@sema-agent/core 7.51.2 → 7.53.0

package/dist/core/runner/prepare-turn-wiring.d.ts

@@ -1,10 +1,9 @@
 import type { AgentHarness, AgentTool, ExecutionEnv, ThinkingLevel } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
 import { type AssembledPrompt, type AssembleInputs } from "../../prompt-assembly/assemble.js";
-import { type PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
-import type { EpochDeclaredSections } from "../../prompt-assembly/epoch.js";
 import { type TurnPromptSnapshot } from "../../prompt-assembly/turn-snapshot.js";
-import type { PromptTextDeclaration } from "../../prompts/default.js";
+import { type CenterAdoption } from "../../prompt-assembly/artifact.js";
+import type { RunPromptIdentity } from "../../prompt-assembly/epoch.js";
 import { CacheBreakDetector, type ToolFingerprintInput } from "../cache-break-detector.js";
 import type { ToolPolicy } from "../tool-policy.js";
 import { type SyntheticReadJudge } from "../synthetic-read-verdict.js";
@@ -39,8 +38,8 @@ export interface PrepareTurnWiringInput {
     };
     /** borrowed-readonly — the task model: `provider` / `id` / `maxTokens` / `api` (the snapshot's identity elements). */
     model: Pick<Model, "provider" | "id" | "maxTokens" | "api">;
-    /** borrowed-readonly — the resolved epoch's artifact digest (the snapshot's identity element). */
-    epochArtifactDigestForSnapshot: string;
+    /** borrowed-readonly — the run's prompt identity (the snapshot's `artifactDigest` element). */
+    promptIdentityDigest: string;
     /** borrowed-readonly — the resolved prompt profile (a snapshot element). */
     promptProfile: "simple" | "classic";
     /** borrowed-readonly — the fable mitigations switch (a snapshot element). */
@@ -109,21 +108,20 @@ export interface PrepareTurnWiringInput {
     /** borrowed-readonly — the registry scope the background listing reads under. */
     taskScope: string;
     /** borrowed-readonly — the prompt-assembly phase's re-invokable assemble-inputs builder (the candidate re-assembles). */
-    buildAssembleInputs: (centerDecls?: PromptTextDeclaration[]) => AssembleInputs;
-    /** borrowed-mutable — the LIVE center adoption (the prompt-assembly phase's accessor cell). Read: the candidate's arming and
-     *  same-artifact test. Writer here: the candidate's `apply` (the boundary swap / the explicit-disable rollback). */
+    buildAssembleInputs: (center: CenterAdoption | undefined) => AssembleInputs;
+    /** borrowed-readonly — the prompt-assembly phase's identity inputs under another center layer (the candidate's record). */
+    identityFor: (center: CenterAdoption | undefined) => RunPromptIdentity;
+    /** borrowed-readonly — whether this run adopts center candidates at its boundaries (a child never does). */
+    adoptsCandidates: boolean;
+    /** borrowed-mutable — the LIVE center adoption (the prompt-assembly phase's accessor cell). Read: the candidate's
+     *  same-artifact test. Writer here: the candidate's `apply` (the boundary adoption / the explicit-disable emptying). */
     centerAdoptionRef: {
-        current: {
-            artifact: PromptEpochArtifact;
-            sourceRevision?: string;
-        } | undefined;
+        current: CenterAdoption | undefined;
     };
     /** borrowed-readonly — the harness ref (the candidate's `apply` calls `setSystemPrompt` on the current harness). */
     harnessRef: {
         current?: AgentHarness;
     };
-    /** borrowed-readonly — the provider-declared sections in the epoch shape (the candidate's declared-sections TYPE). */
-    epochDeclaredSections: EpochDeclaredSections;
     /** borrowed-readonly — the ONE carrier-face expression both delegation mounts consume (the observation seat). */
     carrierReadFace: () => ContainmentFace | undefined;
     /** borrowed-readonly — the same carrier expression on the WRITE seat. */
@@ -134,7 +132,7 @@ export interface PrepareTurnWiringInput {
         caseSensitive: boolean;
     }>;
     /** borrowed-mutable — the holder of the built Prepared. Writer: the DRIVER fills `current` right after `buildPrepared()`;
-     *  the candidate's `apply` then writes `current.epochDeclaredSections` and `current.promptOverheadTokens` at a boundary. */
+     *  the candidate's `apply` then writes `current.promptIdentity` and `current.promptOverheadTokens` at a boundary. */
     preparedHolder: {
         current?: Prepared;
     };

package/dist/core/runner/prepare-turn-wiring.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { assemblePrompt } from "../../prompt-assembly/assemble.js";
-import { artifactDeclarations } from "../../prompt-assembly/artifact.js";
 import { buildTurnPromptSnapshot } from "../../prompt-assembly/turn-snapshot.js";
+import { adoptCenter } from "../../prompt-assembly/artifact.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { createSyntheticReadJudge } from "../synthetic-read-verdict.js";
@@ -15,7 +15,7 @@ import { PROMPT_HASH_SALT } from "./prompt-hash-salt.js";
 import { CHANGED_FILES_MTIME_EPS_MS } from "./turn-attachments.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareTurnWiring(input) {
-    const { deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, readRoots, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants, callerPolicy, inheritedPolicies, persistedRuleLane, ruleLaneFacts, personRowsBeyondRun, orgRuleLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder } = input;
+    const { deps, systemPromptSeat, harnessTools, fpRef, model, promptIdentityDigest, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, readRoots, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants, callerPolicy, inheritedPolicies, persistedRuleLane, ruleLaneFacts, personRowsBeyondRun, orgRuleLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, identityFor, adoptsCandidates, centerAdoptionRef, harnessRef, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder } = input;
     const cacheBreakDetector = deps.cacheBreakDetection === false ? undefined : new CacheBreakDetector();
     const cacheFingerprint = cacheBreakDetector
         ? { systemPrompt: systemPromptSeat.current, tools: toolsToFingerprintInputs(harnessTools) }
@@ -24,7 +24,7 @@ export function prepareTurnWiring(input) {
     const turnSnapshot = buildTurnPromptSnapshot({
         provider: model.provider,
         modelId: model.id,
-        artifactDigest: epochArtifactDigestForSnapshot,
+        artifactDigest: promptIdentityDigest,
         promptProfile,
         fableMitigations,
         layoutGroups: (systemBlocks ?? [{ groupId: "body", cacheControlBoundary: true }]).map((b) => ({ groupId: b.groupId, cacheControlBoundary: b.cacheControlBoundary })),
@@ -165,49 +165,51 @@ export function prepareTurnWiring(input) {
         .filter((t) => t.status === "pending" || t.status === "running" || t.status === "parked")
         .map((t) => ({ id: t.task_id, ...(t.description !== undefined ? { description: t.description } : {}), status: t.status }));
     const overheadState = { promptChars: 0 };
-    const centerCompactionCandidate = deps.promptSource !== undefined && centerAdoptionRef.current !== undefined
+    const centerCompactionCandidate = deps.promptSource !== undefined && adoptsCandidates
         ? () => {
-            const state = deps.promptSource.sourceState?.() ?? "unavailable";
-            const cand = deps.promptSource.current();
-            const toBundled = state === "disabled";
-            if (!toBundled && (cand === undefined || cand.artifact.artifactDigest === centerAdoptionRef.current.artifact.artifactDigest))
+            const state = deps.promptSource.sourceState();
+            const now = centerAdoptionRef.current;
+            let next;
+            if (state === "disabled") {
+                if (now === undefined)
+                    return undefined;
+                next = undefined;
+            }
+            else if (state === "active") {
+                const cand = deps.promptSource.current();
+                if (cand === undefined || cand.artifactDigest === now?.artifact.artifactDigest)
+                    return undefined;
+                next = adoptCenter(cand, cand.sourceRevision);
+                if (next === undefined)
+                    return undefined;
+            }
+            else {
                 return undefined;
+            }
             let a2;
             try {
-                a2 = assemblePrompt(buildAssembleInputs(toBundled ? undefined : artifactDeclarations(cand.artifact)));
+                a2 = assemblePrompt(buildAssembleInputs(next));
             }
             catch {
                 return undefined;
             }
-            if (!toBundled && a2.centerMounted !== true)
-                return undefined;
-            const declared2 = (a2.sections ?? [])
-                .filter((sec) => sec.origin === "provider")
-                .map((sec) => ({ id: sec.id, slot: sec.slot, chars: sec.text.length, ...(sec.declaredContentHash !== undefined ? { contentHash: sec.declaredContentHash } : {}) }));
+            const promptIdentity = identityFor(next);
             const overheadTokensAfter = preparedHolder.current.promptOverheadTokens -
                 Math.ceil(overheadState.promptChars / charsPerToken) +
                 Math.ceil(a2.systemPrompt.length / charsPerToken);
             return {
-                ...(toBundled
-                    ? { clear: true }
-                    : {
-                        centerArtifactDigest: cand.artifact.artifactDigest,
-                        ...(cand.sourceRevision !== undefined ? { sourceRevision: cand.sourceRevision } : {}),
-                    }),
-                declaredSections: declared2,
+                promptIdentity,
                 overheadTokensAfter,
-                apply: (committedArtifactDigest) => {
+                apply: (committedIdentity) => {
                     systemPromptSeat.current = a2.systemPrompt;
                     harnessRef.current?.setSystemPrompt(a2.systemPrompt, a2.systemBlocks);
                     if (fpRef.current)
                         fpRef.current.systemPrompt = a2.systemPrompt;
-                    turnSnapshotRef.current?.refreshStableSystem(a2.systemPrompt, committedArtifactDigest);
-                    preparedHolder.current.epochDeclaredSections = declared2;
+                    turnSnapshotRef.current?.refreshStableSystem(a2.systemPrompt, committedIdentity);
+                    preparedHolder.current.promptIdentity = promptIdentity;
                     preparedHolder.current.promptOverheadTokens = overheadTokensAfter;
                     overheadState.promptChars = a2.systemPrompt.length;
-                    centerAdoptionRef.current = toBundled
-                        ? undefined
-                        : { artifact: cand.artifact, ...(cand.sourceRevision !== undefined ? { sourceRevision: cand.sourceRevision } : {}) };
+                    centerAdoptionRef.current = next;
                 },
             };
         }

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -21,7 +21,8 @@ import { type PeerLaneRefs } from "../../agents/peer-session-drain.js";
 import type { SessionBoxBinding } from "../task-notification.js";
 import type { OnQuestion } from "../ask-question.js";
 import type { CheckpointStore } from "../checkpoint-store.js";
-import { type HookEnvCapabilities, type HookInvocationIdentity, type Hooks } from "../hooks.js";
+import { type HookEnvCapabilities, type HookInvocationIdentity } from "../hooks.js";
+import type { ModBus } from "../mods/kernel/index.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { MaterializedMcp } from "../mcp.js";
 import type { SessionStore } from "../session.js";
@@ -39,7 +40,7 @@ export interface PrepareWiringManifestInput {
      *  `resourceSuspend` (the task-axis lane), `durableApproval` / `principal` (the synthesis and the notice), `interactiveTools` /
      *  `mcp` / `checkpointStore` (manifest cells and the notice's cause), `enablePlanMode` (the gate-machinery predicate's
      *  plan-mode term), `writeProtectedAdditions` (the request's rows of the write-protection table). Never mutated. */
-    spec: Pick<TaskSpec, "onQuestion" | "handsReadOnly" | "tools" | "resourceSuspend" | "durableApproval" | "principal" | "interactiveTools" | "mcp" | "checkpointStore" | "enablePlanMode" | "hooks" | "peerPresence" | "writeProtectedAdditions">;
+    spec: Pick<TaskSpec, "onQuestion" | "handsReadOnly" | "tools" | "resourceSuspend" | "durableApproval" | "principal" | "interactiveTools" | "mcp" | "checkpointStore" | "enablePlanMode" | "peerPresence" | "writeProtectedAdditions">;
     /** borrowed-readonly — the deployment seats, whole: `onError` (the warning), `executionEnv`
      *  (the hook-env predicate), `checkpointStore` (durable infra), the manifest's dozen wiring facts (`backgroundAgentStore`,
      *  `permissionRuleStore`, `permissionRuleSyncWired`, `onBackgroundChildEvent`, `lockedConfig`, `compliancePostureResolver`,
@@ -62,10 +63,8 @@ export interface PrepareWiringManifestInput {
     taskScope: string;
     /** borrowed-readonly — this leg's checkpoint scope (the driver's one derivation): the scope of the synthesized `durableApproval`. */
     checkpointScope: string;
-    /** borrowed-readonly — the resolved hook record (`spec.hooks ?? deps.hooks`): the effect-aware-gate term, the tracked flag and the hook-env consumer test. */
-    hooks: Hooks | undefined;
-    /** borrowed-readonly — whether the deployment declared its screening face observational (then it is no gate). */
-    preToolUseObservational: boolean;
+    /** borrowed-readonly — the leg's mods bus: the effect-aware-gate term, the tracked flag, the hook-env consumer test, and `mods[]` (its admission records). */
+    modBus: ModBus;
     /** borrowed-readonly — the caller-facing policy layers; only their COUNT is read (an effect-aware gate exists). */ policyLayers: ReadonlyArray<unknown>;
     /** borrowed-readonly — the policy chain's effective policy, or undefined; only its PRESENCE is read (the first term of the
      *  gate-machinery predicate below). Never called here. */
@@ -115,7 +114,8 @@ export interface PrepareWiringManifestInput {
     /** borrowed-readonly — the model gate's per-leg read face, or undefined. */
     modelGateManifest: WiringManifest["modelGate"];
     /** borrowed-readonly — the leg's minted tool roster: rides the manifest's `tools` section and is the
-     *  source of the hand band's write-capable names for the ungated-write warning (what actually MOUNTED). */
+     *  source of the hand band's write-capable names for the ungated-write warning (what actually MOUNTED) and of each MCP server's
+     *  `toolCount` (its tools among the roster's names). */
     toolRoster: ToolRoster;
     /** borrowed-readonly — from the read-face phase: the built-in read-deny TIERS that leg's own
      *  resolution materially activated; relayed onto the manifest (present iff non-empty), never
@@ -141,6 +141,9 @@ export interface PrepareWiringManifestInput {
     frameSettlement: import("../frame-settlement.js").FrameSettlement;
     /** borrowed-readonly — the session-box drain's mount verdict (prepare-task's one judgment): present ⇒ this leg drains its own box. */
     sessionBox: SessionBoxBinding | undefined;
+    /** borrowed-readonly, read late — the memory session's one-way pollution face (absent with no memory session). The drain marks
+     *  it when it INJECTS a letter from another principal (the injection path; the tool path is accounted by `ReadInbox`'s class). */
+    memoryPollution?: () => Pick<NonNullable<Prepared["memoryEngineSession"]>["pollution"], "markPolluted"> | undefined;
     /** borrowed-readonly — the built harness the peer drain binds to. */
     harness: AgentHarness;
     /** borrowed-readonly — the durable-suspend holder; the drain's parked predicate reads `token` at run time. Not written here. */
@@ -203,7 +206,8 @@ export interface PrepareWiringManifestResult {
  * The wiring manifest's per-server MCP read face for one leg ({@link WiringManifest.mcp}): every
  * server the leg's FROZEN entry snapshot declared, in declaration order, joined by name to this leg's
  * materialization statuses. Pure projection — no connection logic, no second look at any transport:
- *  · a status `connected` ⇒ `connected` with the mounted roster size (the intake's post-filter count);
+ *  · a status `connected` ⇒ `connected` with the server's tools among `rosterNames` — the names of the roster the row is read
+ *    against: a run's (the valve and the deployment's overlay applied), or the no-run probe's own dials (no run, so no lists apply);
  *  · a status `failed` ⇒ `failed` with the failure record the materialization stamped (`errorCode`/`delivered`/
  *    `httpStatus` = the MCP vocabulary's `McpFailure` spread flat) and the remote text SECRET-REDACTED (an HTTP endpoint's error body rides the SDK's message
  *    verbatim, and a body that echoes the bearer it rejected must not reach a stream consumer),
@@ -214,6 +218,6 @@ export interface PrepareWiringManifestResult {
  * `liveness` is the status record's own observation deep-copied (see {@link WiringManifestMcpEntry.liveness}).
  * The entries are fresh objects so the manifest never aliases the status records the refresh face mutates.
  */
-export declare function mcpManifestEntries(entries: ReadonlyArray<import("../types.js").McpServerSpec> | undefined, statuses: ReadonlyArray<import("../mcp.js").McpServerStatus>): WiringManifestMcpEntry[];
+export declare function mcpManifestEntries(entries: ReadonlyArray<import("../types.js").McpServerSpec> | undefined, statuses: ReadonlyArray<import("../mcp.js").McpServerStatus>, rosterNames: ReadonlyArray<string>): WiringManifestMcpEntry[];
 /** The M18 phase body — prepareTask's wiring-manifest stretch, verbatim (see the module header). */
 export declare function prepareWiringManifest(input: PrepareWiringManifestInput): PrepareWiringManifestResult;

package/dist/core/runner/prepare-wiring-manifest.js

@@ -2,7 +2,8 @@ import { bindPeerLaneDrain } from "../../agents/peer-session-drain.js";
 import { teamRoleOf } from "../../agents/team-role.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { createHookEnvCapabilities, mintHookInvocationIdentity } from "../hooks.js";
-import { wiredHookEntries } from "../hook-seats.js";
+import { chainJudges } from "../mods/stations.js";
+import { toolNamesOfServer } from "../mounted-mcp.js";
 import { isRemoteExecutionEnv, missingRestoreSurface } from "../remote-env.js";
 import { isVolatileOffloadStore } from "../tool-result-store.js";
 import { durableMandateSourceOf, isLiveApproverSeat } from "../tool-policy.js";
@@ -13,7 +14,7 @@ import { autoRunOnRecommendationEffective } from "./memory-consolidation-driver.
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs, windowsGovernCost } from "../usage-window-store.js";
 import { LSP_CONTRACT_ID, askSeatEffective, countElicitOptIns, deriveHandsSeam, deriveLspSeam, deriveWiringManifest, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
 import { modePolicyOf } from "../mode-policy.js";
-export function mcpManifestEntries(entries, statuses) {
+export function mcpManifestEntries(entries, statuses, rosterNames) {
     return (entries ?? []).map((entry) => {
         const status = statuses.find((s) => s.name === entry.name);
         const source = typeof entry.source === "string" && entry.source.length > 0 ? { source: inlineUntrusted(entry.source, 80) } : {};
@@ -21,7 +22,7 @@ export function mcpManifestEntries(entries, statuses) {
         if (status === undefined)
             return { name: entry.name, ...source, status: "skipped", toolCount: 0 };
         if (status.status === "connected")
-            return { name: entry.name, ...source, status: "connected", toolCount: status.toolNames?.length ?? 0, ...liveness };
+            return { name: entry.name, ...source, status: "connected", toolCount: toolNamesOfServer(rosterNames, entry.name).length, ...liveness };
         return {
             name: entry.name,
             ...source,
@@ -116,13 +117,14 @@ function announceDurableGateUnavailable(args) {
     });
 }
 export function prepareWiringManifest(input) {
-    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, checkpointScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, sessionBox, harness, pausedRef, askSeat, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, lspDiagnosticsLive, fileHistoryFact } = input;
+    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, modBus, checkpointScope, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, sessionBox, harness, pausedRef, askSeat, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, lspDiagnosticsLive, fileHistoryFact, memoryPollution } = input;
     const onAsk = askSeat.value;
     const handWriteTools = toolRoster.entries.filter((e) => e.mountedBy === "hands" && (e.effect === "write" || e.effect === "idempotent")).map((e) => e.name);
-    const hasEffectAwareGate = Boolean(policyLayers.length > 0 || (hooks?.preToolUse !== undefined && !preToolUseObservational));
+    const hasEffectAwareGate = policyLayers.length > 0 || chainJudges(modBus);
+    const rosterHolds = new Set(toolRoster.entries.map((e) => e.name));
     const peerWriteUngated = modePolicyOf(permissionMode.current).unstated === "ask"
         ? []
-        : mcp.tools.filter((t) => t.permissionSeat === "passthrough" && !irreversibleTools.has(t.name) && !egressTools.has(t.name) && (toolEffects.get(t.name) ?? "write") !== "read").map((t) => t.name);
+        : mcp.tools.filter((t) => rosterHolds.has(t.name) && t.permissionSeat === "passthrough" && !irreversibleTools.has(t.name) && !egressTools.has(t.name) && (toolEffects.get(t.name) ?? "write") !== "read").map((t) => t.name);
     const firstPartyWriteUngated = (spec.tools ?? [])
         .map((t) => t.name)
         .filter((name) => !irreversibleTools.has(name) && !egressTools.has(name) && toolEffects.get(name) === "write");
@@ -151,7 +153,7 @@ export function prepareWiringManifest(input) {
     const preToolContexts = new Map();
     const blockedToolCalls = new Set();
     const batchHaltRef = {};
-    const blockedTracked = Boolean(hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure || hooks?.postToolBatch);
+    const blockedTracked = ["classic.PostToolUse", "classic.PreToolUse", "classic.PostToolUseFailure", "classic.PostToolBatch"].some((ev) => modBus.hasHandlers(ev));
     const restoreSurfaceGap = ownedEnv !== undefined && isRemoteExecutionEnv(ownedEnv) && ownedEnv.capabilities.suspendable ? missingRestoreSurface(ownedEnv) : [];
     const incompleteSuspendAdapter = restoreSurfaceGap.length > 0 ? restoreSurfaceGap : undefined;
     const durableSuspendInfraReady = resolveCheckpointStore(spec, deps) !== undefined &&
@@ -213,12 +215,12 @@ export function prepareWiringManifest(input) {
         ...(modelGateManifest !== undefined ? { modelGate: modelGateManifest } : {}),
         autoMode: { ...autoModeArmReason() },
         permissionMode: permissionMode.receipt(),
-        mcp: mcpManifestEntries(lockedPreflight.mcp, mcp.statuses),
+        mcp: mcpManifestEntries(lockedPreflight.mcp, mcp.statuses, toolRoster.entries.map((e) => e.name)),
         ...(writeProtection.mount !== undefined ? { writeProtectionTargetView: writeProtection.mount.targetView } : {}),
         readDenyBuiltinTiersActive,
         autoConsolidationOnRecommendation: autoRunOnRecommendationEffective(deps),
         tools: toolRoster,
-        hooks: wiredHookEntries(hooks, spec.hooks !== undefined ? "spec" : "deps", preToolUseObservational),
+        mods: modBus.records,
         ...(lspManagerWired ? { lsp: deriveLspSeam(toolRoster.entries.some((e) => e.contract.contractId === LSP_CONTRACT_ID), lspDiagnosticsLive) } : {}),
         hands: deriveHandsSeam(handsEnabled),
         fileHistory: fileHistoryFact,
@@ -238,12 +240,13 @@ export function prepareWiringManifest(input) {
             settlement: frameSettlement,
             selfName: () => internals?.explicitAgentName,
             parked: () => pausedRef.current !== undefined,
+            markExternalContent: (reason) => memoryPollution?.()?.markPolluted(reason, "observed"),
         });
         frameSettlement.boxBacked = (payload) => peerLaneRefs.isBoxBacked?.(payload) ?? false;
     }
     const parkLaneArmed = wiringManifest.parkLane.effective === true;
     const gateMachineryActive = effectivePolicy !== undefined ||
-        hooks?.preToolUse !== undefined ||
+        modBus.hasHandlers("classic.PreToolUse") ||
         egressTools.size > 0 ||
         irreversibleTools.size > 0 ||
         shellReadStationArmed ||
@@ -262,7 +265,7 @@ export function prepareWiringManifest(input) {
         ...(internals?.spawnAgentType !== undefined ? { agentType: internals.spawnAgentType } : {}),
         ...(internals?.parentToolCallId !== undefined ? { parentToolCallId: internals.parentToolCallId } : {}),
     });
-    const hookContextConsumerWired = hooks?.preToolUse !== undefined || hooks?.postToolUse !== undefined || hooks?.postToolUseFailure !== undefined;
+    const hookContextConsumerWired = ["classic.PreToolUse", "classic.PostToolUse", "classic.PostToolUseFailure"].some((ev) => modBus.hasHandlers(ev));
     const hookEnvFace = hookContextConsumerWired && (ownedEnv ?? deps.executionEnv) != null ? createHookEnvCapabilities(executionEnv) : undefined;
     return { onAsk, preToolContexts, blockedToolCalls, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, platformSuspendArmed, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound };
 }

package/dist/core/runner/resume-admission.d.ts

@@ -12,6 +12,7 @@
  */
 import { type Checkpoint, type CheckpointStore, type CheckpointToken, type PendingSteerEntry, type ResumeOutcome } from "../checkpoint-store.js";
 import type { InheritedGate, ResumeTaskConfig, RunInternals, RunnerDepsSeat } from "./contracts.js";
+import type { SessionStore } from "../session.js";
 /** What the admission rung was called with. */
 export interface ResumeAdmissionInput<R> {
     /** borrowed-readonly — the checkpoint token the caller is redeeming. */
@@ -28,6 +29,8 @@ export interface ResumeAdmissionInput<R> {
     /** borrowed-readonly — the Runner's deployment deps, read LIVE through the Runner (the store resolution reads `checkpointStore`); the one home of why it is a
      *  seat and not a captured object is {@link RunnerDepsSeat}. */
     runner: RunnerDepsSeat;
+    /** borrowed-readonly — the Runner's session store, fixed at its construction (unlike its deps): the retention capability door judges it. */
+    sessions: SessionStore;
     /** borrowed-readonly — the Runner's same-process parked-constraint registry; read for this token (never written here). */
     parentConstraintRegistry: ReadonlyMap<CheckpointToken, NonNullable<InheritedGate["parentConstraints"]>>;
     /** borrowed-readonly — the rung after admission, entered in this rung's last continuation with what it admitted. */
@@ -35,7 +38,7 @@ export interface ResumeAdmissionInput<R> {
 }
 /** What admission established — the constants every later rung reads. */
 export interface ResumeAdmissionResult {
-    /** The caller's config, snapshotted once (own enumerable fields). */
+    /** The caller's config, snapshotted once (own enumerable fields), its MCP / A2A entries the frozen ones the doors judged. */
     config: ResumeTaskConfig;
     /** The trusted internals snapshot, with the parked parent chain re-supplied when this Runner spawned the leg. */
     internals: RunInternals | undefined;

package/dist/core/runner/resume-admission.js

@@ -1,16 +1,18 @@
 import { CheckpointError, readPendingSteerQueue, refuseRetiredModeSeed, resolveCheckpointStore, validatePendingSteer } from "../checkpoint-store.js";
-import { refuseResumeDoors } from "../mode-policy.js";
+import { assertResumeConfigRecord, checkpointStoreSeat, refuseResumeDoors } from "./prepare-config-doors.js";
+import { asResumeConfigRefusal } from "../mode-policy.js";
 import { describeSuppliedValue } from "./decide-continuation.js";
 import { detachSkillLists } from "../skill-grant.js";
 export async function resumeAdmission(input) {
-    const { token, outcome, taskConfig, runner, parentConstraintRegistry } = input;
+    const { token, outcome, taskConfig, runner, sessions, parentConstraintRegistry } = input;
     let internals = input.internals;
     if (outcome === null || typeof outcome !== "object") {
         throw new CheckpointError("checkpoint.invalid_outcome", `resume outcome must be an object naming its gate (got ${outcome === null ? "null" : typeof outcome})`);
     }
-    const config = typeof taskConfig === "object" && taskConfig !== null ? { ...taskConfig, ...(Array.isArray(taskConfig.skills) ? { skills: detachSkillLists(taskConfig.skills) } : {}) } : taskConfig;
+    asResumeConfigRefusal("taskConfig", () => assertResumeConfigRecord(taskConfig));
+    let config = { ...taskConfig, ...(Array.isArray(taskConfig.skills) ? { skills: detachSkillLists(taskConfig.skills) } : {}) };
     internals = internals !== undefined ? { ...internals } : undefined;
-    const store = resolveCheckpointStore(config, runner.deps);
+    const store = asResumeConfigRefusal(checkpointStoreSeat(config), () => resolveCheckpointStore(config, runner.deps));
     if (!store) {
         throw new CheckpointError("checkpoint.not_found", "no CheckpointStore wired — cannot resume (set RunnerDeps.checkpointStore or taskConfig.checkpointStore)");
     }
@@ -39,7 +41,7 @@ export async function resumeAdmission(input) {
     const resumeSignal = config.signal;
     let suppliedMessage;
     refuseRetiredModeSeed(cp.state);
-    refuseResumeDoors(config, cp.state.inheritedGate);
+    config = refuseResumeDoors(config, cp.state.inheritedGate, runner.deps, sessions);
     const parkedSteers = readPendingSteerQueue(cp.state);
     if (outcomeGate === "wake") {
         suppliedMessage = outcome.message;

package/dist/core/runner/resume-apply.d.ts

@@ -1,9 +1,10 @@
 import { type Checkpoint, type PendingSteerEntry, type ResumeOutcome } from "../checkpoint-store.js";
+import { type LegMods } from "../mods/stations.js";
 import type { ResumeRun, ResumeTaskConfig, RunInternals, RunnerDepsSeat } from "./contracts.js";
 export interface ResumeApplyInput<R> {
     /** borrowed-readonly — the pending row (session id, pending call, inherited chain, ledger, hands cwd). */
     cp: Checkpoint;
-    /** borrowed-readonly — the config snapshot (`hooks`, `taskId`, `signal`, the policy seats). */
+    /** borrowed-readonly — the config snapshot (`mods`, `taskId`, `signal`, the policy seats). */
     config: ResumeTaskConfig;
     /** borrowed-readonly — the internals snapshot (delegation identity facts for the screen's envelope). */
     internals: RunInternals | undefined;
@@ -27,7 +28,7 @@ export interface ResumeApplyInput<R> {
     plainParkOutcome: Extract<ResumeOutcome, {
         gate: "wake" | "resource_limit";
     }> | undefined;
-    /** borrowed-readonly — the Runner's deployment deps, read LIVE through the Runner (reads `hooks`, `onError`, `lockedConfig`, `basePolicyForResumeEdit`, `toolPolicy` — the last three AFTER this rung's awaits); the one home of why it is a
+    /** borrowed-readonly — the Runner's deployment deps, read LIVE through the Runner (reads `mods`, `onError`, `lockedConfig`, `basePolicyForResumeEdit`, `toolPolicy` — the last three AFTER this rung's awaits); the one home of why it is a
      *  seat and not a captured object is {@link RunnerDepsSeat}. */
     runner: RunnerDepsSeat;
     /** borrowed-readonly — the orchestrator's delegation-facts fold (a lane may not name the orchestrator; the driver hands it in). */
@@ -40,6 +41,8 @@ export interface ResumeApplyInput<R> {
 export interface ResumeApplyResult {
     /** The screen's `additionalContext` for the wake message, when a screen ran and supplied one. */
     wakeHookContext: string | undefined;
+    /** The resumed leg's bus, when the wake-message screen made this rung admit it (the leg adopts it). */
+    legMods?: LegMods;
     /** The approval lane's twin WITH its minted settlement record (undefined on every other lane). */
     plainPolicyOutcome: Extract<ResumeOutcome, {
         gate: "policy_ask";

package/dist/core/runner/resume-apply.js

@@ -1,8 +1,9 @@
 import { snapshotActorAssertion } from "../../internal/llm.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { CheckpointError, remainingBudgetMicroUsd } from "../checkpoint-store.js";
-import { mintHookInvocationIdentity, resolveHookTimeoutMs, runHookSeat } from "../hooks.js";
 import { chainPolicyOnLeg, chainTopAnchors } from "./child-tree.js";
+import { mintHookInvocationIdentity } from "../hooks.js";
+import { admitLegMods, classicEventBase, failedHandlerClause, screenUserPrompt } from "../mods/stations.js";
 import { checkToolPolicyProjection, policyCannotAnswer, refuseOutOfContractDecision } from "../tool-policy.js";
 import { callFaceSeat, parkedCallFaceOf } from "../tool-roster.js";
 import { readCallTarget } from "../effective-path-target.js";
@@ -10,7 +11,7 @@ import { inlineUntrusted } from "../untrusted-text.js";
 import { deepJsonEqual, describeSuppliedValue, mintDecideRecord } from "./decide-continuation.js";
 import { orgVerdictBeforeClaim } from "./permission-rule-lanes.js";
 import { chainCannotJudge } from "./call-hook-stations.js";
-import { asThrownError, thrownText } from "../thrown-value.js";
+import { thrownText } from "../thrown-value.js";
 import { wireOf } from "../tool-name-readings.js";
 import { parkedSkillApprovalRefusal } from "../skill-grant.js";
 import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, normalizeSkills } from "./synthetic-tools.js";
@@ -19,10 +20,12 @@ export async function resumeApply(input) {
     const { cp, config, internals, outcomeGate, wakeMessage, resumeSignal, recheckGovernanceWindow, plainReviewOutcome, plainParkOutcome, runner, effectiveDelegationFacts } = input;
     let plainPolicyOutcome = input.plainPolicyOutcome;
     let wakeHookContext;
+    let legMods;
     if (outcomeGate === "wake" && wakeMessage !== undefined) {
-        const resumeScreenHooks = config.hooks ?? runner.deps.hooks;
-        const screen = resumeScreenHooks?.userPromptSubmit;
-        if (screen !== undefined && resumeSignal?.aborted !== true) {
+        if (resumeSignal?.aborted !== true) {
+            legMods = await admitLegMods({ spec: config, deps: runner.deps, sessionId: cp.sessionId });
+        }
+        if (legMods !== undefined && legMods.bus.hasHandlers("classic.UserPromptSubmit")) {
             const screenedMessage = wakeMessage;
             const identity = mintHookInvocationIdentity({
                 sessionId: cp.sessionId,
@@ -35,45 +38,24 @@ export async function resumeApply(input) {
                 ...(internals?.spawnAgentType !== undefined ? { agentType: internals.spawnAgentType } : {}),
                 ...(internals?.parentToolCallId !== undefined ? { parentToolCallId: internals.parentToolCallId } : {}),
             });
-            const screenTimeoutMs = resolveHookTimeoutMs(resumeScreenHooks?.timeoutMs, (badErr) => {
-                try {
-                    runner.deps.onError?.(asThrownError(badErr), { phase: "hook", sessionId: cp.sessionId });
-                }
-                catch {
-                }
-            }, resumeScreenHooks);
-            let decision;
-            try {
-                const seat = await runHookSeat("userPromptSubmit", { timeoutMs: screenTimeoutMs, ...(resumeSignal !== undefined ? { signal: resumeSignal } : {}), abortEnds: true }, (sig) => screen(screenedMessage.text, {
-                    identity,
-                    signal: sig,
-                    source: "resume_message",
-                    ...(screenedMessage.inputId !== undefined ? { inputId: screenedMessage.inputId } : {}),
-                    ...(screenedMessage.actor !== undefined ? { actor: snapshotActorAssertion(screenedMessage.actor) } : {}),
-                }));
-                if (seat.expired) {
-                    if (seat.cause === "aborted")
-                        throw new CheckpointError("checkpoint.resume_aborted", "the resume was aborted while the deployment's userPromptSubmit hook was still screening this wake message — the checkpoint stays pending and is resumable with a live signal");
-                    throw new CheckpointError("steering.blocked_by_hook", `the deployment's userPromptSubmit hook did not answer within its ${screenTimeoutMs}ms bound while screening this wake message; the resume was refused (fail-closed) and the checkpoint stays pending`);
-                }
-                decision = seat.value;
+            const screen = await screenUserPrompt(legMods.bus, {
+                ...classicEventBase(identity),
+                prompt: screenedMessage.text,
+                source: "resume_message",
+                ...(screenedMessage.inputId !== undefined ? { inputId: screenedMessage.inputId } : {}),
+                ...(screenedMessage.actor !== undefined ? { actor: snapshotActorAssertion(screenedMessage.actor) } : {}),
+            }, resumeSignal);
+            if (screen?.kind === "aborted") {
+                throw new CheckpointError("checkpoint.resume_aborted", "the resume was aborted while the deployment's userPromptSubmit hook was still screening this wake message — the checkpoint stays pending and is resumable with a live signal");
             }
-            catch (hookErr) {
-                if (hookErr instanceof CheckpointError)
-                    throw hookErr;
-                const err = asThrownError(hookErr);
-                try {
-                    runner.deps.onError?.(err, { phase: "hook", sessionId: cp.sessionId });
-                }
-                catch {
-                }
-                throw new CheckpointError("steering.blocked_by_hook", `the deployment's userPromptSubmit hook crashed while screening this wake message (${inlineUntrusted(err.message)}); the resume was refused (fail-closed) and the checkpoint stays pending`);
+            if (screen?.kind === "failed") {
+                throw new CheckpointError("steering.blocked_by_hook", `the deployment's userPromptSubmit hook ${failedHandlerClause(screen)} while screening this wake message; the resume was refused (fail-closed) and the checkpoint stays pending`);
             }
-            if (decision?.block !== undefined && decision.block !== "") {
-                throw new CheckpointError("steering.blocked_by_hook", `the deployment's userPromptSubmit hook blocked this wake message: ${inlineUntrusted(decision.block)}`);
+            if (screen?.block !== undefined && screen.block !== "") {
+                throw new CheckpointError("steering.blocked_by_hook", `the deployment's userPromptSubmit hook blocked this wake message: ${inlineUntrusted(screen.block)}`);
             }
-            if (decision?.additionalContext !== undefined && decision.additionalContext !== "") {
-                wakeHookContext = decision.additionalContext;
+            if (screen?.additionalContext !== undefined && screen.additionalContext !== "") {
+                wakeHookContext = screen.additionalContext;
             }
             if (recheckGovernanceWindow !== undefined)
                 await recheckGovernanceWindow();
@@ -192,5 +174,5 @@ export async function resumeApply(input) {
     if (outcomeForStore === undefined) {
         throw new CheckpointError("checkpoint.invalid_outcome", `resume outcome (gate "${describeSuppliedValue(outcomeGate)}") matched the checkpoint gate but no lane captured it — refusing pre-CAS rather than passing the caller's live object to the store and the resumed run`);
     }
-    return await input.next({ wakeHookContext, plainPolicyOutcome, outcomeForStore });
+    return await input.next({ wakeHookContext, ...(legMods !== undefined ? { legMods } : {}), plainPolicyOutcome, outcomeForStore });
 }

package/dist/core/runner/resume-checkpoint-screen.d.ts

@@ -7,6 +7,7 @@ export interface ResumeCheckpointScreenInput {
     resumeSignal: AbortSignal | undefined;
     /** borrowed-readonly — the internals snapshot (the re-supplied chain, the requested cwd). */
     internals: RunInternals | undefined;
+    /** borrowed-readonly — the roster the resume hands (`ResumeTaskConfig.tools`), as the caller mounts it. */ tools: unknown;
     /** borrowed-readonly — the Runner's deployment deps, read LIVE through the Runner (reads `permissionRuleStore` and `executionEnvFactory`); the one home of why it is a
      *  seat and not a captured object is {@link RunnerDepsSeat}. */
     runner: RunnerDepsSeat;

package/dist/core/runner/resume-checkpoint-screen.js

@@ -6,8 +6,11 @@ import { judgeCheckpointRequirements } from "../checkpoint-requirements.js";
 import { constraintChainDigest, constraintChainEntryOfSuppliedLayer } from "../tool-policy.js";
 import { readFrozenSkillGrants } from "../skill-grant.js";
 import { chainInstallationGaps, chainInstallationRefusal } from "./child-tree.js";
+import { screeningInstallationsOf, unraisableGuardsOf } from "../mods/stations.js";
+import { refusePersistedToolNames, refuseRenamedDelegationMounts } from "./sub-agent-deny-lists.js";
+import { asResumeConfigRefusal } from "../mode-policy.js";
 export function resumeCheckpointScreen(input) {
-    const { cp, resumeSignal, internals, runner } = input;
+    const { cp, resumeSignal, internals, tools, runner } = input;
     const { realApproval: realApprovalRow, face: faceRow, f012: f012Row } = CHECKPOINT_FEATURES;
     if (checkpointVersionOf(cp) > MAX_SUPPORTED_CHECKPOINT_VERSION) {
         throw new CheckpointError("checkpoint.unsupported_version", `checkpoint requires reader capabilities this worker lacks (row format v${checkpointVersionOf(cp)}; this worker reads up to v${MAX_SUPPORTED_CHECKPOINT_VERSION}) — resume it on a worker at or above the version that parked it`, { reason: "version_newer" });
@@ -84,6 +87,8 @@ export function resumeCheckpointScreen(input) {
             "the restored workspace's own mount path is authoritative for the task root. Drop requestedCwd on resume legs " +
             "(the checkpoint stays pending and is resumable without it).");
     }
+    asResumeConfigRefusal("inheritedGate", () => refusePersistedToolNames((internals?.toolCeiling ?? undefined) === undefined ? cp.state.toolCeiling : undefined, cp.state.inheritedGate?.constraintChain, (internals?.ownToolLists ?? undefined) === undefined ? cp.state.ownToolLists : undefined));
+    asResumeConfigRefusal("taskConfig", () => refuseRenamedDelegationMounts(tools));
     if (cp.state.inheritedGate?.requiresParentConstraint === true) {
         const supplied = internals?.inheritedGate?.parentConstraints?.length ?? 0;
         if (supplied === 0) {
@@ -126,6 +131,9 @@ export function resumeCheckpointScreen(input) {
         if (gaps.length > 0)
             throw chainInstallationRefusal(gaps, true);
     }
+    const unraisable = unraisableGuardsOf(screeningInstallationsOf(internals?.inheritedGate?.parentConstraints ?? []));
+    if (unraisable !== undefined)
+        throw new CheckpointError("resume.parent_constraint_mismatch", `${unraisable}; rejected pre-CAS (the checkpoint stays pending)`);
     const resumeInternals = internals?.inheritedGate?.parentConstraints !== undefined
         ? {
             ...internals,

package/dist/core/runner/resume-internals-and-config.d.ts

@@ -1,6 +1,6 @@
 /**
  * The resume ladder's INTERNALS-AND-CONFIG rung (E7), verbatim from `Runner.resumeStream`:
- * the locked-policy guard on the resume-edit seat, the principal and placement identity-continuity rungs,
+ * the inherited constraints' retired-member door, the principal and placement identity-continuity rungs,
  * and the governance-window ENTRANCE check for a row that still owes a delivery.
  *
  * Synchronous by construction, with the ladder's ONE await at this rung handed back instead of taken: the
@@ -14,13 +14,13 @@ import type { ResumeTaskConfig, RunInternals, RunnerDepsSeat } from "./contracts
 export interface ResumeInternalsAndConfigInput {
     /** borrowed-readonly — the pending row (recorded principal, placement root, parked steers, background tasks). */
     cp: Checkpoint;
-    /** borrowed-readonly — the config snapshot (`basePolicyForResumeEdit`, `principal`). */
+    /** borrowed-readonly — the config snapshot (`principal`). */
     config: ResumeTaskConfig;
     /** borrowed-readonly — the internals snapshot (`placementRoot`). */
     internals: RunInternals | undefined;
     /** borrowed-readonly — the ONE read of the outcome discriminant (a bare resource_limit continue owes nothing). */
     outcomeGate: ResumeOutcome["gate"];
-    /** borrowed-readonly — the Runner's deployment deps, read LIVE through the Runner (reads `lockedConfig`, `usageWindowStore`, `usageWindows`); the one home of why it is a
+    /** borrowed-readonly — the Runner's deployment deps, read LIVE through the Runner (reads `usageWindowStore`, `usageWindows`); the one home of why it is a
      *  seat and not a captured object is {@link RunnerDepsSeat}. */
     runner: RunnerDepsSeat;
 }