                if (arbitrated !== undefined)
-                    return arbitrated;
-                const askT0 = now();
-                const { resolved, judged: settled } = await resolveInheritedAsk(judged, (j) => resolveAsk({
-                    toolName: creq.toolName,
-                    toolCallId: creq.toolCallId,
-                    args: presentedArgs,
-                    ...ruleOffersOf(creq, presentedArgs, ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
-                    ...cardDisclosureOf(j.ask, inheritedAskFallbackMessage(creq.toolName)),
-                    ...askSourceIdentity(),
-                    ...riskAxesOf(creq),
-                    ...approvalCardMemberOf(creq),
-                    ...grantBindingOf(creq, presentedArgs),
-                    ...(j.ask.action === "ask" && j.ask.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                    ...askMandateMember(ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
-                    ...inheritedAskCarry(j, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
-                    ruleEvidence: inheritedAskEvidence,
-                }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), pc.autoMode?.denialTracking, creq, inheritedStationFacts(creq));
-                void settleReadRootGrant(resolved.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
-                const askWaitMs = Math.max(0, now() - askT0);
-                if (resolved.action === "deny" && resolved.approverUnavailable === true) {
-                    if (markInheritedUnavailable(creq.toolCallId))
-                        return settled.ask;
-                    return markerChannelFullDeny(creq);
-                }
-                settleDenialLimitFallback({ fallback: settled.fallback, mintedHere: settled.mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
-                if (resolved.action !== "allow")
-                    return resolved;
+                const settled = await settleInstallationAsk(pc, decision, creq, csignal);
+                if (settled.kind === "settled")
+                    return settled.result;
+                const { resolved } = settled;
                 if (resolved.updatedInput !== undefined) {
                     return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode);
                 }
-                if (pc.preToolUse === undefined) {
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved, askClassMembersOf(judged.classification).classes);
+                if (screeningInstallationsOf([pc]).length === 0) {
+                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, settled.askWaitMs, resolved, settled.classes);
                 }
                 if (decision.updatedInput === undefined)
                     return resolved;
                 return { ...resolved, updatedInput: decision.updatedInput };
             }));
+    const installationToolChecks = inheritedToolChecks(inheritedParentConstraints ?? [], legStandsIn, (pc) => async (ask, creq, csignal) => {
+        const settled = await settleInstallationAsk(pc, ask, creq, csignal);
+        return settled.kind === "settled" ? settled.result : settled.resolved;
+    });
     const rewriteCapableLayers = policy !== undefined || parentConstraintWrappers.length > 0;
     const rewriteEmitterIndex = new Map();
     const rewriteCapableChain = [
@@ -678,7 +673,7 @@ export async function preparePolicyChain(input) {
             return decision;
         })
         : foldedPolicy;
-    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, ruleLaneFacts, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
+    return { basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, ruleLaneFacts, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations, inheritedToolChecks: installationToolChecks };
 }
 const advisedPolicyNames = new WeakMap();
 const ADVISED_KEYS_CAP = 64;

package/dist/core/runner/prepare-project-context.js

@@ -8,6 +8,7 @@ import { defineTool } from "../tools.js";
 import { readFrozenSkillGrants, seedSkillGrants, skillSeatReader } from "../skill-grant.js";
 import { allowedToolsNotGrantedNotice, seedAllowEntryTables } from "../allow-entry.js";
 import { deliverEngineNotice } from "../engine-notice.js";
+import { announceMemoryNotMounted } from "./announce-once-ledger.js";
 import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
 import { skillLoadReading } from "./skill-base-dir.js";
 import { RosterBuilder } from "../tool-roster.js";
@@ -117,11 +118,9 @@ export async function prepareProjectContext(input) {
         const excludedName = SHARED_MEMORY_TOOL_NAMES.find((n) => !toolFaceSnapshot.selector.admits({ name: n }));
         const occupiedName = SHARED_MEMORY_TOOL_NAMES.find((n) => mountedNameDomain.has(n));
         if (excludedName !== undefined || occupiedName !== undefined) {
-            onceLedger.onError(new Error(`Shared memory tools ${SHARED_MEMORY_TOOL_NAMES.join("/")} were NOT mounted: ` +
-                (excludedName !== undefined
-                    ? `the run's tool selector (allowTools / excludeTools) does not admit "${excludedName}"`
-                    : `this task already declares a tool named "${occupiedName}" (the built-in yields to it)`) +
-                " — the pair mounts together or not at all."), { phase: "config", sessionId, classification: "shared-memory-not-mounted" });
+            announceMemoryNotMounted(onceLedger, sessionId, "shared", SHARED_MEMORY_TOOL_NAMES, excludedName !== undefined
+                ? `the run's tool selector (allowTools / excludeTools) does not admit "${excludedName}"`
+                : `this task already declares a tool named "${occupiedName}" (the built-in yields to it)`);
         }
         else {
             roster.mountAll(createSharedMemoryTools({
@@ -137,11 +136,9 @@ export async function prepareProjectContext(input) {
         memoryEnginePairMounted = true;
     }
     else if (memoryEngineSession !== undefined && !memorySearchToolsPlanned) {
-        onceLedger.onError(new Error(`Memory tools ${MEMORY_ENGINE_TOOL_NAMES.join("/")} were NOT mounted: ` +
-            (memoryPairExcludedName !== undefined
-                ? `the run's tool selector (allowTools / excludeTools) does not admit "${memoryPairExcludedName}"`
-                : `this task already declares a tool named "${memoryPairOccupiedName}" (the built-in yields to it)`) +
-            " — these tools mount together or not at all."), { phase: "config", sessionId, classification: "memory-tools-not-mounted" });
+        announceMemoryNotMounted(onceLedger, sessionId, "engine", MEMORY_ENGINE_TOOL_NAMES, memoryPairExcludedName !== undefined
+            ? `the run's tool selector (allowTools / excludeTools) does not admit "${memoryPairExcludedName}"`
+            : `this task already declares a tool named "${memoryPairOccupiedName}" (the built-in yields to it)`);
     }
     const skillsListing = skillSpecs.length > 0
         ? {

package/dist/core/runner/prepare-prompt-assembly.d.ts

@@ -1,37 +1,42 @@
 import type { AgentTool } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
 import { assemblePrompt, type AssembledPrompt } from "../../prompt-assembly/assemble.js";
-import { type PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
-import { type EpochDeclaredSections } from "../../prompt-assembly/epoch.js";
-import { type EnvironmentFacts, type PromptProvider, type PromptTextDeclaration } from "../../prompts/default.js";
+import { type CenterAdoption } from "../../prompt-assembly/artifact.js";
+import { type RunPromptIdentity } from "../../prompt-assembly/epoch.js";
+import type { HostForm, HostRole } from "../../prompt-assembly/catalog/schema.js";
+import type { SourcedOverlay } from "../../prompt-assembly/overlay.js";
+import { type EnvironmentFacts } from "../../prompts/default.js";
+import { type LegModBus } from "../mods/stations.js";
 import { type StoredSession } from "../session.js";
 import type { RunnerDeps } from "../types.js";
 import type { AnnounceOnceSink, Prepared, PrepareResume, PromptFeatureFlags, RunInternals } from "./contracts.js";
-/** The center adoption a run composes under: the artifact and, when the source stamped one, its revision. */
-export type CenterAdoption = {
-    artifact: PromptEpochArtifact;
-    sourceRevision?: string;
-};
 export interface PreparePromptAssemblyInput {
-    /** borrowed-mutable — the acquired session. Read: `getPromptEpoch` (the pin, twice — the center arm and the epoch
-     *  resolution), `getBranch` (the freshness discriminator on the pinless arms). Writer here: `appendPromptEpoch`, the
-     *  ONE pin write of this leg (only when the resolution migrated). The acquire phase and the run loop write it elsewhere. */
+    /** borrowed-mutable — the acquired session. Read: `getPromptEpoch` (the stored record), `getBranch` (the freshness
+     *  discriminator on the record-less arms). Writer here: `appendPromptEpoch`, the ONE record write of this leg (only
+     *  when the run's identity differs from the stored record's). The acquire phase and the run loop write it elsewhere. */
     session: Pick<StoredSession, "getPromptEpoch" | "getBranch" | "appendPromptEpoch">;
-    /** borrowed-readonly — the deployment seats: `promptSource` (the center artifact store and its live candidate), `onError`
-     *  (the assembly's warn channel, the prompt-constitution line, the missing-declaration disclosure). Receiver preserved. */
+    /** borrowed-readonly — the deployment seats: `promptSource` (the center artifact source, its candidate and its
+     *  tri-state), `onError` (the assembly's warn channel). Receiver preserved. */
     deps: Pick<RunnerDeps, "promptSource" | "onError">;
-    /** borrowed-readonly — the trusted spawn-side channel: the parent's center closure (`parentCenterArtifactDigest`,
+    /** borrowed-readonly — the trusted spawn-side channel: the parent's center layer (`parentCenterArtifactDigest`,
      *  `parentCenterSourceRevision`), the top-level freshness facts (`parentTaskId`, `parentSessionId`) and the named-child
      *  fact the teammate flag reads (`explicitAgentName`). */
     internals: Pick<RunInternals, "parentCenterArtifactDigest" | "parentCenterSourceRevision" | "parentTaskId" | "parentSessionId" | "explicitAgentName"> | undefined;
     /** borrowed-readonly — the resume leg, or undefined; PRESENCE only (a resumed leg is never truly fresh). */
     resume: Pick<PrepareResume, "seed"> | undefined;
-    /** borrowed-readonly — the resolved prompt provider (compared against the default for `isDefaultProvider`). */
-    provider: PromptProvider;
-    /** borrowed-readonly — the caller's role-layer prompt, or undefined. */
-    userSystemPrompt: string | undefined;
-    /** borrowed-readonly — the caller's appended prompt, or undefined. */
-    userAppendSystemPrompt: string | undefined;
+    /** borrowed-readonly — the request-body sugar's overlays (the task class's first contributions). */
+    sugar: readonly SourcedOverlay[];
+    /** borrowed-readonly — the host selector values (`promptRole` / `promptForm`). */
+    host: {
+        readonly role?: HostRole;
+        readonly form?: HostForm;
+    };
+    /** borrowed-readonly — the center binding (`TaskSpec.promptBinding`, validated), or undefined. */
+    binding: string | undefined;
+    /** borrowed-readonly — the leg's mods bus: `prompt.compose` collects the deploy and task seats' overlays. */
+    modBus: LegModBus;
+    /** borrowed-readonly — the run's abort signal (the compose raise ends with it). */
+    signal?: AbortSignal;
     /** borrowed-readonly — the harness-context flags; the two orchestration flags are re-derived against the post-exclusion
      *  roster at assembly. */
     featureFlags: PromptFeatureFlags;
@@ -49,47 +54,47 @@ export interface PreparePromptAssemblyInput {
     /** borrowed-readonly — the run's ONE tool roster, read only: the assembly receives DETACHED copies, the audit and the
      *  manifest read it in place. Never mutated here. */
     tools: readonly AgentTool[];
-    /** borrowed-readonly — the task model; only `promptGuidance` (the model-guidance section). */
-    model: Pick<Model, "promptGuidance">;
+    /** borrowed-readonly — the task model: `promptGuidance` (the model-guidance section) and `id` (the compose event's `model`). */
+    model: Pick<Model, "id" | "promptGuidance">;
     /** borrowed-readonly — the acquired session id (every operator line's attribution). */
     sessionId: string;
-    /** borrowed-readonly — the session's reminder provenance mark (the declaration the assembled prompt must render). */
-    reminderMark: string;
     /** borrowed-readonly — the once-per-session ledger's operator sink (the collision audit's two lines). */
     onceLedger: Pick<AnnounceOnceSink, "onError">;
 }
 export interface PreparePromptAssemblyResult {
     /** borrowed-mutable — the LIVE system prompt (an accessor cell over this phase's closure variable). Writers: this
      *  phase's `renderWithDate` (the date re-render, called by the listings phase's date_change seam); the turn-wiring
-     *  phase's center candidate `apply` (the compaction-boundary swap). Readers: the harness construction, the cache
+     *  phase's center candidate `apply` (the compaction-boundary change). Readers: the harness construction, the cache
      *  fingerprint, the turn snapshot's stable text, the prompt-overhead term. */
     systemPromptSeat: {
         current: string;
     };
-    /** owned — the date re-render, or undefined for a provider whose assembly cannot re-render. Returns the new prompt and
-     *  writes it into `systemPromptSeat`. */
+    /** owned — the date re-render. Returns the new prompt and writes it into `systemPromptSeat`. */
     renderWithDate: ((date: string) => string) | undefined;
-    /** owned — the physical block face of the assembled prompt, or undefined (the harness's systemBlocks and the turn
-     *  snapshot's layout groups). */
+    /** owned — the physical block face of the assembled prompt (the harness's systemBlocks and the turn snapshot's
+     *  layout groups). */
     systemBlocks: AssembledPrompt["systemBlocks"];
     /** borrowed-mutable — the composition manifest (`Prepared.promptManifest`). Writers after this phase: the tool-disclosure
      *  phase writes `toolDisclosure` (when deferred tools exist); the turn-wiring phase backfills `snapshot` and `lowering`
      *  once the final wire tool list exists. */
     promptManifest: Prepared["promptManifest"];
-    /** owned — the provider-declared sections in the epoch shape (id, slot, chars, opt-in contentHash; never text). */
-    epochDeclaredSections: EpochDeclaredSections;
-    /** owned — the resolved epoch's artifact digest, the turn snapshot's identity element. */
-    epochArtifactDigestForSnapshot: string;
-    /** owned — the re-invokable assemble-inputs BUILDER: the compaction-boundary candidate re-assembles with a new
-     *  artifact's declarations through it (facts and tails identical; only the center closure differs). */
-    buildAssembleInputs: (centerDecls?: PromptTextDeclaration[]) => Parameters<typeof assemblePrompt>[0];
+    /** owned — the run's identity inputs and the pinned center layer's provenance (`Prepared.promptIdentity`; the
+     *  compaction-boundary candidate replaces it after a committed center change). */
+    promptIdentity: RunPromptIdentity;
+    /** owned — the re-invokable assemble-inputs BUILDER: the compaction-boundary candidate re-assembles with a new center
+     *  layer through it (facts, tails and the run-frozen mods overlays identical; only the center class differs). */
+    buildAssembleInputs: (center: CenterAdoption | undefined) => Parameters<typeof assemblePrompt>[0];
+    /** owned — the identity inputs under another center layer (the compaction-boundary candidate's record). */
+    identityFor: (center: CenterAdoption | undefined) => RunPromptIdentity;
+    /** owned — whether this run adopts center candidates at its boundaries: a top-level run does; a child composes its
+     *  parent's layer and never adopts one of its own. */
+    adoptsCandidates: boolean;
     /** borrowed-mutable — the LIVE center adoption (an accessor cell over this phase's closure variable), or undefined.
-     *  Writers: this phase (the three arms; the all-shadowed drop on the fresh arm); the turn-wiring phase's center
-     *  candidate `apply` (the boundary swap / the explicit-disable rollback). Readers: the two late-bound ctx getters
-     *  (inherited-gate, caps-and-workflow), the pin write, the candidate's same-artifact test. */
+     *  Writers: this phase (the resolution arms); the turn-wiring phase's center candidate `apply` (the boundary change).
+     *  Readers: the two late-bound ctx getters (inherited-gate, caps-and-workflow), the candidate's same-artifact test. */
     centerAdoptionRef: {
         current: CenterAdoption | undefined;
     };
 }
-/** The M13 phase body — prepareTask's prompt-assembly stretch, verbatim (see the module header). */
+/** The M13 phase body — prepareTask's prompt-assembly stretch (see the module header). */
 export declare function preparePromptAssembly(input: PreparePromptAssemblyInput): Promise<PreparePromptAssemblyResult>;