@sema-agent/core 7.51.2 → 7.52.0

package/dist/core/gate-lanes.js

@@ -1,6 +1,6 @@
 import { withArgsReading } from "./effective-path-target.js";
-import { attest, attestationOf, decisionText, refuseOutOfContractDecision } from "./tool-policy.js";
-import { arbitrateByMode, classifyAsk, fileCommandOptionsSentence, persistedRuleMandateOf, ruleClearanceOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
+import { attest, attestationOf, decisionText, foldHookAsk, ownArgs, refusalOf, refuseOutOfContractDecision } from "./tool-policy.js";
+import { arbitrateByMode, classifyAsk, decisionAskClassesOf, fileCommandOptionsSentence, persistedRuleMandateOf, ruleClearanceOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
 import { classifierParseFailureDenyMessage, denialLimitFallbackMessage, rungDidNotRule, unarmedWindow } from "./auto-mode.js";
 import { classifierNoRulingArm, settleNoRulingAsk } from "./classifier-unavailable-arm.js";
 import { SETTLEMENT_NOBODY_JUDGED } from "./gate-outcome.js";
@@ -17,11 +17,13 @@ import { callFaceSeat } from "./tool-roster.js";
 import { heldBy, wireOf } from "./tool-name-readings.js";
 import { asksUnstated, modeAcceptsFileCommand, permissionSeatAt, unstatedAskMessage } from "./mode-policy.js";
 import { ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON } from "./permission-rule-org.js";
-import { exitGate, passAskFace } from "./runner/gate-exit.js";
+import { exitGate, passAskFace, unownedArgsMessage } from "./runner/gate-exit.js";
 import { readOrgRuleLane, readPersistedRuleLane } from "./rule-lane-reads.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, withGateTimeout } from "./gate-bounded-await.js";
 import { readStationAnswer } from "./shell-read-silence.js";
+import { agentIdOf, judgedInputOf, raiseToolCheck } from "./mods/stations.js";
+import { readToolChecks } from "./tool-check-reading.js";
 import { policyThrowLine, reportPolicyThrow } from "./runner/policy-throw.js";
 const QUESTION_TOOL_NAMES = new Set([ASK_USER_QUESTION_TOOL_NAME]);
 function parkWith(suspendAsk, parkArgs, carry) {
@@ -34,6 +36,38 @@ export async function runGateLanes(pass) {
     const boundedAwaitDeadlineMs = createGateDeadline(input, notifier);
     let orgRealApprovalRequired = false;
     let markedThisRound;
+    let approvedWithArgs = false;
+    let carriedOwnAsk;
+    const takeApprovedEdit = (read) => {
+        carriedOwnAsk = read.outstanding ?? (pass.decision.action === "ask" ? pass.decision : undefined);
+        pass.decision = read.allow;
+        approvedWithArgs = true;
+    };
+    const safetyOf = (d) => safetyAxisOf({ egress: input.egress, shellGated: input.shellGated, irreversibility: input.irreversibility, probeMandated: d.action === "ask" && d.probeMandated === true, probeUnanswered: pass.probeUnanswered === true, tightened: pass.tightenedBy });
+    const realApprovalOf = (d, org) => {
+        if (d.action !== "ask" || d.requiresRealApproval !== true)
+            return undefined;
+        if (d.origin === undefined)
+            throw new Error(`a real-approval ask for "${toolName}" reached a park site with no origin word — the origin stamp precedes every park`);
+        return { origin: d.origin, ...(org !== undefined ? { org } : {}) };
+    };
+    const carryOf = (d) => ({
+        ...(callSignal !== undefined ? { signal: callSignal } : {}),
+        ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
+        ...(d.action === "ask" && d.classifierNoRuling !== undefined ? { classifierNoRuling: d.classifierNoRuling } : {}),
+        ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
+        ...(d.action === "ask" && d.askClass !== undefined && d.classes !== undefined ? { askClass: d.askClass, classes: d.classes } : {}),
+        ...(d.action === "ask" && d.mandated === true ? { mandated: true, ...(d.mandate !== undefined ? { mandate: d.mandate } : {}) } : {}),
+        ...(d.action === "ask" && d.authoredBy === "deployment" ? { authoredBy: "deployment" } : {}),
+    });
+    const parkAsk = async (d, req, args, safety, liveFaceUnavailable, org) => {
+        if (suspendAsk === undefined || d.action !== "ask")
+            return undefined;
+        const suspended = await parkWith(suspendAsk, [req, args, safety, liveFaceUnavailable, realApprovalOf(d, org), d.allowRuleShadowed, d.decisionReason, d.probeReason, d.probeCause, d.segmentCoverage, d.matchedAskRule, d.probeMandated], carryOf(d));
+        if (suspended && "parkFailed" in suspended)
+            pass.parkFailed = suspended.parkFailed;
+        return suspended && !("parkFailed" in suspended) ? { suspend: suspended, preToolContext: pass.preToolContext } : undefined;
+    };
     const markedUnresolvable = () => (markedThisRound ??= input.isMarkedUnresolvable?.(input.event.toolCallId) === true);
     const mandateMarksNow = () => ({
         egress: input.egress,
@@ -75,7 +109,7 @@ export async function runGateLanes(pass) {
         if (wireOf("lanes.orgContentAskExemption", pass.req) === ASK_USER_QUESTION_TOOL_NAME && input.orgRules.contentAskToolMounted === true)
             return { decision: current, org: undefined };
         let decided = current;
-        const answer = await readOrgRuleLane(input.orgRules, { toolName, args, toolCallId, ...callFaceSeat(pass.req.face) }, input.abortSignal);
+        const answer = await readOrgRuleLane(input.orgRules, Object.freeze({ toolName, args, toolCallId, ...callFaceSeat(pass.req.face) }), input.abortSignal);
         if (answer.status === "unavailable") {
             orgEvidence = { revisionAbsent: "unavailable", ruleAbsent: "unavailable" };
             orgRealApprovalRequired = true;
@@ -103,7 +137,7 @@ export async function runGateLanes(pass) {
             orgTightenCount += 1;
             pass.deniedBy = "org";
             pass.denyCause = undefined;
-            return { decision: { action: "deny", message: `an organization policy rule (${rule}) denies this call`, decisionReason: ORG_RULE_DECISION_REASON }, org: undefined };
+            return { decision: refusalOf({ action: "deny", message: `an organization policy rule (${rule}) denies this call`, decisionReason: ORG_RULE_DECISION_REASON }, args), org: undefined };
         }
         if (decided.action === "deny")
             return { decision: decided, org: undefined };
@@ -120,33 +154,75 @@ export async function runGateLanes(pass) {
             org: "rule",
         };
     };
-    const orgAnswer = await applyOrgLayer(pass.decision, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput);
+    const finalArgs = pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput;
+    if (pass.decision.action === "deny")
+        pass.decision = refusalOf(pass.decision, finalArgs);
+    const orgAnswer = await applyOrgLayer(pass.decision, finalArgs);
     pass.decision = orgAnswer.decision;
     const readPersistedRules = (req) => readPersistedRuleLane(input.persistedRules, req, input.abortSignal);
     const reread = pass.policyRewrite !== undefined ? withArgsReading(pass.req, pass.policyRewrite, pass.callSignal ?? input.abortSignal) : undefined;
-    const laneReq = reread !== undefined ? await reread : { ...pass.req, ...(pass.policyRewrite !== undefined ? { args: pass.policyRewrite } : {}) };
+    const laneReq = Object.freeze(reread !== undefined ? await reread : { ...pass.req, ...(pass.policyRewrite !== undefined ? { args: pass.policyRewrite } : {}) });
     const laneAnswer = input.persistedRules !== undefined && wireOf("lanes.persistedLaneSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME ? await readPersistedRules(laneReq) : undefined;
     {
         const tightened = applyPersistedTightening(pass.decision, laneAnswer, laneReq);
-        pass.decision = tightened.decision;
+        pass.decision = tightened.tightened === "deny" ? refusalOf(tightened.decision, laneReq.args) : tightened.decision;
         if (tightened.tightened === "deny")
             pass.deniedBy = "persisted_rule";
         if (tightened.tightened === "deny")
             pass.denyCause = undefined;
         const skillRefusal = pass.decision.action === "deny" ? undefined : skillRowRefusal(input.skillGrants, laneReq);
         if (skillRefusal !== undefined) {
-            pass.decision = skillRefusal;
+            pass.decision = refusalOf(skillRefusal, laneReq.args);
             pass.deniedBy = "policy";
             pass.denyCause = undefined;
         }
     }
+    let settledRefusal;
+    const checkTool = async (standing, args, org, rewrite, mayClear) => {
+        const agentId = agentIdOf(input.identity);
+        const ceiling = org !== undefined ? { ceiling: "ask" } : {};
+        const e = { tool: toolName, input: judgedInputOf(args), tool_use_id: toolCallId, ...(agentId !== undefined ? { agentId } : {}), ...ceiling };
+        const signal = callSignal ?? input.abortSignal;
+        const own = input.modBus;
+        settledRefusal = undefined;
+        const settleThroughLedger = (settle) => async (ask, call, sig) => {
+            const read = ledger.fromDecision(await settle(ask, call, sig));
+            if (read.decision.action === "deny")
+                settledRefusal = { deniedBy: read.deniedBy ?? "policy", cause: ledger.causeOf(read.decision) };
+            return read.decision;
+        };
+        const chains = [
+            ...(own !== undefined ? [{ raise: (p) => raiseToolCheck(own, { ...e }, p, signal), ...(mayClear !== undefined ? { mayClear } : {}) }] : []),
+            ...(input.inheritedToolChecks ?? []).map((c) => ({ raise: (p) => raiseToolCheck(c.bus, { ...e }, p, signal, c.judges), settle: settleThroughLedger(c.settle) })),
+        ];
+        const project = (current, clears) => {
+            const reason = decisionText(current);
+            const said = reason !== undefined ? { reason } : {};
+            return current.action === "ask" ? { decision: "ask", ...said, classes: [...(current.classes ?? [])], mandated: clears?.() !== true, ...ceiling } : { decision: "allow", ...said, ...ceiling };
+        };
+        return await readToolChecks(chains, standing, { toolName, judged: args, rewrite, request: Object.freeze({ ...pass.req, args }), signal }, project);
+    };
+    const refuseByExtension = (deny) => {
+        pass.decision = deny;
+        pass.deniedBy = settledRefusal?.deniedBy ?? "hook";
+        pass.denyCause = settledRefusal?.cause;
+    };
+    if (pass.decision.action === "allow") {
+        const read = await checkTool(pass.decision, finalArgs, orgAnswer.org, pass.policyRewrite);
+        if (read !== undefined)
+            pass.toolCheckRaised = true;
+        if (read?.kind === "denied")
+            refuseByExtension(read.deny);
+        else if (read?.kind === "asked")
+            pass.decision = read.ask;
+        else if (read?.kind === "approved")
+            takeApprovedEdit(read);
+    }
     if (pass.decision.action === "ask") {
         pass.decision = { ...pass.decision };
         if (pass.policyRewrite !== undefined) {
             pass.currentInput = pass.policyRewrite;
-            pass.req.args = pass.policyRewrite;
-            if (laneReq.targetReading !== undefined)
-                pass.req.targetReading = laneReq.targetReading;
+            pass.req = Object.freeze({ ...pass.req, args: pass.policyRewrite, ...(laneReq.targetReading !== undefined ? { targetReading: laneReq.targetReading } : {}) });
         }
         const ruleMayClear = () => ruleClearanceOf(pass.decision.action === "ask" ? pass.decision : undefined, mandateMarksNow()).ruleMayClear;
         const classMayClear = () => pass.decision.action === "ask" && classifyAsk(pass.decision, askOriginFacts(orgAnswer.org, laneAnswer)).row.ruleMayClear;
@@ -194,7 +270,7 @@ export async function runGateLanes(pass) {
         });
         const storedAllows = laneAnswer?.hit?.behavior === "allow" ? laneAnswer.hit.rules : undefined;
         const members = [
-            ["hook", () => (pass.hookAllowed === true && pass.policyRewrite === undefined ? { entries: [], clear: () => ({ action: "allow", message: "a PreToolUse hook allowed this call", decisionReason: "hook" }), afterClear: async () => undefined } : undefined)],
+            ["hook", () => (pass.hookAllowedBy !== undefined && pass.policyRewrite === undefined ? { entries: pass.hookAllowedBy, clear: () => ({ action: "allow", message: "a PreToolUse hook allowed this call", decisionReason: "hook" }), afterClear: async () => undefined } : undefined)],
             ["deployment", () => {
                     const hit = input.deploymentAllows?.allowing(pass.req, mode);
                     return hit && { entries: hit.entries, clear: () => listAllow("deployment_rule", "the deployment's", hit.entries), afterClear: () => notifier.notifyAsync(() => input.deploymentAllows?.onAllowed?.({ toolName: pass.req.toolName, toolCallId, entries: hit.entries }), "toolGate.allowedToolsResolved") };
@@ -268,6 +344,24 @@ export async function runGateLanes(pass) {
                 pass.decision = { ...pass.decision, message: CD_GIT_COMPOUND_SENTENCE };
             }
         }
+        if (pass.toolCheckRaised !== true && pass.decision.action !== "deny") {
+            const read = await checkTool(pass.decision, pass.currentInput, orgAnswer.org, pass.policyRewrite, () => allowLayerMayClear() && ruleMayClear() && classMayClear());
+            if (read?.kind === "denied")
+                refuseByExtension(read.deny);
+            else if (read?.kind === "cleared")
+                pass.decision = read.allow;
+            else if (read?.kind === "asked") {
+                const asked = read.minted ? { ...read.ask, ruleEvidence: mintRuleEvidence(personalEvidence) } : read.ask;
+                if (read.marked === true)
+                    markedThisRound = undefined;
+                const facts = read.marked === true ? askOriginFacts(orgAnswer.org, laneAnswer) : originFacts;
+                pass.decision = stampAskOrigin(asked, facts, classifyStanding(asked, facts));
+            }
+            else if (read?.kind === "shadowed" && pass.decision.action === "ask")
+                pass.decision = { ...pass.decision, allowRuleShadowed: [...(pass.decision.allowRuleShadowed ?? []), ...read.shadows] };
+            else if (read?.kind === "approved")
+                takeApprovedEdit(read);
+        }
         if (pass.decision.action === "ask")
             ledger.supersede();
         if (input.autoMode && pass.decision.action === "ask" && pass.decision.origin !== undefined && pass.askClassification?.row.classifierEligible === true && (input.permissionMode === undefined || input.permissionMode() === "auto")) {
@@ -296,7 +390,7 @@ export async function runGateLanes(pass) {
                     pass.classifierRound = undefined;
                 }
                 else if (arm?.kind === "denied")
-                    pass.decision = arm.deny;
+                    pass.decision = refusalOf(arm.deny, finalArgs);
                 else {
                     const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
                     const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
@@ -310,7 +404,7 @@ export async function runGateLanes(pass) {
                             message: verdict.kind === "block" ? `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : reason,
                             decisionReason: "classifier",
                         };
-                        pass.decision = verdict.kind === "parse_error" ? attest(denied, pass.req, { classifierCause: "parse_error" }) : denied;
+                        pass.decision = refusalOf(verdict.kind === "parse_error" ? attest(denied, pass.req, { classifierCause: "parse_error" }) : denied, finalArgs);
                     }
                 }
             }
@@ -373,86 +467,46 @@ export async function runGateLanes(pass) {
                 pass.arbitration = verdict;
                 pass.deniedBy = "mode";
                 pass.denyCause = undefined;
-                pass.decision = {
+                pass.decision = refusalOf({
                     action: "deny",
                     message: verdict.mode === "dontAsk"
                         ? `refused by the dontAsk permission mode: this call needed approval (${verdict.askClass}) and the mode answers no ask; run under a mode with an approver, or change the call`
                         : `refused by the bypassPermissions permission mode: the write-protection judge could not resolve this write's target, and with nobody to ask the mode refuses rather than releases it`,
                     decisionReason: "mode",
-                };
+                }, finalArgs);
             }
         }
-        const safety = safetyAxisOf({
-            egress: input.egress,
-            shellGated: input.shellGated,
-            irreversibility: input.irreversibility,
-            probeMandated: pass.decision.action === "ask" && pass.decision.probeMandated === true,
-            probeUnanswered: pass.probeUnanswered === true,
-            tightened: pass.tightenedBy,
-        });
-        const realApprovalOf = (d) => {
-            if (d.action !== "ask" || d.requiresRealApproval !== true)
-                return undefined;
-            if (d.origin === undefined)
-                throw new Error(`a real-approval ask for "${toolName}" reached a park site with no origin word — the origin stamp precedes every park`);
-            return { origin: d.origin, ...(originFacts.org !== undefined ? { org: originFacts.org } : {}) };
-        };
-        const carryOf = (d) => ({
-            ...(callSignal !== undefined ? { signal: callSignal } : {}),
-            ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
-            ...(d.action === "ask" && d.classifierNoRuling !== undefined ? { classifierNoRuling: d.classifierNoRuling } : {}),
-            ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
-            ...(d.action === "ask" && d.askClass !== undefined && d.classes !== undefined ? { askClass: d.askClass, classes: d.classes } : {}),
-            ...(d.action === "ask" && d.mandated === true ? { mandated: true, ...(d.mandate !== undefined ? { mandate: d.mandate } : {}) } : {}),
-            ...(d.action === "ask" && d.authoredBy === "deployment" ? { authoredBy: "deployment" } : {}),
-        });
+        const safety = safetyOf(pass.decision);
         if (suspendAsk && pass.decision.action === "ask") {
-            const parkArgs = [pass.req, pass.currentInput, safety, undefined, realApprovalOf(pass.decision), pass.decision.action === "ask" ? pass.decision.allowRuleShadowed : undefined, pass.decision.action === "ask" ? pass.decision.decisionReason : undefined, pass.decision.action === "ask" ? pass.decision.probeReason : undefined, pass.decision.action === "ask" ? pass.decision.probeCause : undefined, pass.decision.action === "ask" ? pass.decision.segmentCoverage : undefined, pass.decision.action === "ask" ? pass.decision.matchedAskRule : undefined, pass.decision.action === "ask" ? pass.decision.probeMandated : undefined];
-            const suspended = await parkWith(suspendAsk, parkArgs, carryOf(pass.decision));
-            if (suspended) {
-                if ("parkFailed" in suspended)
-                    pass.parkFailed = suspended.parkFailed;
-                else
-                    return { suspend: suspended, preToolContext: pass.preToolContext };
-            }
+            const parked = await parkAsk(pass.decision, pass.req, pass.currentInput, safety, undefined, originFacts.org);
+            if (parked)
+                return parked;
         }
         if (pass.decision.action === "ask" && wireOf("lanes.contentAskRoute", pass.req) === ASK_USER_QUESTION_TOOL_NAME) {
             const outcome = input.resolveContentAsk !== undefined ? await (callSignal !== undefined ? input.resolveContentAsk(pass.req, callSignal) : input.resolveContentAsk(pass.req)) : { kind: "unavailable", parkDeclined: false };
             if (outcome.kind === "answered") {
-                pass.decision = { action: "allow", updatedInput: outcome.presentedInput };
+                pass.decision = { action: "allow" };
             }
             else if (outcome.kind === "unavailable") {
-                if (outcome.presentedInput !== undefined) {
-                    pass.currentInput = outcome.presentedInput;
-                    pass.req.args = outcome.presentedInput;
-                }
                 if (suspendAsk && outcome.parkDeclined && pass.parkFailed === undefined) {
-                    const parkArgs = [pass.req, pass.currentInput, safety, true, realApprovalOf(pass.decision), pass.decision.action === "ask" ? pass.decision.allowRuleShadowed : undefined, pass.decision.action === "ask" ? pass.decision.decisionReason : undefined, pass.decision.action === "ask" ? pass.decision.probeReason : undefined, pass.decision.action === "ask" ? pass.decision.probeCause : undefined, pass.decision.action === "ask" ? pass.decision.segmentCoverage : undefined, pass.decision.action === "ask" ? pass.decision.matchedAskRule : undefined, pass.decision.action === "ask" ? pass.decision.probeMandated : undefined];
-                    const suspended = await parkWith(suspendAsk, parkArgs, carryOf(pass.decision));
-                    if (suspended) {
-                        if ("parkFailed" in suspended)
-                            pass.parkFailed = suspended.parkFailed;
-                        else
-                            return { suspend: suspended, preToolContext: pass.preToolContext };
-                    }
+                    const parked = await parkAsk(pass.decision, pass.req, pass.currentInput, safety, true, originFacts.org);
+                    if (parked)
+                        return parked;
                 }
                 if (pass.decision.origin === undefined)
                     throw new Error(`the content ask for "${toolName}" reached its refusal without an origin word`);
                 ledger.set({ settlement: { kind: input.resolveContentAsk !== undefined ? "approver_unavailable" : "no_approver", who: { party: "none" }, when: Date.now() }, origin: pass.decision.origin });
                 pass.deniedBy = "ask_resolution";
-                pass.decision = {
+                pass.decision = refusalOf({
                     action: "deny",
                     message: "AskUserQuestion could not be parked for a durable human answer on this path (no checkpoint " +
                         "facility, or the suspend failed) and a synchronous permission approver cannot carry an answer — " +
                         "the question was NOT shown to anyone. Proceed with your best judgment and state the assumption " +
                         "you made.",
-                };
+                }, finalArgs);
             }
             else {
-                if (outcome.presentedInput !== undefined)
-                    pass.decision = { action: "allow", updatedInput: outcome.presentedInput };
-                else
-                    pass.decision = { action: "allow" };
+                pass.decision = { action: "allow" };
             }
         }
         if (pass.decision.action === "ask") {
@@ -467,16 +521,11 @@ export async function runGateLanes(pass) {
             resolved = ledger.fromResolved(resolved, askBeforeResolve, pass.req);
             if (resolved.action === "deny")
                 pass.deniedBy = "ask_resolution";
-            pass.decision = resolved;
+            pass.decision = resolved.action === "deny" ? refusalOf(resolved, finalArgs) : resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && pass.parkFailed === undefined) {
-                const parkArgs = [pass.req, pass.currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.allowRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeMandated : undefined];
-                const suspended = await parkWith(suspendAsk, parkArgs, carryOf(askBeforeResolve));
-                if (suspended) {
-                    if ("parkFailed" in suspended)
-                        pass.parkFailed = suspended.parkFailed;
-                    else
-                        return { suspend: suspended, preToolContext: pass.preToolContext };
-                }
+                const parked = await parkAsk(askBeforeResolve, pass.req, pass.currentInput, safety, true, originFacts.org);
+                if (parked)
+                    return parked;
             }
             if (askBeforeResolve.action === "ask" && askBeforeResolve.denialLimitFallback !== undefined) {
                 if (pass.decision.action === "allow") {
@@ -493,211 +542,248 @@ export async function runGateLanes(pass) {
                     }
                 }
             }
-            if (pass.decision.action === "allow" && pass.decision.updatedInput !== undefined) {
-                let editArgs = pass.decision.updatedInput;
-                let editDenied;
-                let editRewrittenSinceHuman = false;
-                for (let round = 0;; round++) {
-                    if (round >= 3) {
-                        editDenied = {
-                            action: "deny",
-                            message: `the approval-edit chain for "${toolName}" exceeded the re-approval cap — denied fail-closed; re-submit the edited action directly`,
-                        };
-                        pass.deniedBy = "policy";
-                        break;
-                    }
-                    if (screening !== undefined) {
-                        let hr;
-                        let hrUnanswered;
-                        try {
-                            const seat = await screening.screen(editArgs);
-                            if (seat.expired)
-                                hrUnanswered = seat.cause;
-                            else
-                                hr = screening.screened(seat.value);
-                        }
-                        catch (err) {
-                            traceHookCrash(input, err, notifier);
-                            editDenied = { action: "deny", message: screening.crashReason(`the approved edit for "${toolName}"`, err) };
-                            pass.deniedBy = "hook";
-                            break;
-                        }
-                        if (hrUnanswered !== undefined) {
-                            editDenied = { action: "deny", message: await screening.unansweredReason(`the approved edit for "${toolName}"`, hrUnanswered) };
-                            pass.deniedBy = "hook";
-                            break;
-                        }
-                        if (hr) {
-                            if (hr.additionalContext)
-                                pass.preToolContext.push(hr.additionalContext);
-                            if (hr.action === "deny") {
-                                editDenied = { action: "deny", message: decisionText(hr) ?? `the approved edit for "${toolName}" was blocked by a PreToolUse hook` };
-                                pass.deniedBy = "hook";
-                                break;
-                            }
-                            if (hr.action === "ask") {
-                                editDenied = {
-                                    action: "deny",
-                                    message: `the approved edit for "${toolName}" raises a new PreToolUse approval requirement the original approval does not cover — denied fail-closed; re-submit the edited action directly`,
-                                };
-                                pass.deniedBy = "hook";
-                                break;
-                            }
-                            if (hr.updatedInput !== undefined) {
-                                editArgs = hr.updatedInput;
-                                editRewrittenSinceHuman = true;
-                            }
-                        }
-                    }
-                    let recheck = { action: "allow" };
-                    if (adjudicate) {
-                        try {
-                            const editReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
-                            recheck = refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(editReq, callSignal) : adjudicate(editReq)));
-                        }
-                        catch (err) {
-                            reportPolicyThrow((e) => traceHookCrash(input, e, notifier), "the tool policy's re-check of the approved edit", { toolName, toolCallId }, err, callSignal ?? input.abortSignal);
-                            recheck = {
-                                action: "deny",
-                                message: `policy re-check of the approved edit for "${toolName}" errored: ${policyThrowLine(err)}`,
-                            };
-                        }
-                    }
-                    {
-                        const attributed = ledger.classifierRoundOf(recheck);
-                        if (attributed !== undefined)
-                            pass.classifierRound = attributed;
-                        const read = ledger.fromDecision(recheck);
-                        recheck = read.decision;
-                        if (recheck.action === "deny" && read.deniedBy !== undefined) {
-                            editDenied = recheck;
-                            pass.deniedBy = read.deniedBy;
-                            pass.denyCause = ledger.causeOf(recheck);
-                            break;
-                        }
-                    }
-                    if (recheck.updatedInput !== undefined) {
-                        editArgs = recheck.updatedInput;
-                        editRewrittenSinceHuman = true;
-                    }
-                    const editOrg = await applyOrgLayer(recheck, editArgs);
-                    recheck = editOrg.decision;
-                    if (recheck.action === "deny") {
-                        editDenied = recheck;
-                        break;
-                    }
-                    let editLane;
-                    const editReread = withArgsReading(pass.req, editArgs, callSignal ?? input.abortSignal);
-                    const editLaneReq = editReread !== undefined ? await editReread : { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
-                    if (input.persistedRules !== undefined && wireOf("lanes.persistedEditSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME) {
-                        editLane = await readPersistedRules(editLaneReq);
-                        const editTightened = applyPersistedTightening(recheck, editLane, editLaneReq);
-                        recheck = editTightened.decision;
-                        if (editTightened.tightened === "deny")
-                            pass.deniedBy = "persisted_rule";
-                        if (recheck.action === "deny") {
-                            editDenied = recheck;
-                            break;
-                        }
-                    }
-                    const editSkillRefusal = skillRowRefusal(input.skillGrants, editLaneReq);
-                    if (editSkillRefusal !== undefined) {
-                        editDenied = editSkillRefusal;
-                        pass.deniedBy = "policy";
+            approvedWithArgs = pass.decision.action === "allow" && pass.decision.updatedInput !== undefined;
+        }
+    }
+    if (approvedWithArgs && pass.decision.action === "allow" && pass.decision.updatedInput !== undefined) {
+        let editArgs = pass.decision.updatedInput;
+        let editDenied;
+        let editRewrittenSinceHuman = false;
+        let unanswered;
+        const refusedAtResolution = (d) => { editDenied = d; pass.deniedBy = "ask_resolution"; };
+        for (let round = 0;; round++) {
+            const taken = ownArgs(editArgs);
+            if (!taken.ok) {
+                editDenied = { action: "deny", message: unownedArgsMessage(`the approved edit for "${toolName}"`, taken.reason) };
+                pass.deniedBy = "policy";
+                break;
+            }
+            editArgs = taken.value;
+            if (round >= 3) {
+                editDenied = {
+                    action: "deny",
+                    message: `the approval-edit chain for "${toolName}" exceeded the re-approval cap — denied fail-closed; re-submit the edited action directly`,
+                };
+                pass.deniedBy = "policy";
+                break;
+            }
+            let editHookAsk;
+            if (screening !== undefined) {
+                const screened = await screening.screen(editArgs, `the approved edit for "${toolName}"`);
+                if (screened.kind === "refused") {
+                    editDenied = { action: "deny", message: screened.reason };
+                    pass.deniedBy = "hook";
+                    break;
+                }
+                const hr = screened.answer;
+                if (hr) {
+                    if (hr.additionalContext)
+                        pass.preToolContext.push(hr.additionalContext);
+                    if (hr.action === "deny") {
+                        editDenied = { action: "deny", message: decisionText(hr) ?? `the approved edit for "${toolName}" was blocked by a PreToolUse hook` };
+                        pass.deniedBy = "hook";
                         break;
                     }
-                    if (recheck.action === "allow") {
-                        if (recheck.updatedInput !== undefined) {
-                            editArgs = recheck.updatedInput;
-                            editRewrittenSinceHuman = true;
-                        }
-                        if (!editRewrittenSinceHuman || !asksUnstated(recheck, permissionSeatAt(input, editArgs)?.seat, input.permissionMode?.()))
-                            break;
-                        recheck = { action: "ask", message: permissionSeatAt(input, editArgs)?.question ?? unstatedAskMessage(toolName) };
-                        pass.tightenedBy = "unstated";
+                    if (hr.action === "ask") {
+                        const { updatedInput: _adopted, ...ask } = hr;
+                        editHookAsk = ask;
                     }
-                    if (recheck.updatedInput !== undefined) {
-                        editArgs = recheck.updatedInput;
+                    if (hr.updatedInput !== undefined) {
+                        editArgs = hr.updatedInput;
                         editRewrittenSinceHuman = true;
                     }
-                    const editAskSnapshot = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
+                }
+            }
+            let recheck = { action: "allow" };
+            if (adjudicate) {
+                try {
+                    const editReq = Object.freeze({ toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
+                    recheck = refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(editReq, callSignal) : adjudicate(editReq)));
+                }
+                catch (err) {
+                    reportPolicyThrow((e) => traceHookCrash(input, e, notifier), "the tool policy's re-check of the approved edit", { toolName, toolCallId }, err, callSignal ?? input.abortSignal);
+                    recheck = {
+                        action: "deny",
+                        message: `policy re-check of the approved edit for "${toolName}" errored: ${policyThrowLine(err)}`,
+                    };
+                }
+            }
+            {
+                const attributed = ledger.classifierRoundOf(recheck);
+                if (attributed !== undefined)
+                    pass.classifierRound = attributed;
+                const read = ledger.fromDecision(recheck);
+                recheck = read.decision;
+                if (recheck.action === "deny" && read.deniedBy !== undefined) {
+                    editDenied = recheck;
+                    pass.deniedBy = read.deniedBy;
+                    pass.denyCause = ledger.causeOf(recheck);
+                    break;
+                }
+            }
+            if (recheck.updatedInput !== undefined) {
+                editArgs = recheck.updatedInput;
+                editRewrittenSinceHuman = true;
+            }
+            const editOrg = await applyOrgLayer(recheck, editArgs);
+            recheck = editOrg.decision;
+            if (recheck.action === "deny") {
+                editDenied = recheck;
+                break;
+            }
+            let editLane;
+            const editReread = withArgsReading(pass.req, editArgs, callSignal ?? input.abortSignal);
+            const editLaneReq = Object.freeze(editReread !== undefined ? await editReread : { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
+            if (input.persistedRules !== undefined && wireOf("lanes.persistedEditSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME) {
+                editLane = await readPersistedRules(editLaneReq);
+                const editTightened = applyPersistedTightening(recheck, editLane, editLaneReq);
+                recheck = editTightened.decision;
+                if (editTightened.tightened === "deny")
+                    pass.deniedBy = "persisted_rule";
+                if (recheck.action === "deny") {
+                    editDenied = recheck;
+                    break;
+                }
+            }
+            const editSkillRefusal = skillRowRefusal(input.skillGrants, editLaneReq);
+            if (editSkillRefusal !== undefined) {
+                editDenied = editSkillRefusal;
+                pass.deniedBy = "policy";
+                break;
+            }
+            if (recheck.action === "allow") {
+                if (recheck.updatedInput !== undefined) {
+                    editArgs = recheck.updatedInput;
+                    editRewrittenSinceHuman = true;
+                }
+                if (editRewrittenSinceHuman && asksUnstated(recheck, permissionSeatAt(input, editArgs)?.seat, input.permissionMode?.())) {
+                    recheck = { action: "ask", message: permissionSeatAt(input, editArgs)?.question ?? unstatedAskMessage(toolName) };
+                    pass.tightenedBy = "unstated";
+                }
+            }
+            if (recheck.updatedInput !== undefined) {
+                editArgs = recheck.updatedInput;
+                editRewrittenSinceHuman = true;
+            }
+            let editFacts;
+            const stampEditAsk = (ask) => {
+                const editAskSnapshot = { ...ask, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
+                if (editFacts === undefined) {
                     markedThisRound = undefined;
-                    const editFacts = askOriginFacts(editOrg.org, editLane);
-                    const editAskDecision = stampAskOrigin(editAskSnapshot, editFacts, classifyStanding(editAskSnapshot, editFacts));
-                    if (input.permissionMode !== undefined && pass.askClassification !== undefined) {
-                        const editVerdict = arbitrateByMode(input.permissionMode(), pass.askClassification, { ...(editAskDecision.origin !== undefined ? { origin: editAskDecision.origin } : {}), ...(editAskDecision.mandate !== undefined ? { mandate: editAskDecision.mandate } : {}) });
-                        if (editVerdict.kind === "released") {
-                            ledger.supersede();
-                            pass.arbitration = editVerdict;
-                            await notifier.notifyAsync(() => input.onModeReleased?.({ toolName, toolCallId, release: { mode: editVerdict.mode, askClass: editVerdict.askClass, classes: editVerdict.classes, ...(editVerdict.origin !== undefined ? { origin: editVerdict.origin } : {}), ...(editVerdict.mandate !== undefined ? { mandate: editVerdict.mandate } : {}), ...(editVerdict.reason !== undefined ? { reason: editVerdict.reason } : {}) }, ...(pass.shellReadUnestablished === true ? { readUnestablished: true } : {}) }), "toolGate.onModeReleased");
-                            break;
-                        }
-                        if (editVerdict.kind === "denied_by_mode") {
-                            ledger.supersede();
-                            pass.arbitration = editVerdict;
-                            editDenied = { action: "deny", message: `the approved edit for "${toolName}" raised a new approval requirement that the ${editVerdict.mode} permission mode refuses`, decisionReason: "mode" };
-                            pass.deniedBy = "mode";
-                            break;
-                        }
-                    }
-                    const editAskReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
-                    const rr = ledger.fromResolved(await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq)), editAskDecision, editAskReq);
-                    if (rr.action !== "allow") {
-                        editDenied = rr;
-                        pass.deniedBy = "ask_resolution";
-                        break;
-                    }
-                    if (rr.updatedInput === undefined) {
-                        if (rr.presentedInput !== undefined)
-                            editArgs = rr.presentedInput;
-                        editRewrittenSinceHuman = false;
-                        break;
-                    }
-                    editArgs = rr.updatedInput;
-                    editRewrittenSinceHuman = false;
+                    editFacts = askOriginFacts(editOrg.org, editLane);
                 }
-                if (editDenied === undefined && editRewrittenSinceHuman && input.writeProtectionCheck !== undefined) {
-                    const check = input.writeProtectionCheck;
-                    const verdict = await awaitWriteProtectionJudgment((deadline) => check(toolName, editArgs, pass.req.face, input.trackedCwd?.(), deadline), boundedAwaitDeadlineMs, callSignal ?? input.abortSignal);
-                    if (verdict !== undefined && verdict.kind !== "clear") {
-                        editDenied = {
-                            action: "deny",
-                            message: verdict.kind === "hit"
-                                ? `the approved edit for "${toolName}" was rewritten by the restriction chain onto a write-protected path (table entry "${verdict.hit.name}") that no approval covers — denied fail-closed; re-submit the edited action directly`
-                                : `the approved edit for "${toolName}" was rewritten by the restriction chain onto a target whose destination could not be determined (target_unresolved: ${verdict.cause}) — denied fail-closed; re-submit the edited action directly`,
-                        };
-                        pass.deniedBy = "write_protection";
-                    }
+                return stampAskOrigin(editAskSnapshot, editFacts, classifyStanding(editAskSnapshot, editFacts));
+            };
+            if (editHookAsk !== undefined)
+                recheck = foldHookAsk(recheck, editHookAsk);
+            let editDecision = recheck.action === "ask" ? stampEditAsk(recheck) : recheck;
+            if (carriedOwnAsk !== undefined) {
+                const { updatedInput: _theOriginalBytes, ...carried } = carriedOwnAsk;
+                const rra = carried.requiresRealApproval === true ? { requiresRealApproval: true } : {};
+                editDecision = stampEditAsk(editDecision.action === "ask" ? { ...editDecision, foldedAskClasses: [...(editDecision.foldedAskClasses ?? []), ...decisionAskClassesOf(carried), ...(carried.classes ?? [])], ...rra } : carried);
+                carriedOwnAsk = undefined;
+            }
+            const editRead = await checkTool(editDecision, editArgs, editOrg.org, undefined);
+            if (editRead?.kind === "denied") {
+                refuseByExtension(editRead.deny);
+                editDenied = editRead.deny;
+                break;
+            }
+            if (editRead?.kind === "approved") {
+                carriedOwnAsk = editRead.outstanding ?? (editDecision.action === "ask" ? editDecision : undefined);
+                editArgs = editRead.allow.updatedInput;
+                editRewrittenSinceHuman = false;
+                continue;
+            }
+            if (editRead?.kind === "asked" && editRead.marked === true)
+                editFacts = undefined;
+            if (editRead?.kind === "asked")
+                editDecision = stampEditAsk(editRead.ask);
+            else if (editRead?.kind === "shadowed" && editDecision.action === "ask")
+                editDecision = { ...editDecision, allowRuleShadowed: [...(editDecision.allowRuleShadowed ?? []), ...editRead.shadows] };
+            if (editDecision.action !== "ask")
+                break;
+            const editAskDecision = editDecision;
+            if (input.permissionMode !== undefined && pass.askClassification !== undefined) {
+                const editVerdict = arbitrateByMode(input.permissionMode(), pass.askClassification, { ...(editAskDecision.origin !== undefined ? { origin: editAskDecision.origin } : {}), ...(editAskDecision.mandate !== undefined ? { mandate: editAskDecision.mandate } : {}) });
+                if (editVerdict.kind === "released") {
+                    ledger.supersede();
+                    pass.arbitration = editVerdict;
+                    await notifier.notifyAsync(() => input.onModeReleased?.({ toolName, toolCallId, release: { mode: editVerdict.mode, askClass: editVerdict.askClass, classes: editVerdict.classes, ...(editVerdict.origin !== undefined ? { origin: editVerdict.origin } : {}), ...(editVerdict.mandate !== undefined ? { mandate: editVerdict.mandate } : {}), ...(editVerdict.reason !== undefined ? { reason: editVerdict.reason } : {}) }, ...(pass.shellReadUnestablished === true ? { readUnestablished: true } : {}) }), "toolGate.onModeReleased");
+                    break;
                 }
-                if (editDenied === undefined && input.shellReadCheck !== undefined) {
-                    const station = input.shellReadCheck;
-                    const judged = station.judge(pass.req, editArgs, input.trackedCwd?.(), callSignal ?? input.abortSignal, { seat: "rejudge", toolCallId });
-                    if (judged !== null) {
-                        let verdict;
-                        try {
-                            verdict = await withGateTimeout(judged, boundedAwaitDeadlineMs(), callSignal ?? input.abortSignal, "shellReadStation");
-                        }
-                        catch {
-                            verdict = station.unanswered(pass.req, "the read station could not answer");
-                        }
-                        const reading = readStationAnswer(verdict, { toolName, toolCallId, report: (e) => traceHookCrash(input, e, notifier) });
-                        if (reading.kind !== "vouch") {
-                            editDenied = {
-                                action: "deny",
-                                message: reading.verdict.sentence ?? `the approved edit for "${toolName}" reads where the read boundary does not vouch — denied fail-closed; re-submit the command as a fresh call and answer its card`,
-                            };
-                            pass.deniedBy = "read_boundary";
-                            if (reading.verdict.details !== undefined)
-                                pass.denyDetails = reading.verdict.details;
-                        }
-                    }
+                if (editVerdict.kind === "denied_by_mode") {
+                    ledger.supersede();
+                    pass.arbitration = editVerdict;
+                    editDenied = { action: "deny", message: `the approved edit for "${toolName}" raised a new approval requirement that the ${editVerdict.mode} permission mode refuses`, decisionReason: "mode" };
+                    pass.deniedBy = "mode";
+                    break;
                 }
-                pass.decision = editDenied ?? { ...pass.decision, updatedInput: editArgs };
             }
-            else if (pass.decision.action === "allow" && pass.decision.updatedInput === undefined && resolved.presentedInput !== undefined) {
-                pass.decision = { ...pass.decision, updatedInput: resolved.presentedInput };
+            const editAskReq = Object.freeze({ toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
+            if (suspendAsk !== undefined && markedUnresolvable()) {
+                unanswered = { ask: editAskDecision, req: editAskReq, org: editOrg.org };
+                break;
+            }
+            const rr = ledger.fromResolved(await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq)), editAskDecision, editAskReq);
+            if (rr.action !== "allow") {
+                refusedAtResolution(rr);
+                if (rr.approverUnavailable === true)
+                    unanswered = { ask: editAskDecision, req: editAskReq, org: editOrg.org, deny: rr };
+                break;
             }
+            if (rr.updatedInput === undefined) {
+                editRewrittenSinceHuman = false;
+                break;
+            }
+            editArgs = rr.updatedInput;
+            editRewrittenSinceHuman = false;
+        }
+        const rejudged = () => editDenied === undefined || editDenied === unanswered?.deny;
+        if (rejudged() && editRewrittenSinceHuman && input.writeProtectionCheck !== undefined) {
+            const check = input.writeProtectionCheck;
+            const verdict = await awaitWriteProtectionJudgment((deadline) => check(toolName, editArgs, pass.req.face, input.trackedCwd?.(), deadline), boundedAwaitDeadlineMs, callSignal ?? input.abortSignal);
+            if (verdict !== undefined && verdict.kind !== "clear") {
+                editDenied = {
+                    action: "deny",
+                    message: verdict.kind === "hit"
+                        ? `the approved edit for "${toolName}" was rewritten by the restriction chain onto a write-protected path (table entry "${verdict.hit.name}") that no approval covers — denied fail-closed; re-submit the edited action directly`
+                        : `the approved edit for "${toolName}" was rewritten by the restriction chain onto a target whose destination could not be determined (target_unresolved: ${verdict.cause}) — denied fail-closed; re-submit the edited action directly`,
+                };
+                pass.deniedBy = "write_protection";
+            }
+        }
+        if (rejudged() && input.shellReadCheck !== undefined) {
+            const station = input.shellReadCheck;
+            const judged = station.judge(pass.req, editArgs, input.trackedCwd?.(), callSignal ?? input.abortSignal, { seat: "rejudge", toolCallId });
+            if (judged !== null) {
+                let verdict;
+                try {
+                    verdict = await withGateTimeout(judged, boundedAwaitDeadlineMs(), callSignal ?? input.abortSignal, "shellReadStation");
+                }
+                catch {
+                    verdict = station.unanswered(pass.req, "the read station could not answer");
+                }
+                const reading = readStationAnswer(verdict, { toolName, toolCallId, report: (e) => traceHookCrash(input, e, notifier) });
+                if (reading.kind !== "vouch") {
+                    editDenied = {
+                        action: "deny",
+                        message: reading.verdict.sentence ?? `the approved edit for "${toolName}" reads where the read boundary does not vouch — denied fail-closed; re-submit the command as a fresh call and answer its card`,
+                    };
+                    pass.deniedBy = "read_boundary";
+                    if (reading.verdict.details !== undefined)
+                        pass.denyDetails = reading.verdict.details;
+                }
+            }
+        }
+        if (unanswered !== undefined && editDenied === unanswered.deny && pass.parkFailed === undefined) {
+            const parked = await parkAsk(unanswered.ask, unanswered.req, editArgs, safetyOf(unanswered.ask), unanswered.deny !== undefined || undefined, unanswered.org);
+            if (parked)
+                return parked;
         }
+        if (unanswered !== undefined && unanswered.deny === undefined && editDenied === undefined)
+            refusedAtResolution(ledger.fromResolved(await (callSignal !== undefined ? resolveAsk(unanswered.ask, unanswered.req, callSignal) : resolveAsk(unanswered.ask, unanswered.req)), unanswered.ask, unanswered.req));
+        pass.decision = editDenied !== undefined ? refusalOf(editDenied, editArgs) : { ...pass.decision, updatedInput: editArgs };
     }
     return await exitGate(pass);
 }