@sema-agent/core 7.52.0 → 7.53.0

package/dist/core/runner/prepare-memory-engine-session.js

@@ -1,5 +1,5 @@
 import { classifyToolContentOrigin, contentOriginPollutes, delegationCallIsExternal } from "../memory-engine/content-origin.js";
-import { mountedMcpPoolRows } from "../mounted-mcp.js";
+import { mountedMcpPoolRows, toolNamesOfServer } from "../mounted-mcp.js";
 import { narrowContentSafety, readCardAttestation } from "../memory-engine/delegation-provenance.js";
 import { recordSyncUnattestable, sessionSettlements } from "../memory-engine/delegation-settlement.js";
 import { protocolOf } from "../protocol-table.js";
@@ -7,9 +7,10 @@ import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { fileArgPath } from "../tool-registry.js";
 import { RosterBuilder } from "../tool-roster.js";
+import { isNotStartedDelegationResult } from "../../agents/subagent.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareMemoryEngineSession(input) {
-    const { memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mcp, mountedMcp, sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef } = input;
+    const { memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mountedMcp, sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef } = input;
     const tools = roster.tools;
     const delegationProvenanceChannel = internals?.delegationProvenance;
     if (memoryEngineSession !== undefined || delegationProvenanceChannel !== undefined) {
@@ -22,7 +23,7 @@ export function prepareMemoryEngineSession(input) {
         provenanceForChildrenRef.current = { trustedTools: [...trustedTools], execIsExternalContent };
         announceDeclaredMcpContentClasses({
             entries: lockedPreflight.mcp,
-            statuses: mcp.statuses,
+            mountedNames: roster.tools.map((t) => t.name),
             execIsExternalContent,
             sessionId,
             runId,
@@ -133,6 +134,9 @@ export function prepareMemoryEngineSession(input) {
                             isPolluting: poolToolPollutes,
                         });
                         const result = await inner(toolCallId, params, signal, onUpdate);
+                        const delivery = delegationDeliveryOf(result);
+                        if (delivery === "none")
+                            return result;
                         const att = readCardAttestation(result?.details);
                         if (att === "external") {
                             mark(`tool "${t.name}" returned the output of a delegated agent that invoked an external-content-class tool at runtime` +
@@ -141,8 +145,11 @@ export function prepareMemoryEngineSession(input) {
                         }
                         else if (att !== "clean") {
                             if (external) {
-                                const staticFaceReason = `tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
-                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)");
+                                const staticFaceReason = (delivery === "launched"
+                                    ? `tool "${t.name}" launched a background delegated agent whose tool face can reach external content`
+                                    : `tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content`) +
+                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)") +
+                                    (delivery === "launched" ? " — its output enters this session when it finishes" : "");
                                 if (!delegationEvidenceAttestedOnly) {
                                     mark(staticFaceReason, "static");
                                 }
@@ -207,13 +214,19 @@ export function prepareMemoryEngineSession(input) {
     }
     return { armed: memoryEngineSession !== undefined || delegationProvenanceChannel !== undefined };
 }
+function delegationDeliveryOf(result) {
+    if (isNotStartedDelegationResult(result))
+        return "none";
+    const details = typeof result === "object" && result !== null ? result.details : undefined;
+    return typeof details === "object" && details !== null && details.status === "async_launched" ? "launched" : "report";
+}
 function announceDeclaredMcpContentClasses(args) {
     for (const entry of args.entries ?? []) {
         const declaredClass = entry.contentOrigin;
         if (declaredClass === undefined)
             continue;
         const server = inlineUntrusted(String(entry.name), 160);
-        const toolCount = args.statuses?.find((s) => s.name === entry.name)?.toolNames?.length ?? 0;
+        const toolCount = toolNamesOfServer(args.mountedNames, entry.name).length;
         const resourceFaceCaveat = " (Not covered: the cross-server resource faces — ListMcpResourcesTool/ReadMcpResourceTool/ReadMcpResourceDirTool — stay externally classified and still mark.)";
         const posture = declaredClass === "local"
             ? `this server's mounted tools' invocations will not mark this session's memory as externally exposed.${resourceFaceCaveat}`

package/dist/core/runner/prepare-memory.d.ts

@@ -208,11 +208,12 @@ export interface PrepareMemoryResult {
      * BEFORE it). It performs the one destructive read this phase has — `inject()` drains the announcement queue —
      * so a hands-phase refusal cannot consume announcements a later prepare should deliver, and it takes the
      * roster-wide persistence verdict the driver can only read off the MOUNTED roster (`rosterCanPersist`: the
-     * `TaskSpec.memoryPersistenceCapable` declaration when set, else the known-store-path inference over the
-     * assembled tools). Call exactly once per prepare.
+     * `memoryPersistenceCapable` declaration when set, else the store-path inference over the assembled tools) and
+     * `isSubagent` (a non-fork delegated child — no user conversation, no not-mounted notice). Call once per prepare.
      */
     composeInjection: (facts: {
         rosterCanPersist: boolean;
+        isSubagent: boolean;
     }) => MemoryInjectionComposition;
     /**
      * The FROZEN org-admission verdict of this prepare: every org scope the task actually mounts

package/dist/core/runner/prepare-memory.js

@@ -6,7 +6,7 @@ import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir,
 import { memoryProjectScopeAbsentNotice, normalizeMemorySpec } from "../memory.js";
 import { deriveSupersededSet } from "../memory-engine/consolidation.js";
 import { shadowNamesOf } from "../memory-engine/shadowing.js";
-import { MEMORY_ANNOUNCEMENT_CAPTURE_OPTOUT_CODA, MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_CAPTURE_INDETERMINATE_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MemoryEngine, entryFileHeadCarriesOrigin, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, memoryConsolidationRecommendedNotice, memoryHarvestQuarantinedNotice, memoryHoldNotices, memoryRecallDisciplineSegment, memoryRestoreWithheldNotice, memorySessionPollutedNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
+import { MEMORY_ANNOUNCEMENT_CAPTURE_OPTOUT_CODA, MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_CAPTURE_OPTOUT_NOTICE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MemoryEngine, entryFileHeadCarriesOrigin, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, memoryConsolidationRecommendedNotice, memoryHarvestQuarantinedNotice, memoryHoldNotices, memoryRecallDisciplineSegment, memoryRestoreWithheldNotice, memorySessionPollutedNotice, memoryUnavailableNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
 import { adjudicateCaptureOptOut, captureOptOutDeniedError, captureOptOutUnpersistedError } from "./memory-capture-optout.js";
 import { readSessionCaptureOptOut } from "../memory-engine/layout.js";
 import { sessionIncarnationResolver } from "../memory-engine/session-incarnation.js";
@@ -14,6 +14,7 @@ import { createMemoryEngineTools } from "../memory-engine/tools.js";
 import { assertScopeContractPlacement, parseScopeKey, resolveProjectId } from "../memory-engine/scope-contract.js";
 import { FileMemoryEngineBackend } from "../memory-engine/file-backend.js";
 import { writableRootOf } from "../memory-engine/types.js";
+import { catalogText } from "../../prompt-assembly/catalog/index.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
 let undeclaredCapturePostureAnnounced = false;
 export async function prepareMemory(input) {
@@ -781,7 +782,7 @@ export async function prepareMemory(input) {
                 blockBody = [MEMORY_CAPTURE_OPTOUT_NOTICE, injection.index, injection.announceBlock].filter((s) => Boolean(s && s.trim())).join("\n\n");
             }
             else if (captureIndeterminate && facts.rosterCanPersist) {
-                blockBody = [MEMORY_CAPTURE_INDETERMINATE_NOTICE, injection.index, injection.announceBlock].filter((s) => Boolean(s && s.trim())).join("\n\n");
+                blockBody = [memoryUnavailableNotice({ what: "capture-record-unreadable", notesReadable: true }), injection.index, injection.announceBlock].filter((s) => Boolean(s && s.trim())).join("\n\n");
             }
             else if (!facts.rosterCanPersist && injection.instruction === "" && injection.readOnlyNotice === undefined) {
                 blockBody = blockBody.trim() ? `${MEMORY_READONLY_NOTICE}\n\n${blockBody}` : MEMORY_READONLY_NOTICE;
@@ -817,6 +818,9 @@ export async function prepareMemory(input) {
             if (memoryBlock !== undefined && injection.indexSeed !== undefined && facts.rosterCanPersist && !captureOptedOut && !captureIndeterminate)
                 seedFiles = [injection.indexSeed];
         }
+        else if (!facts.rosterCanPersist && !facts.isSubagent) {
+            memoryBlock = effectiveMemoryScopes?.reason === "mount-failed" ? memoryUnavailableNotice({ what: "mount-failed", notesReadable: false }) : catalogText("core/memory.no-persistent-store");
+        }
         return {
             memoryBlock,
             ...(recallDisciplineSegment !== undefined ? { recallDisciplineSegment } : {}),

package/dist/core/runner/prepare-offload-wrappers.d.ts

@@ -20,10 +20,10 @@ import type { ToolSelector } from "../tool-face.js";
 export interface PrepareOffloadWrappersInput {
     /** borrowed-readonly — the REBOUND spec (the config-doors result); read for the per-task coarse
      *  offload knob only. */
-    spec: Pick<TaskSpec, "toolResultThresholdChars">;
-    /** borrowed-readonly — the leg's compiled selector: an offloaded result is read back through the reader tool, so a leg whose selector
-     *  does not admit the reader (a sub-agent whose lists leave it out, a deployment that excludes it) offloads nothing — a preview that
-     *  sends the model to a tool it does not have is a dead end. */
+    spec: Pick<TaskSpec, "toolResultThresholdChars" | "excludeAllTools">;
+    /** borrowed-readonly — the leg's compiled selector, read through the valve (`valveLeaves`): an offloaded result is read back through the
+     *  reader tool, so a leg whose valve does not leave the reader (a sub-agent whose lists leave it out, a deployment that excludes it, a
+     *  run whose whole face is switched off) offloads nothing — a preview that sends the model to a tool it does not have is a dead end. */
     selector: Pick<ToolSelector, "admits">;
     /** borrowed-readonly — the deployment's coarse offload knob and its injected store (used AS-IS when
      *  present; a Runner-shared instance is viewed per task, see the body). */

package/dist/core/runner/prepare-offload-wrappers.js

@@ -1,5 +1,6 @@
 import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, InMemoryToolResultStore, OFFLOAD_TOOL_NAME, RunnerSharedToolResultStore, ScopedToolResultStore, withToolResultOffload, } from "../tool-result-store.js";
 import { faceOf } from "../tool-roster.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 const FIRST_PARTY_OFFLOAD_THRESHOLD_CHARS = 50_000;
 export function prepareOffloadWrappers(input) {
     const { spec, deps, resume, offloadScope, sessionId, selector } = input;
@@ -21,7 +22,7 @@ export function prepareOffloadWrappers(input) {
     };
     const explicitGlobalThreshold = spec.toolResultThresholdChars ?? deps.toolResultThresholdChars;
     const offloadThreshold = explicitGlobalThreshold ?? DEFAULT_TOOL_RESULT_THRESHOLD_CHARS;
-    const offloadEnabled = Number.isFinite(offloadThreshold) && offloadThreshold > 0 && selector.admits({ name: OFFLOAD_TOOL_NAME });
+    const offloadEnabled = Number.isFinite(offloadThreshold) && offloadThreshold > 0 && valveLeaves(spec, selector)({ name: OFFLOAD_TOOL_NAME });
     const rawOffloadStore = offloadEnabled ? (deps.toolResultStore ?? new InMemoryToolResultStore()) : undefined;
     const offloadStore = rawOffloadStore instanceof RunnerSharedToolResultStore
         ? new ScopedToolResultStore(rawOffloadStore, offloadScope)

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -46,7 +46,7 @@ export interface PreparePolicyChainInput {
     /** borrowed-readonly — the REBOUND spec. Read: `sessionId` / `principal` (the session-rule read and the lanes' identity),
      *  `durableApproval` / `checkpointStore` (the mandate-park facility test and the sandbox arming's park prerequisites), `taskId` (the late-ask observer's detail),
      *  `tools` (the names the caller mounted, for the name audit). Never mutated. */
-    spec: Pick<TaskSpec, "sessionId" | "principal" | "durableApproval" | "taskId" | "checkpointStore" | "tools">;
+    spec: Pick<TaskSpec, "sessionId" | "principal" | "durableApproval" | "taskId" | "checkpointStore" | "tools" | "excludeAllTools">;
     /** borrowed-readonly — the deployment seats: `sessionPolicyStore` (the rule reads),
      *  `permissionRuleStore` / `localOwnerRules` (the lanes and the offer factory), `onError` / `onNotice` (the advisories,
      *  the refusal disclosures, the late-ask observer), `tracer` (the admission and rule-store frames), `checkpointStore` (the park facility). Receiver preserved;

package/dist/core/runner/prepare-policy-chain.js

@@ -1,4 +1,4 @@
-import { withArgsReading } from "../effective-path-target.js";
+import { argsAsTheToolReads, withArgsReading } from "../effective-path-target.js";
 import { policyAskClassOf } from "../ask-class.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { classifierUnavailableSeat } from "./classifier-ladder.js";
@@ -6,7 +6,8 @@ import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { chainJudges, inheritedToolChecks, screeningInstallationsOf, standsInFor } from "../mods/stations.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
-import { earlierGrammarAdvisory } from "../session-policy-store.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+import { earlierGrammarNotice } from "../session-policy-store.js";
 import { attest, attestationOf, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, mergeAttestation, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, withAttestation, wrapToolPolicy } from "../tool-policy.js";
 import { judgeRuleToolName, mountedToolNames } from "../tool-name-aliases.js";
 import { approvalCardMemberOf } from "../tool-roster.js";
@@ -15,6 +16,7 @@ import { emitTrace } from "../trace.js";
 import { skillGrantBindingMembers } from "../skill-grant.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { delegationPoolReading } from "./sub-agent-deny-lists.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 import { autoStrippedRule, cardDisclosureOf, nearMissSpellingOf, rootFacingToolNames } from "../allow-entry.js";
 import { arbitrateByMode, askClassMembersOf, askFaceOf, askMandateMember } from "../ask-origin.js";
 import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
@@ -46,7 +48,7 @@ export async function preparePolicyChain(input) {
             const known = mountedToolNames(tools);
             for (const t of harnessTools)
                 known.add(t.name);
-            const pool = delegationPoolReading(spec.tools ?? [], selector);
+            const pool = delegationPoolReading(spec.tools ?? [], valveLeaves(spec, selector));
             const callerNames = mountedToolNames(spec.tools ?? []);
             const rootFacing = rootFacingToolNames([...known, ...callerNames, ...pool.names]);
             const unmatched = new Set();
@@ -119,7 +121,7 @@ export async function preparePolicyChain(input) {
         catch {
         }
     };
-    const announceEarlierGrammar = (rulesSessionId) => (entries, field, grammar) => deps.onError?.(Object.assign(new Error(earlierGrammarAdvisory(rulesSessionId, entries, field, grammar)), { code: "config.session_rules_earlier_grammar" }), { phase: "config", sessionId });
+    const announceEarlierGrammar = (rulesSessionId) => (entries, field, grammar) => deliverEngineNotice(deps.onNotice, earlierGrammarNotice({ rulesSessionId, sessionId, entries, field, grammar }));
     let sessionRulePolicy;
     if (deps.sessionPolicyStore && spec.sessionId) {
         const store = deps.sessionPolicyStore;
@@ -343,7 +345,7 @@ export async function preparePolicyChain(input) {
     const recheckApprovedEdit = async (pol, onAskOf, creq, edit, approved, csignal, ancestorAutoMode) => {
         const ancestorDecider = ancestorAutoMode?.decider;
         const ancestorTracker = ancestorAutoMode?.denialTracking;
-        let editArgs = edit;
+        let editArgs = argsAsTheToolReads(creq, edit);
         let settledBy = approved;
         const onApproval = (d) => withAttestation(d, mergeAttestation(creq, attestationOf(settledBy, creq), attestationOf(d, creq), "answer"));
         const vetoed = onApproval;
@@ -356,8 +358,7 @@ export async function preparePolicyChain(input) {
             }
             let re;
             try {
-                const editReq = withArgsReading(creq, editArgs, csignal ?? abortController.signal);
-                re = refuseOutOfContractDecision(await pol.check(editReq !== undefined ? await editReq : { ...creq, args: editArgs }, csignal ?? abortController.signal));
+                re = refuseOutOfContractDecision(await pol.check(await withArgsReading(creq, editArgs, csignal ?? abortController.signal), csignal ?? abortController.signal));
             }
             catch (err) {
                 reportPolicyThrow(notifyOwnHookCrash, "an inherited parent policy's re-check of the approved edit", creq, err, csignal ?? abortController.signal);
@@ -373,7 +374,7 @@ export async function preparePolicyChain(input) {
                 return onApproval(withAttestation({ action: "allow", updatedInput: re.updatedInput !== undefined ? re.updatedInput : editArgs, ...(stated !== undefined ? { decisionReason: stated } : {}) }, re.attestation));
             }
             if (re.updatedInput !== undefined)
-                editArgs = re.updatedInput;
+                editArgs = argsAsTheToolReads(creq, re.updatedInput);
             const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), route: frozenApproverRoute(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
             if (judged.kind === "allow") {
                 return onApproval(judged.result);
@@ -408,7 +409,7 @@ export async function preparePolicyChain(input) {
             settledBy = rr;
             if (rr.updatedInput === undefined)
                 return onApproval({ action: "allow", updatedInput: editArgs, decisionReason: "mode" });
-            editArgs = rr.updatedInput;
+            editArgs = argsAsTheToolReads(creq, rr.updatedInput);
         }
     };
     const settleInstallationAsk = async (pc, decision, creq, csignal) => {
@@ -427,7 +428,7 @@ export async function preparePolicyChain(input) {
                 return settledAs(decision);
             return settledAs(mandateUnreconstructibleDeny(creq));
         }
-        const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
+        const presentedArgs = decision.updatedInput !== undefined ? argsAsTheToolReads(creq, decision.updatedInput) : creq.args;
         const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), route: frozenApproverRoute(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
         if (judged.kind === "allow")
             return settledAs(judged.result);
@@ -635,8 +636,7 @@ export async function preparePolicyChain(input) {
                 }
             }
             const recheckLayers = [...recheckPrefix, ...postEmitterSameInstanceAdapters];
-            const finalRead = withArgsReading(req, decision.updatedInput, signal);
-            const finalReq = finalRead !== undefined ? await finalRead : { ...req, args: decision.updatedInput };
+            const finalReq = await withArgsReading(req, decision.updatedInput, signal);
             let asked;
             let revalidated;
             let restated;

package/dist/core/runner/prepare-project-context.d.ts

@@ -14,7 +14,7 @@ export interface PrepareProjectContextInput {
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `sessionId` (phase derivation + the
      *  continuation projections), `skills` (the roster), `userInvokedSkills` (the person's invoked skills — their
      *  rows are written here), `principal` (the shared-memory tools' trusted identity). Never mutated. */
-    spec: Pick<TaskSpec, "sessionId" | "skills" | "userInvokedSkills" | "principal">;
+    spec: Pick<TaskSpec, "sessionId" | "skills" | "userInvokedSkills" | "principal" | "excludeAllTools">;
     /** borrowed-readonly — trusted internals: `agentName` (seam ctx), `inheritedSkillGrants` (the parent's captured
      *  skill grant rows, seeded as `inherited`), `inheritedAllowedTools` (the parent's request entries, seeded as this leg's
      *  own). `undefined` on a standalone prepare. */

package/dist/core/runner/prepare-project-context.js

@@ -13,10 +13,12 @@ import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createSkillTool, normalizeSki
 import { skillLoadReading } from "./skill-base-dir.js";
 import { RosterBuilder } from "../tool-roster.js";
 import { mountedToolNames } from "../tool-name-aliases.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 import { asThrownError } from "../thrown-value.js";
 export async function prepareProjectContext(input) {
     const { deps, spec, internals, session, sessionId, runId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, allowedTools, allowedToolTables, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget } = input;
     const tools = roster.tools;
+    const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
     let memoryBlock = memoryBlockFromEngine;
     let instructionSources;
     let projectInstructionContent;
@@ -115,11 +117,11 @@ export async function prepareProjectContext(input) {
             for (const alias of t.aliases ?? [])
                 mountedNameDomain.add(alias);
         }
-        const excludedName = SHARED_MEMORY_TOOL_NAMES.find((n) => !toolFaceSnapshot.selector.admits({ name: n }));
+        const excludedName = SHARED_MEMORY_TOOL_NAMES.find((n) => !leaves({ name: n }));
         const occupiedName = SHARED_MEMORY_TOOL_NAMES.find((n) => mountedNameDomain.has(n));
         if (excludedName !== undefined || occupiedName !== undefined) {
             announceMemoryNotMounted(onceLedger, sessionId, "shared", SHARED_MEMORY_TOOL_NAMES, excludedName !== undefined
-                ? `the run's tool selector (allowTools / excludeTools) does not admit "${excludedName}"`
+                ? `the run's tool face (allowTools / excludeTools / excludeAllTools) does not admit "${excludedName}"`
                 : `this task already declares a tool named "${occupiedName}" (the built-in yields to it)`);
         }
         else {
@@ -137,10 +139,10 @@ export async function prepareProjectContext(input) {
     }
     else if (memoryEngineSession !== undefined && !memorySearchToolsPlanned) {
         announceMemoryNotMounted(onceLedger, sessionId, "engine", MEMORY_ENGINE_TOOL_NAMES, memoryPairExcludedName !== undefined
-            ? `the run's tool selector (allowTools / excludeTools) does not admit "${memoryPairExcludedName}"`
+            ? `the run's tool face (allowTools / excludeTools / excludeAllTools) does not admit "${memoryPairExcludedName}"`
             : `this task already declares a tool named "${memoryPairOccupiedName}" (the built-in yields to it)`);
     }
-    const skillsListing = skillSpecs.length > 0
+    const skillsListing = skillSpecs.length > 0 && leaves({ name: SKILL_TOOL_NAME })
         ? {
             entries: skillSpecs.map((s) => ({
                 name: s.name,

package/dist/core/runner/prepare-prompt-assembly.d.ts

@@ -31,7 +31,7 @@ export interface PreparePromptAssemblyInput {
         readonly role?: HostRole;
         readonly form?: HostForm;
     };
-    /** borrowed-readonly — the center binding (`TaskSpec.promptBinding`, validated), or undefined. */
+    /** borrowed-readonly — the run's binding (`TaskSpec.promptBinding`, validated), or undefined: a selector value. */
     binding: string | undefined;
     /** borrowed-readonly — the leg's mods bus: `prompt.compose` collects the deploy and task seats' overlays. */
     modBus: LegModBus;

package/dist/core/runner/prepare-prompt-assembly.js

@@ -1,12 +1,13 @@
 import { createHash } from "node:crypto";
 import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { assemblePrompt } from "../../prompt-assembly/assemble.js";
-import { adoptCenter, centerOverlaysOf } from "../../prompt-assembly/artifact.js";
+import { adoptCenter, centerOverlaysOf, verifyPromptArtifactBody } from "../../prompt-assembly/artifact.js";
+import { refusalClause, storedArtifactLine } from "../../prompt-assembly/artifact-store.js";
 import { catalogDigestOf, digestOf, prepareEpochRecord } from "../../prompt-assembly/epoch.js";
 import { rendererVector } from "../../prompt-assembly/renderers.js";
 import { SEMA_DEFAULT_CATALOG } from "../../prompt-assembly/catalog/index.js";
 import { describeCatalog } from "../../prompt-assembly/explain.js";
-import { selectorsOf } from "../../prompt-assembly/select.js";
+import { selectorRecordOf, selectorsOf } from "../../prompt-assembly/select.js";
 import { auditToolCollisions, projectToolManifest } from "../../prompt-assembly/tool-catalog.js";
 import { buildEnvironmentContext } from "../../prompts/default.js";
 import { raisePromptCompose } from "../mods/stations.js";
@@ -31,13 +32,21 @@ export async function preparePromptAssembly(input) {
     const stored = await session.getPromptEpoch();
     let centerAdoption;
     {
-        const failUnavailable = (what) => {
-            throw Object.assign(new Error(`prompt snapshot unavailable: ${what} (artifact source miss / not verifiable here${deps.promptSource === undefined ? "; RunnerDeps.promptSource is not configured" : ""}) — refusing to recompose a hybrid prompt`), { code: "prompt.snapshot_unavailable" });
+        const failUnavailable = (what, refusal) => {
+            const why = refusal !== undefined ? `the source's copy is ${refusalClause(refusal)}` : `artifact source miss / not verifiable here${deps.promptSource === undefined ? "; RunnerDeps.promptSource is not configured" : ""}`;
+            throw Object.assign(new Error(`prompt snapshot unavailable: ${what} (${why}) — refusing to recompose a hybrid prompt`), { code: "prompt.snapshot_unavailable" });
         };
         const resolvePinned = async (digest, sourceRevision, via) => {
-            const art = await deps.promptSource?.get(digest);
+            const told = {};
+            const art = await deps.promptSource?.get(digest, (r) => void (told.current = r));
             const adopted = art !== undefined ? adoptCenter(art, sourceRevision) : undefined;
-            return adopted ?? failUnavailable(`${via} center prompt artifact ${digest.slice(0, 23)}… has no verified resolvable copy`);
+            if (adopted !== undefined)
+                return adopted;
+            const checked = art !== undefined ? verifyPromptArtifactBody(art) : undefined;
+            const refusal = told.current ?? (checked !== undefined && !checked.ok ? { code: checked.code, reason: checked.reason } : undefined);
+            if (refusal !== undefined)
+                deps.onError?.(new Error(storedArtifactLine(digest, refusal, `the session fails prompt.snapshot_unavailable (a hybrid prompt is never recomposed)`)), { phase: "prompt-constitution", sessionId });
+            return failUnavailable(`${via} center prompt artifact ${digest.slice(0, 23)}… has no verified resolvable copy`, refusal);
         };
         const pinned = stored?.kind === "pin" ? stored.descriptor : undefined;
         const retiredCenterPin = stored?.kind === "legacy" && stored.centerPinned;
@@ -76,14 +85,8 @@ export async function preparePromptAssembly(input) {
         promptProfile,
         fableMitigations,
     };
-    const selectors = selectorsOf(facts, host);
-    const selectorRecord = {
-        ...(binding !== undefined ? { binding } : {}),
-        traits: [...selectors.traits].sort(),
-        host: { role: selectors.host.role, form: selectors.host.form },
-        facts: { ...selectors.facts },
-    };
-    const centerOverlays = centerOverlaysOf(centerAdoption, binding);
+    const selectorRecord = selectorRecordOf(selectorsOf(facts, host, binding));
+    const centerOverlays = centerOverlaysOf(centerAdoption);
     const lowerAdds = new Map();
     for (const { overlay } of [...sugar, ...centerOverlays])
         if (overlay.op === "add")
@@ -91,16 +94,17 @@ export async function preparePromptAssembly(input) {
     const composed = await raisePromptCompose(modBus, {
         model: model.id,
         catalog: describeCatalog().sections,
-        selectors: { traits: [...selectors.traits], host: selectors.host, facts: selectors.facts },
+        selectors: selectorRecord,
     }, { lowerAdds, ...(input.signal !== undefined ? { signal: input.signal } : {}) });
     for (const w of composed.warnings)
         deps.onError?.(new Error(w), { phase: "prompt-constitution", sessionId });
     const taskOverlays = [...sugar, ...composed.task];
     const buildAssembleInputs = (center) => ({
         taskOverlays,
-        centerOverlays: centerOverlaysOf(center, binding),
+        centerOverlays: centerOverlaysOf(center),
         deployOverlays: composed.deploy,
         host,
+        ...(binding !== undefined ? { binding } : {}),
         tools,
         facts,
         ...(envFacts.cwd !== undefined ? { workspaceFolder: envFacts.cwd } : {}),

package/dist/core/runner/prepare-prompt-inputs.d.ts

@@ -27,6 +27,7 @@ import type { SourcedOverlay } from "../../prompt-assembly/overlay.js";
 import type { ContainmentFace } from "../../tools/fs/index.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { MaterializedMcp } from "../mcp.js";
+import type { RosterBuilder } from "../tool-roster.js";
 import type { ResolvedRole } from "../roles.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { SessionTreeEntry } from "../../internal/harness-types.js";
@@ -37,8 +38,8 @@ import { type ContextWindowOverlay } from "../context-settings.js";
 export interface PreparePromptInputsInput {
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `systemPrompt` / `appendSystemPrompt` (handed whole to the
      *  request-body sugar), `clientContext` (zone, email), `envFacts` (the deployment's sandbox + resume facts),
-     *  `compaction` (the within-task flag). Never mutated. */
-    spec: Pick<TaskSpec, "systemPrompt" | "appendSystemPrompt" | "clientContext" | "envFacts" | "compaction">;
+     *  `compaction` (the within-task flag), `excludeAllTools` (the valve's whole-face switch). Never mutated. */
+    spec: Pick<TaskSpec, "systemPrompt" | "appendSystemPrompt" | "clientContext" | "envFacts" | "compaction" | "excludeAllTools">;
     /** borrowed-readonly — deployment deps: `onError` (the operator lane: fail-closed advisory, cwd misalignment,
      *  git-lane degrade), `modelKnowledgeCutoffs`. Receiver preserved (`deps.onError?.(…)`). */
     deps: Pick<RunnerDeps, "onError" | "modelKnowledgeCutoffs">;
@@ -61,8 +62,9 @@ export interface PreparePromptInputsInput {
     resolvedReadFace: ContainmentFace | undefined;
     /** borrowed-readonly — the resolved write face (the open-writes flag + the structured env fact). */
     resolvedWriteFace: ContainmentFace | undefined;
-    /** borrowed-readonly — the frozen tool face; only `defer` is read (the Workflow short-pointer flag). */
-    toolFaceSnapshot: Pick<ToolFaceSnapshot, "defer">;
+    /** borrowed-readonly — the frozen tool face; `defer` (the Workflow short-pointer flag) and `selector` (with the spec's whole-face
+     *  switch, the valve's reading that decides which servers' instructions are taught). */
+    toolFaceSnapshot: Pick<ToolFaceSnapshot, "defer" | "selector">;
     /** borrowed-readonly — the resolved prompt profile (rides the flags to the legacy ctx). */
     promptProfile: "simple" | "classic";
     /** borrowed-readonly — the fable-mitigations profile axis (rides the flags with the profile). */
@@ -81,8 +83,12 @@ export interface PreparePromptInputsInput {
     };
     /** borrowed-readonly — the resolved role; only its `systemPrompt` preset is read (second source). */
     resolvedRole: Pick<ResolvedRole, "systemPrompt">;
-    /** borrowed-readonly — the materialized MCP roster; only `serverInstructions` (the disposed entries) is read. */
-    mcp: Pick<MaterializedMcp, "serverInstructions">;
+    /** borrowed-mutable — the materialized MCP roster; `serverInstructions` (the disposed entries) and `tools` (each server's listing: did it list
+     *  any tool) are read, and the instructions lane's ledger is stated: the block is what the model is told at the run's start. */
+    mcp: Pick<MaterializedMcp, "serverInstructions" | "tools" | "instructionsDelta">;
+    /** borrowed-readonly — the run's roster as the protocol-tools phase mounted it (the deployment's overlay applied, the valve not yet):
+     *  the tools the teaching answer reads, with the valve's predicate. */
+    roster: Pick<RosterBuilder, "tools">;
     /** borrowed-readonly — the resolved model (id for the env line + the cutoff lookup). */
     model: Model;
     /** borrowed-readonly — the run's external-content-target fold (the single-source disclosure fact). */

package/dist/core/runner/prepare-prompt-inputs.js

@@ -1,5 +1,7 @@
 import { formatLocalDate, isValidTimeZone } from "../../prompts/default.js";
 import { sugarOverlays } from "../../prompt-assembly/sugar.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
+import { instructionsTaught, toldAtStart } from "../mounted-mcp.js";
 import { isIsolated } from "../remote-env.js";
 import { readDateAnchor } from "./announce-once-ledger.js";
 import { probeGitStatusLane } from "./git-status-frame.js";
@@ -31,9 +33,10 @@ export async function preparePromptInputs(input) {
         isSubagent: delegation.isNonForkChild,
     };
     const sugar = sugarOverlays({ spec, resolvedRole, ...(internals !== undefined ? { internals } : {}) });
-    const mcpInstructionsBlock = mcp.serverInstructions.length
-        ? `# MCP Server Instructions\n${mcp.serverInstructions.map(renderMcpInstructionsEntry).join("\n\n")}`
-        : undefined;
+    const valveLeft = valveLeaves(spec, toolFaceSnapshot.selector);
+    const taught = mcp.serverInstructions.filter((entry) => instructionsTaught(valveLeft, entry.server, input.roster.tools, mcp.tools));
+    toldAtStart(mcp.instructionsDelta, new Set(taught.map((entry) => entry.server)));
+    const mcpInstructionsBlock = taught.length ? `# MCP Server Instructions\n${taught.map(renderMcpInstructionsEntry).join("\n\n")}` : undefined;
     const userTz = spec.clientContext?.timeZone;
     const tzValid = userTz !== undefined && isValidTimeZone(userTz);
     const dateAnchor = await readDateAnchor(session);

package/dist/core/runner/prepare-protocol-tools.d.ts

@@ -32,12 +32,14 @@ import type { AnnounceOnceSink, IrreversibilityTier, Prepared, RollbackStack, To
 import { RosterBuilder, type ToolRosterDeltaSeat } from "../tool-roster.js";
 import type { LegModBus } from "../mods/stations.js";
 export interface PrepareProtocolToolsInput {
-    /** borrowed-readonly — the frozen preflight; only `mcp` (the declared server entries) is read: the
-     *  materialize input, the RefreshMcpTools mount predicate, and whether a real client was acquired. */
-    lockedPreflight: Pick<LockedPreflight, "mcp">;
+    /** borrowed-readonly — the frozen preflight; `mcp` (the declared server entries: the materialize input, the RefreshMcpTools
+     *  mount predicate, and whether a real client was acquired) and `a2a` (the declared peers the door judged: the materialize
+     *  input and whether a handle was acquired) are read. */
+    lockedPreflight: Pick<LockedPreflight, "mcp" | "a2a">;
     /** borrowed-readonly — the REBOUND spec. Read: `principal` (the MCP header / the A2A identity), `tools`
-     *  (the caller names both reserved-name guards check against), `a2a` (the peer entries). */
-    spec: Pick<TaskSpec, "principal" | "tools" | "a2a">;
+     *  (the caller names both reserved-name guards check against), `excludeAllTools` (the valve's whole-face switch: the live roster lane's
+     *  reading, and the first-dial gate). */
+    spec: Pick<TaskSpec, "principal" | "tools" | "excludeAllTools">;
     /** borrowed-readonly — the deployment seats the materializers and their operator faces read: `onElicit`
      *  and `mcpImageResizer` ride into the MCP intake; `onError` takes the A2A warnings (no ledger — a peer is
      *  re-read every prepare); `mcpRevocations` + `onNotice` make the revocation wiring. */

package/dist/core/runner/prepare-protocol-tools.js

@@ -1,6 +1,8 @@
 import { Type } from "typebox";
 import { materializeMcpTools } from "../mcp.js";
-import { applyMcpRosterDelta, commitMcpRosterChanges, redialMcpServer } from "./mcp-redial.js";
+import { applyMcpRosterDelta, commitMcpRosterChanges, redialMcpServer, rosterHolding, settledOnRoster } from "./mcp-redial.js";
+import { valveLeaves, valveLeavesPeer } from "../../agents/tool-filter.js";
+import { resourceFacesLeft } from "../mounted-mcp.js";
 import { materializeA2aTools } from "../a2a.js";
 import { deliverEngineNotice } from "../types.js";
 import { RosterBuilder } from "../tool-roster.js";
@@ -24,8 +26,11 @@ export async function prepareProtocolTools(input) {
     if (overPeer !== undefined) {
         throw Object.assign(new Error(`MCP server name ${JSON.stringify(overPeer.name.slice(0, 40) + "…")} is ${overPeer.name.length} characters; a peer rides every roster row of its tools and the roster's bound on a name is ${TOOL_WIRE_NAME_MAX_CHARS}.`), { code: "config.tool_name_too_long" });
     }
+    const serverReached = valveLeavesPeer(spec, toolFaceSnapshot.selector);
+    const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
+    const resourcesReached = resourceFacesLeft(leaves);
     const mcp = lockedPreflight.mcp?.length
-        ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps, runId), mcpPool === undefined ? undefined : { pool: mcpPool.pool, ownsPool: mcpPool.owned }, sectionDisposerOf(input.modBus, abortController.signal))
+        ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps, runId), mcpPool === undefined ? undefined : { pool: mcpPool.pool, ownsPool: mcpPool.owned }, sectionDisposerOf(input.modBus, abortController.signal), (entry) => resourcesReached || serverReached(mintNamespacePrefix(MCP_NAMESPACE, entry.name)))
         :
             { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, droppedTools: [], statuses: [], refresh: async () => [], reconnect: async (server) => ({ server, prefix: mintNamespacePrefix(MCP_NAMESPACE, server), outcome: "not_declared", reason: "this task declared no MCP servers", toolCount: 0, added: [], removed: [] }), dispose: async () => { } };
     if (lockedPreflight.mcp?.length)
@@ -69,7 +74,7 @@ export async function prepareProtocolTools(input) {
     const rebuildHarnessToolsRef = {};
     const contentOriginWrapRef = {};
     const toolCallGateArmedRef = { armed: false };
-    const rosterApply = { toolFaceSnapshot, withFaces, remoteToolOffload, foldProtocolAxes: (axes, label) => foldProtocolAxes(axes, label), toolEffects, axisExplicitNegatives, roster };
+    const rosterApply = { spec, toolFaceSnapshot, withFaces, remoteToolOffload, foldProtocolAxes: (axes, label) => foldProtocolAxes(axes, label), toolEffects, axisExplicitNegatives, roster, declared: lockedPreflight.mcp ?? [], instructionsDelta: mcp.instructionsDelta };
     const rosterCommit = { rebuildHarnessToolsRef, rosterSeat, toolCallGateArmedRef, irreversibleTools, egressTools };
     const redialInput = { ...rosterApply, ...rosterCommit, mcp, deps, sessionId, runId, irreversibilityTier };
     const mcpRedial = lockedPreflight.mcp?.length ? (server) => redialMcpServer(redialInput, server) : undefined;
@@ -88,14 +93,17 @@ export async function prepareProtocolTools(input) {
                 const lines = [];
                 let changed = false;
                 let anyActiveFailure = false;
+                const reported = [];
                 for (const r of results) {
                     if (r.tools === undefined) {
+                        reported.push(settledOnRoster(r, rosterHolding(rosterApply, r.server), roster));
                         lines.push(`${r.server}: ${r.status}${r.error !== undefined ? ` (${r.error})` : ""}`);
                         if (r.status === "failed")
                             anyActiveFailure = true;
                         continue;
                     }
-                    const applied = applyMcpRosterDelta(rosterApply, { server: r.server, prefix: r.prefix, tools: r.tools, axes: r.axes ?? [], dropped: r.dropped ?? [] });
+                    const applied = applyMcpRosterDelta(rosterApply, { server: r.server, prefix: r.prefix, tools: r.tools, axes: r.axes ?? [], dropped: r.dropped ?? [], ...(r.instructions !== undefined ? { instructions: r.instructions } : {}) });
+                    reported.push(settledOnRoster(r, applied, roster));
                     if (!applied.applied) {
                         lines.push(`${r.server}: failed (${applied.foldError})`);
                         anyActiveFailure = true;
@@ -103,16 +111,15 @@ export async function prepareProtocolTools(input) {
                     }
                     changed = true;
                     const detail = [];
-                    const shownAdded = r.added.filter((n) => !applied.excluded.includes(n));
-                    if (shownAdded.length > 0)
-                        detail.push(`added: ${shownAdded.join(", ")}`);
-                    if (r.removed.length > 0)
-                        detail.push(`removed: ${r.removed.join(", ")}`);
+                    if (applied.added.length > 0)
+                        detail.push(`added: ${applied.added.join(", ")}`);
+                    if (applied.removed.length > 0)
+                        detail.push(`removed: ${applied.removed.join(", ")}`);
                     if (applied.excluded.length > 0)
                         detail.push(`excluded by deployment config (not mounted): ${applied.excluded.join(", ")}`);
                     if ((r.dropped?.length ?? 0) > 0)
                         detail.push(`dropped: ${r.dropped.map((d) => `${d.tool} (${d.reason.length > 90 ? `${d.reason.slice(0, 90)}…` : d.reason})`).join("; ")}`);
-                    lines.push(`${r.server}: refreshed — ${applied.pushed} tool${applied.pushed === 1 ? "" : "s"}${detail.length > 0 ? ` (${detail.join("; ")})` : ""}`);
+                    lines.push(`${r.server}: refreshed — ${applied.mounted.length} tool${applied.mounted.length === 1 ? "" : "s"}${detail.length > 0 ? ` (${detail.join("; ")})` : ""}`);
                 }
                 if (changed) {
                     const ungated = await commitMcpRosterChanges(rosterCommit);
@@ -122,7 +129,7 @@ export async function prepareProtocolTools(input) {
                 const text = lines.length === 0 ? "No connected MCP servers to refresh." : lines.join("\n");
                 return {
                     content: [{ type: "text", text }],
-                    details: { results },
+                    details: { results: reported },
                     terminate: false,
                     ...(anyActiveFailure && !changed ? { isError: true } : {}),
                 };
@@ -157,7 +164,7 @@ export async function prepareProtocolTools(input) {
         }
     };
     foldProtocolAxes(mcp.toolAxes, "MCP");
-    const a2aDeclared = spec.a2a?.length ? spec.a2a : undefined;
+    const a2aDeclared = lockedPreflight.a2a;
     const a2a = a2aDeclared
         ? await materializeA2aTools(a2aDeclared, spec.principal, abortController.signal)
         : { tools: [], toolAxes: [], warnings: [], statuses: [], refresh: async () => [], dispose: async () => { } };