@sema-agent/core 7.52.0 → 7.53.0

package/dist/core/roles.js

@@ -1,11 +1,29 @@
 import { selectModel } from "./select-model.js";
 import { MODEL_ROLES } from "./types.js";
 export { MODEL_ROLES } from "./types.js";
+function catalogModel(ref, models) {
+    const m = models != null && (typeof models === "object" || typeof models === "function") && Object.hasOwn(models, ref) ? models[ref] : undefined;
+    return m || undefined;
+}
+function modelBindingRefusal(seat, reason, message) {
+    const e = new Error(message);
+    e.code = "config.unknown_role";
+    e.detail = { field: seat, reason };
+    return e;
+}
+function bindingShown(value) {
+    if (typeof value === "string")
+        return JSON.stringify(value.length > 80 ? `${value.slice(0, 80)}…` : value);
+    return value === null ? "null" : Array.isArray(value) ? "a list" : `a ${typeof value}`;
+}
+function unknownModelRefRefusal(ref, seat) {
+    return modelBindingRefusal(seat, "unknown_model_ref", `Unknown model ref ${bindingShown(ref)} in ${seat}. Provide it in RunnerDeps.models or pass a Model object.`);
+}
 export function resolveModel(ref, models) {
     if (typeof ref !== "string") {
         return ref;
     }
-    const m = models !== undefined && Object.hasOwn(models, ref) ? models[ref] : undefined;
+    const m = catalogModel(ref, models);
     if (!m) {
         throw new Error(`Unknown model ref "${ref}". Provide it in RunnerDeps.models or pass a Model object.`);
     }
@@ -33,7 +51,19 @@ export function expandTiers(models, tiers) {
     out[TIER_ALIAS_VIA] = aliasVia;
     const bound = (name) => {
         const b = Object.hasOwn(tiers, name) ? tiers[name] : undefined;
-        return b === undefined ? undefined : resolveModel(b, models);
+        if (b === undefined)
+            return undefined;
+        const seat = `tiers.${name}`;
+        if (typeof b === "string") {
+            const held = catalogModel(b, models);
+            if (held === undefined)
+                throw unknownModelRefRefusal(b, seat);
+            return held;
+        }
+        if (typeof b !== "object" || b === null || Array.isArray(b)) {
+            throw modelBindingRefusal(seat, "not_a_model_ref", `${seat} is ${bindingShown(b)}, not a model reference — a tier binds a catalog model name or a Model object.`);
+        }
+        return b;
     };
     const ownKey = (k) => models !== undefined && Object.hasOwn(models, k) && Boolean(models[k]);
     const landing = (t, self) => {
@@ -131,13 +161,16 @@ const FALLBACK = {
     classifier: ["summarize", "default"],
     consolidate: ["summarize"],
 };
-function specParts(s) {
+function specParts(s, seat = "a role seat") {
     if (s == null) {
         return {};
     }
     if (typeof s === "string") {
         return { model: s };
     }
+    if (typeof s !== "object" && typeof s !== "function") {
+        throw modelBindingRefusal(seat, "not_a_model_ref", `${seat} is ${bindingShown(s)}, not a model reference — a role binds a catalog model name, a Model object or a { model, select, thinking, systemPrompt } record.`);
+    }
     if ("id" in s && "api" in s) {
         return { model: s };
     }
@@ -191,12 +224,17 @@ function mergeRoles(base, over) {
     }
     return out;
 }
-function partsModel(parts, models) {
+function partsModel(parts, models, seat = "a role seat") {
     if (parts.model) {
         return resolveModel(parts.model, models);
     }
     if (parts.select) {
-        return selectModel(models ?? {}, parts.select);
+        const needs = parts.select.needs;
+        if (needs != null && !Array.isArray(needs)) {
+            throw modelBindingRefusal(`${seat}.select`, "not_a_model_ref", `${seat}.select.needs is ${bindingShown(needs)}, not a list of capabilities (vision / reasoning).`);
+        }
+        const held = models != null && typeof models === "object" ? Object.values(models).filter(Boolean) : [];
+        return selectModel(held, parts.select);
     }
     return undefined;
 }
@@ -204,7 +242,7 @@ export function resolveTaskModel(spec, deps) {
     const start = spec.modelRole ?? "default";
     assertKnownRole(start, "modelRole");
     if (spec.model) {
-        const startParts = specParts(mergeRoles(deps.roles, spec.roles)[start]);
+        const startParts = specParts(mergeRoles(deps.roles, spec.roles)[start], `roles.${start}`);
         return {
             model: resolveModel(spec.model, deps.models),
             modelRef: spec.model,
@@ -213,10 +251,10 @@ export function resolveTaskModel(spec, deps) {
         };
     }
     const merged = mergeRoles(deps.roles, spec.roles);
-    const startSystemPrompt = specParts(merged[start]).systemPrompt;
+    const startSystemPrompt = specParts(merged[start], `roles.${start}`).systemPrompt;
     for (const role of [start, ...FALLBACK[start]]) {
-        const parts = specParts(merged[role]);
-        const fromParts = partsModel(parts, deps.models);
+        const parts = specParts(merged[role], `roles.${role}`);
+        const fromParts = partsModel(parts, deps.models, `roles.${role}`);
         const model = fromParts ?? roleTierModel(role, deps.models);
         if (model) {
             const modelRef = fromParts !== undefined ? (parts.model ?? model) : (ROLE_TIER_DEFAULTS[role] ?? model);
@@ -227,5 +265,17 @@ export function resolveTaskModel(spec, deps) {
 }
 export function roleModelIfSet(role, spec, deps) {
     const merged = mergeRoles(deps.roles, spec.roles);
-    return partsModel(specParts(merged[role]), deps.models) ?? roleTierModel(role, deps.models);
+    const seat = `roles.${role}`;
+    const parts = specParts(merged[role], seat);
+    const named = parts.model;
+    if (named) {
+        if (typeof named === "string") {
+            if (catalogModel(named, deps.models) === undefined)
+                throw unknownModelRefRefusal(named, seat);
+        }
+        else if (typeof named !== "object" || Array.isArray(named)) {
+            throw modelBindingRefusal(seat, "not_a_model_ref", `${seat}.model is ${bindingShown(named)}, not a model reference — a role binds a catalog model name or a Model object.`);
+        }
+    }
+    return partsModel(parts, deps.models, seat) ?? roleTierModel(role, deps.models);
 }

package/dist/core/rule-lane-reads.js

@@ -65,7 +65,7 @@ export function normalizeOrgGateVerdict(answer, unreadable) {
     if ((behavior !== "deny" && behavior !== "ask") || typeof rule !== "string")
         return clean({ status: "unavailable", disclosures: [unreadable] });
     const reason = ownDataValue(verdict, "unreadable");
-    const unreadableCell = behavior === "ask" && typeof reason === "string" ? { unreadable: reason } : {};
+    const unreadableCell = typeof reason === "string" ? { unreadable: reason } : {};
     return clean({ status: "available", verdict: clean({ behavior: behavior, rule, ...unreadableCell }), ...revisionCell });
 }
 function copiedDenial(raw, ruleTexts) {

package/dist/core/runner/contracts.d.ts

@@ -2938,6 +2938,7 @@ export interface ManualCompactRef {
  */
 export type EndOfTaskCompaction = {
     compacted: boolean;
+    pass?: string;
     tokensBefore?: number;
     freedTokens?: number;
     triggerTokens?: number;

package/dist/core/runner/gate-exit.js

@@ -5,6 +5,7 @@ import { isProtectedWrite } from "../tool-registry.js";
 import { attestationOf, decisionText } from "../tool-policy.js";
 import { pathDenialCardOf } from "../../tools/fs/safety.js";
 import { boundInputHashOf } from "../canonical-json.js";
+import { argsAsTheToolReads, argsReadFrom } from "../effective-path-target.js";
 import { askUnresolvableRemedySeat } from "../ask-unresolvable-notice.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
@@ -127,7 +128,7 @@ export function createSettlementLedger(call) {
             return { decision, deniedBy: refusal ? "ask_resolution" : "policy" };
         },
         keepForBytes(runs) {
-            if (settled !== undefined && settled.licensed !== boundInputHashOf(runs))
+            if (settled !== undefined && settled.licensed !== boundInputHashOf(runs) && settled.licensed !== boundInputHashOf(argsReadFrom(runs)))
                 settled = undefined;
         },
         causeOf(decision) {
@@ -220,7 +221,7 @@ export async function exitGate(pass) {
     const { input, toolName, toolCallId, ledger, notifyPermissionDenied } = pass;
     if (pass.decision.action === "deny") {
         if (pass.decision.updatedInput !== undefined) {
-            pass.currentInput = pass.decision.updatedInput;
+            pass.currentInput = argsAsTheToolReads(pass.req, pass.decision.updatedInput);
         }
         if (pass.deniedBy === undefined)
             throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
@@ -265,7 +266,7 @@ export async function exitGate(pass) {
     if (pass.decision.action === "allow") {
         const rw = pass.decision.updatedInput !== undefined ? pass.decision.updatedInput : pass.policyRewrite;
         if (rw !== undefined)
-            pass.currentInput = rw;
+            pass.currentInput = argsAsTheToolReads(pass.req, rw);
     }
     ledger.keepForBytes(pass.currentInput);
     const release = pass.arbitration?.kind === "released" ? pass.arbitration : (() => { if (ledger.settled !== undefined)

package/dist/core/runner/mcp-redial.d.ts

@@ -15,22 +15,28 @@
  */
 import type { AgentTool } from "../../internal/harness.js";
 import type { McpDroppedTool, McpReconnectResult, MaterializedMcp, McpToolAxis } from "../mcp.js";
-import type { RunnerDeps, ToolEffect } from "../types.js";
+import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
 import type { IrreversibilityTier, ToolFaceSnapshot } from "./contracts.js";
 import type { RosterBuilder, ToolRosterDeltaSeat } from "../tool-roster.js";
+import type { McpInstructionsEntry } from "../prompt-section-seat.js";
 /** One server's assertion about its own prefix domain — the shape both faces reduce to. `tools` is
  *  the roster the domain must END UP with (empty withdraws it); `added`/`removed` are the reporting
- *  half and never drive the swap. */
+ *  half and never drive the swap. `instructions`: the server's current connection's instructions entry, when the face that produced
+ *  the delta hands it back (a refresh does; a re-dial queues its new text itself). */
 export interface McpRosterDelta {
     server: string;
     prefix: string;
     tools: AgentTool[];
     axes: McpToolAxis[];
     dropped: McpDroppedTool[];
+    instructions?: McpInstructionsEntry;
 }
 /** The seats a roster application writes through. Every one of them is borrowed from the phase that
  *  minted it — this module owns nothing. */
 export interface McpRosterApplyInput {
+    /** borrowed-readonly — the run's spec; only `excludeAllTools` is read: the valve's whole-face switch decides what a live roster
+     *  change may mount, beside the selector (`valveLeaves`). */
+    spec: Pick<TaskSpec, "excludeAllTools">;
     /** borrowed-readonly — the frozen tool face; its selector keeps a tool the leg may not use from ever
      *  being mounted by a face the model or a host can trigger. */
     toolFaceSnapshot: Pick<ToolFaceSnapshot, "selector">;
@@ -48,20 +54,53 @@ export interface McpRosterApplyInput {
     }>;
     /** borrowed-mutable — the run's shared roster. */
     roster: RosterBuilder;
+    /** borrowed-readonly — the run's frozen MCP server declarations: a roster reading is of a declared server, and a name none is declared under holds nothing. */
+    declared: ReadonlyArray<{
+        readonly name: string;
+    }>;
+    /** borrowed-mutable — the materialization's instructions delta lane; a roster change settles the server's adds on it. */
+    instructionsDelta: MaterializedMcp["instructionsDelta"];
+}
+/** What one application did to the server's domain on the roster — read off the roster before and after the swap, the ONE source of
+ *  "how many of this server's tools are mounted" for the re-dial's notice and receipt and the refresh tool's receipt. A name the
+ *  valve left out, a name the deployment's `toolFaces` overlay refused and a name the server listed but the roster did not take are
+ *  all simply absent from `mounted`. */
+export interface McpRosterReading {
+    /** The names of the server's tools the roster holds after the application, in wire order. */
+    mounted: string[];
+    /** The names `mounted` holds that the roster did not hold before. */
+    added: string[];
+    /** The names the roster held before that `mounted` no longer holds. */
+    removed: string[];
+    /** The names the server listed that the roster did not take (the valve's, the overlay's). */
+    excluded: string[];
 }
 /** What one application did, for the caller's receipt. `applied:false` means the axis fold refused
- *  and the domain was left exactly as it was (the tables restored) — no roster write happened. */
-export type McpRosterApplyOutcome = {
+ *  and the domain was left exactly as it was (the tables restored) — no roster write happened, so `mounted` is what it held. */
+export type McpRosterApplyOutcome = ({
     applied: true;
-    pushed: number;
-    excluded: string[];
-} | {
+} & McpRosterReading) | ({
     applied: false;
     foldError: string;
-};
+} & McpRosterReading);
+/** What the roster holds of one server with no swap made — the reading of an arm that asserted no roster (a failed refresh, a refused re-dial, a fold refusal).
+ *  A name no server is declared under holds nothing, even when it mints a declared server's prefix. */
+export declare function rosterHolding(input: Pick<McpRosterApplyInput, "roster" | "declared">, serverName: string): McpRosterReading;
+/** A refresh or re-dial result read off the roster instead of the server's own listing: `toolCount` is the tools mounted, `added` /
+ *  `removed` the names that came onto / left the roster, and — on a result that asserts a roster — `tools` the roster's tools of the
+ *  server (with `axes` cut to them), so `toolCount === tools.length`. One meaning, the one `MaterializedMcp.refresh` / `reconnect` give
+ *  for their own handles. */
+export declare function settledOnRoster<T extends {
+    toolCount: number;
+    added: string[];
+    removed: string[];
+    tools?: AgentTool[];
+    axes?: McpToolAxis[];
+}>(result: T, reading: McpRosterReading, roster: Pick<RosterBuilder, "tools">): T;
 /**
- * Apply one server's delta to the live roster. Behavior-identical to the body this was extracted
- * from; the comments are the extracted reasoning, not new claims.
+ * Apply one server's delta to the live roster, and settle the server's instruction adds on the delta lane: the teaching answer over the
+ * roster after the swap, against the lane's ledger of what the model holds (both faces — the model's refresh and the host's re-dial —
+ * through this one step).
  */
 export declare function applyMcpRosterDelta(input: McpRosterApplyInput, delta: McpRosterDelta): McpRosterApplyOutcome;
 /** The seats the post-application commit writes through. */
@@ -105,5 +144,8 @@ export interface McpRedialInput extends McpRosterApplyInput, McpRosterCommitInpu
  * leave the model holding tools that can only fail), and an arm that never touched the connection —
  * unknown name, revoked server, re-dial already in flight, disposed materialization — asserts nothing
  * and the mounted roster is left alone.
+ *
+ * The result it hands back counts what the ROSTER took: `toolCount` is the server's tools mounted after the swap, `added` /
+ * `removed` the names that came onto / left the roster, and the notice reads the same three — one source for "how many are mounted".
  */
 export declare function redialMcpServer(input: McpRedialInput, server: string): Promise<McpReconnectResult>;

package/dist/core/runner/mcp-redial.js

@@ -1,9 +1,31 @@
+import { valveLeaves } from "../../agents/tool-filter.js";
+import { instructionsTaught, instructionsTold, tellInstructions, toolNamesOfServer, withdrawInstructionAdds } from "../mounted-mcp.js";
 import { deliverEngineNotice } from "../types.js";
 import { thrownText } from "../thrown-value.js";
+export function rosterHolding(input, serverName) {
+    const mounted = input.declared.some((d) => d.name === serverName) ? toolNamesOfServer(input.roster.tools.map((t) => t.name), serverName) : [];
+    return { mounted, added: [], removed: [], excluded: [] };
+}
+export function settledOnRoster(result, reading, roster) {
+    const settled = { ...result, toolCount: reading.mounted.length, added: reading.added, removed: reading.removed };
+    if (result.tools === undefined)
+        return settled;
+    const held = new Set(reading.mounted);
+    return { ...settled, tools: roster.tools.filter((t) => held.has(t.name)), ...(result.axes !== undefined ? { axes: result.axes.filter((a) => held.has(a.name)) } : {}) };
+}
+function settleInstructions(lane, delta, taught) {
+    if (!taught)
+        return withdrawInstructionAdds(lane, delta.server);
+    if (delta.instructions !== undefined && !instructionsTold(lane, delta.server) && !lane.pendingAdds.some((e) => e.server === delta.server))
+        tellInstructions(lane, delta.instructions);
+}
 export function applyMcpRosterDelta(input, delta) {
-    const { toolFaceSnapshot, withFaces, remoteToolOffload, foldProtocolAxes, toolEffects, axisExplicitNegatives, roster } = input;
-    const pushable = delta.tools.filter((t) => toolFaceSnapshot.selector.admits(t));
-    const excluded = delta.tools.filter((t) => !toolFaceSnapshot.selector.admits(t)).map((t) => t.name);
+    const { spec, toolFaceSnapshot, withFaces, remoteToolOffload, foldProtocolAxes, toolEffects, axisExplicitNegatives, roster } = input;
+    const domainNow = () => toolNamesOfServer(roster.tools.map((t) => t.name), delta.server);
+    const before = domainNow();
+    const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
+    const pushable = delta.tools.filter(leaves);
+    const valveExcluded = delta.tools.filter((t) => !leaves(t)).map((t) => t.name);
     const domainSnapshot = (m) => new Map([...m].filter(([name]) => name.startsWith(delta.prefix)));
     const restoreDomain = (m, snap) => {
         for (const name of [...m.keys()])
@@ -19,15 +41,20 @@ export function applyMcpRosterDelta(input, delta) {
     for (const name of priorDomainNegatives.keys())
         axisExplicitNegatives.delete(name);
     try {
-        foldProtocolAxes(delta.axes.filter((a) => !excluded.includes(a.name)), "MCP");
+        foldProtocolAxes(delta.axes.filter((a) => !valveExcluded.includes(a.name)), "MCP");
     }
     catch (foldErr) {
         restoreDomain(toolEffects, priorDomainEffects);
         restoreDomain(axisExplicitNegatives, priorDomainNegatives);
-        return { applied: false, foldError: thrownText(foldErr) };
+        settleInstructions(input.instructionsDelta, delta, instructionsTaught(leaves, delta.server, roster.tools, delta.tools));
+        return { applied: false, foldError: thrownText(foldErr), ...rosterHolding(input, delta.server) };
     }
     roster.replaceDomain(delta.prefix, withFaces(pushable, delta.server).map((t) => remoteToolOffload(t)), { source: "mcp", mountedBy: "optional", origin: { peer: delta.server } });
-    return { applied: true, pushed: pushable.length, excluded };
+    const mounted = domainNow();
+    const heldNow = new Set(mounted);
+    const heldBefore = new Set(before);
+    settleInstructions(input.instructionsDelta, delta, instructionsTaught(leaves, delta.server, roster.tools, delta.tools));
+    return { applied: true, mounted, added: mounted.filter((n) => !heldBefore.has(n)), removed: before.filter((n) => !heldNow.has(n)), excluded: delta.tools.map((t) => t.name).filter((n) => !heldNow.has(n)) };
 }
 export async function commitMcpRosterChanges(input) {
     await input.rebuildHarnessToolsRef.current?.();
@@ -38,9 +65,11 @@ export async function commitMcpRosterChanges(input) {
     return undefined;
 }
 export async function redialMcpServer(input, server) {
-    const result = await input.mcp.reconnect(server);
-    if (result.tools !== undefined) {
-        const outcome = applyMcpRosterDelta(input, { server: result.server, prefix: result.prefix, tools: result.tools, axes: result.axes ?? [], dropped: result.dropped ?? [] });
+    const listed = await input.mcp.reconnect(server);
+    let result = settledOnRoster(listed, rosterHolding(input, listed.server), input.roster);
+    if (listed.tools !== undefined) {
+        const outcome = applyMcpRosterDelta(input, { server: listed.server, prefix: listed.prefix, tools: listed.tools, axes: listed.axes ?? [], dropped: listed.dropped ?? [] });
+        result = settledOnRoster(listed, outcome, input.roster);
         if (!outcome.applied)
             input.deps.onError?.(Object.assign(new Error(`MCP re-dial of "${server}" connected but its safety-axis fold refused, so its tools were not mounted: ${outcome.foldError}`), { code: "mcp.server_unavailable" }), { phase: "mcp", sessionId: input.sessionId });
         const ungated = await commitMcpRosterChanges(input);

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -117,12 +117,15 @@ export interface PermissionRuleLanes {
     } | undefined;
 }
 /** The ORG lane: the org's verdict about one call, off the store view `read` supplies — the gate's `orgRules` face over the
- *  call's pinned read ({@link createPermissionRuleLanes}), and {@link orgVerdictBeforeClaim} over a view of its own. */
+ *  call's pinned read ({@link createPermissionRuleLanes}), and {@link orgVerdictBeforeClaim} over a view of its own.
+ *  `onDegraded` receives the snapshot's degraded line ({@link describeUnreadableOrgRows}) on every adjudication over a
+ *  snapshot carrying a row this layer cannot read. */
 export declare function orgRuleLane(cfg: {
     read: (toolCallId: string) => Promise<Pick<EffectivePermissionRules, "org">>;
     questionToolMounted: boolean;
     questionToolName: string;
     onRevisionDefect: (message: string) => void;
+    onDegraded: (message: string) => void;
 }): NonNullable<PermissionRuleLanes["org"]>;
 /** The org's CURRENT verdict about a parked call, read by the resume entry before the claim (the row's session and principal,
  *  bounded like the gate's wait; unreadable ⇒ unavailable). The mount and a revision defect are the resumed leg's facts, so
@@ -172,7 +175,7 @@ export declare function createPermissionRuleLanes(cfg: {
     questionToolMounted: boolean;
     questionToolName: string;
     onRevisionDefect: (message: string) => void;
-    /** Sink for a judgment against the rows that threw. */
+    /** Sink for a judgment against the rows that threw, and for the org lane's degraded-snapshot line. */
     onDisclosure: (message: string) => void;
     /** The run's one reader of the person's rules: the call's ONE read, pinned, that the read station, the org lane and the
      *  personal lane all take (the lanes consume a reader; they do not make one). */

package/dist/core/runner/permission-rule-lanes.js

@@ -1,10 +1,10 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, domainRuleSubjectOf, faceRowsSpeakFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
+import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, domainRuleSubjectOf, escapeForDisclosure, faceRowsSpeakFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
 import { callTargetViewsOf, validatePath } from "../effective-path-target.js";
 import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
 import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
-import { orgRuleVerdictFor, settleOrgVerdictWithin } from "../permission-rule-org.js";
+import { describeUnreadableOrgRows, readOrgRules, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { ownerStoreOf } from "../permission-rule-provider.js";
 import { thrownText } from "../thrown-value.js";
@@ -18,12 +18,19 @@ export function inheritedAskRuleEvidence(provider) {
     return Object.freeze({ orgRevisionAbsent: org, orgRuleAbsent: org, personalRuleDotsAbsent: personal });
 }
 export function orgRevisionEvidenceOf(resolution, onDefect) {
-    const reported = resolution.revision;
+    let reported;
+    try {
+        reported = resolution.revision;
+    }
+    catch (err) {
+        onDefect(`the org rule partition's revision could not be read (${thrownText(err)}) — the adjudication stands, but the ask carries no revision evidence for this call`);
+        return {};
+    }
     if (reported === undefined)
         return {};
     if (typeof reported === "number" && Number.isFinite(reported))
         return { revision: reported };
-    onDefect(`the org rule partition reported revision ${JSON.stringify(reported)} — a snapshot revision is a finite number; ` +
+    onDefect(`the org rule partition reported revision ${typeof reported === "string" ? `"${escapeForDisclosure(reported)}"` : escapeForDisclosure(reported)} — a snapshot revision is a finite number; ` +
         `the adjudication stands, but the ask carries no revision evidence for this call`);
     return {};
 }
@@ -59,11 +66,16 @@ export function orgRuleLane(cfg) {
             if (resolution.status === "unavailable" || resolution.status === "ungoverned") {
                 return { status: "unavailable", disclosures: resolution.status === "ungoverned" ? ["the store reports no org partition while the provider declares one — unreadable governance, never an empty one"] : resolution.disclosures };
             }
-            const revisionCell = orgRevisionEvidenceOf(resolution, cfg.onRevisionDefect);
+            const reading = readOrgRules(resolution.rules);
+            if ("refused" in reading)
+                return { status: "unavailable", disclosures: [`the store's org resolution cannot be read (${reading.refused}) — unreadable governance, never an empty one`] };
             const command = req.args?.command;
-            if (!laneToolNamesOf(req).includes(PERSISTED_RULE_TOOL) || typeof command !== "string")
-                return { status: "available", ...revisionCell };
-            const verdict = orgRuleVerdictFor(resolution.rules, { tool: PERSISTED_RULE_TOOL, command });
+            const face = callPathFaceOf(req);
+            const verdict = reading.verdictFor({ tool: laneToolNamesOf(req), ...(typeof command === "string" ? { command } : {}), ...(face !== undefined ? { face } : {}) });
+            const revisionCell = orgRevisionEvidenceOf(resolution, cfg.onRevisionDefect);
+            const degraded = describeUnreadableOrgRows(reading.unreadable, revisionCell.revision);
+            if (degraded !== undefined)
+                cfg.onDegraded(degraded);
             return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
         },
     };
@@ -72,7 +84,7 @@ export function orgVerdictBeforeClaim(cfg, req) {
     const unreadable = { status: "unavailable", disclosures: [] };
     const read = () => {
         const store = ownerStoreOf(cfg.provider, cfg.principal, cfg.localOwnerDeclared);
-        return orgRuleLane({ read: () => store.effective({ sessionId: cfg.sessionId }), questionToolMounted: true, questionToolName: ASK_USER_QUESTION_TOOL_NAME, onRevisionDefect: () => undefined }).adjudicate(req);
+        return orgRuleLane({ read: () => store.effective({ sessionId: cfg.sessionId }), questionToolMounted: true, questionToolName: ASK_USER_QUESTION_TOOL_NAME, onRevisionDefect: () => undefined, onDegraded: () => undefined }).adjudicate(req);
     };
     return settleOrgVerdictWithin(Promise.resolve().then(read).catch(() => unreadable), unreadable, { timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS, ...(cfg.signal !== undefined ? { signal: cfg.signal } : {}) });
 }
@@ -101,7 +113,7 @@ export function createPermissionRuleLanes(cfg) {
             throw new Error(read.unreadable ?? "the store did not answer");
         return { org: read.org };
     };
-    const org = provider.partitions.org ? orgRuleLane({ read: orgViewOf, questionToolMounted: cfg.questionToolMounted, questionToolName: cfg.questionToolName, onRevisionDefect: cfg.onRevisionDefect }) : undefined;
+    const org = provider.partitions.org ? orgRuleLane({ read: orgViewOf, questionToolMounted: cfg.questionToolMounted, questionToolName: cfg.questionToolName, onRevisionDefect: cfg.onRevisionDefect, onDegraded: cfg.onDisclosure }) : undefined;
     const personalAdjudicate = async (req) => {
         if (anonymous && !cfg.localOwnerDeclared)
             return undefined;

package/dist/core/runner/person-path-rows.d.ts

@@ -237,7 +237,9 @@ export declare function ruleStoreUnreadableNotice(onNotice: RunnerDeps["onNotice
 /**
  * The run's ONE `permission.rule_row_dropped` notice (audience user): the person's store served project-scoped rows whose
  * scope root is not a complete absolute path, left out of the checks; minted by whichever read met them first, once per
- * run. The sentence names no path; the rows (bounded) ride the detail. The trace keeps every read's line.
+ * run. The sentence names no path; the rows ride the detail: `rule` is the rule text as the store served it, through the one
+ * reading ({@link noticeRuleText}) that `permission.allowed_tool_not_granted`'s `entries[].entry` uses too — the machine-read side carries the
+ * original, the sentence spells — and `scopeRoot` neutralized and bounded. The trace keeps every read's line.
  */
 export declare function ruleRowsDroppedNotice(onNotice: RunnerDeps["onNotice"], ids: {
     readonly sessionId: string;

package/dist/core/runner/person-path-rows.js

@@ -1,6 +1,6 @@
 import { ownerStoreOf } from "../permission-rule-provider.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
-import { PATH_RULE_FACES, READ_RULE_TOOL, eligiblePersisted } from "../permission-rule-model.js";
+import { PATH_RULE_FACES, READ_RULE_TOOL, eligiblePersisted, noticeRuleText } from "../permission-rule-model.js";
 import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { thrownText } from "../thrown-value.js";
@@ -382,7 +382,7 @@ export function ruleRowsDroppedNotice(onNotice, ids) {
         deliverEngineNotice(onNotice, {
             code: "permission.rule_row_dropped",
             message: `${rows.length} of your persisted permission rule rows ${one ? "is" : "are"} scoped to a project directory that is not written as a complete absolute path, so ${one ? "it takes" : "they take"} no part in this run's checks — a deny or ask row among them protects nothing. Rewrite ${one ? "it" : "them"} with the project's full path, or remove ${one ? "it" : "them"} (this notice's detail names ${one ? "it" : "them"}).`,
-            detail: { rows: rows.slice(0, 8).map((r) => ({ rule: inlineUntrusted(r.rule, 200), scopeRoot: inlineUntrusted(r.scopeRoot, 200) })), count: rows.length, sessionId: ids.sessionId, runId: ids.runId },
+            detail: { rows: rows.slice(0, 8).map((r) => ({ rule: noticeRuleText(r.rule), scopeRoot: inlineUntrusted(r.scopeRoot, 200) })), count: rows.length, sessionId: ids.sessionId, runId: ids.runId },
         });
     };
 }

package/dist/core/runner/prepare-config-doors.d.ts

@@ -23,7 +23,8 @@ import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
 import type { Model } from "../../internal/llm.js";
 import type { ThinkingLevel } from "../../internal/harness.js";
 import { type MicroCompactMachine } from "../context-edit.js";
-import { type LockedPreflight } from "../locked-config.js";
+import { recordedModeSeed } from "../checkpoint-store.js";
+import { type ConfigDoorEntry, type LockedPreflight } from "../locked-config.js";
 import { type ResolvedRole } from "../roles.js";
 import { type ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import type { SessionStore } from "../session.js";
@@ -146,7 +147,7 @@ export interface PrepareConfigDoorsResult {
     promptProfile: "simple" | "classic";
     /** owned — the host selector values (`TaskSpec.promptRole` / `TaskSpec.promptForm`, validated) the assembly selects on. */
     promptHost: ReturnType<typeof resolveHost>;
-    /** owned — the center binding (`TaskSpec.promptBinding`, validated) the center layer's scoped overlays select on. */
+    /** owned — the run's binding (`TaskSpec.promptBinding`, validated): the selector value every overlay's `when.binding` reads. */
     promptBinding: string | undefined;
     /** owned — the administrator lock snapshot; the rest of prepare reads guarded slots through it. */
     lockedPreflight: LockedPreflight;
@@ -230,4 +231,49 @@ export declare function resolveMicroCompactKnob(bag: RunnerDeps["microCompact"])
     machine: MicroCompactMachine;
     clearOnRejection: boolean;
 };
+/** The seat a checkpoint-store resolution is judged at: the store the task's own config names, else the deployment's. */
+export declare const checkpointStoreSeat: (spec: {
+    checkpointStore?: unknown;
+}) => "taskConfig" | "deps";
+/** The first door of a resume: its re-supplied config is a record. A `null`, a primitive or an array where the record is declared is refused by name
+ *  (`config.invalid_argument`), through the same channel as every door after it, before any of its members is read. */
+export declare function assertResumeConfigRecord(config: unknown): void;
+/** The spec the value doors read: a prepare's (its roster is faces) or a resume's re-supplied config (no objective, no session id). */
+type ValueDoorSpec = Omit<TaskSpec, "tools" | "objective" | "sessionId" | "userAttachments"> & Partial<Pick<TaskSpec, "objective" | "sessionId">>;
+type ConfigValueDoorsResult = Pick<PrepareConfigDoorsResult, "toolFaceLists" | "promptHost" | "promptBinding" | "lockedPreflight" | "microCompactKnob" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "usageWindows" | "brainCallGuardrailMs"> & {
+    skillListingSeats: {
+        fraction: unknown;
+        maxDescChars: unknown;
+    };
+    skills: TaskSpec["skills"];
+};
+/**
+ * The phase's VALUE doors as ONE function with two callers — each judges a declared value against its own vocabulary, reading only the
+ * spec, the deployment's deps, the session store the Runner was constructed over and whether the leg resumes: {@link prepareConfigDoors}
+ * enters them as they stand, and a resume's screen before the claim (`refuseResumeDoors`) enters them through the resume's refusal
+ * channel, so a resume prepare would refuse here is refused before it consumes the row. `enter(seat, door)` names the input that carries
+ * each value; what a door resolves is returned. Every door is total over what a plain-JSON caller can hand it: a `null`, a primitive or an
+ * array where a record is declared is refused by its own code, never read through.
+ */
+export declare function configValueDoors(input: {
+    spec: ValueDoorSpec;
+    deps: RunnerDeps;
+    resumeLeg: boolean;
+    sessions: SessionStore;
+}, enter?: ConfigDoorEntry): ConfigValueDoorsResult;
+/**
+ * The doors a RESUMED leg's prepare refuses at, run as one screen BEFORE the claim — prepare's own functions, so a refusal carries
+ * the very sentence and code prepare throws: the mode doors (`refusePermissionModeDoors`), the output-style seat, the approval
+ * reach, the skills invoked by name (the part no roster changes), the attachments (a resume sends no new human message, so any
+ * entry is refused), this phase's value doors over the config, the deployment's deps and the session store the Runner holds
+ * ({@link configValueDoors}, the retention capability door included) and the mode words the row recorded (`recordedModeSeed`).
+ * It leaves by the resume's ONE refusal channel (`asResumeConfigRefusal`:
+ * `checkpoint.config_refused`, `detail.code` = prepare's code, `detail.field` = `"taskConfig"`, `"deps"` or `"inheritedGate"`)
+ * where prepare would end the leg `failed` after the claim — the row consumed on a store without `reopen`, replayed as a system
+ * retry on one with it, which a configuration fix cannot reach. Before the claim the row stays `pending` and byte-identical and the
+ * corrected resume redeems the same token. A throw that is none of prepare's codes leaves as it was thrown. Returns the config the
+ * leg is handed: the caller's, its MCP servers and A2A peers the frozen entries the lock layer judged (read once, dialed as judged).
+ */
+export declare function refuseResumeDoors<C extends ValueDoorSpec & Pick<TaskSpec, "userAttachments">>(config: C, recordedGate: Parameters<typeof recordedModeSeed>[0], deps: RunnerDeps, sessions: SessionStore): C;
 export declare function prepareConfigDoors(input: PrepareConfigDoorsInput): PrepareConfigDoorsResult;
+export {};