@sema-agent/core 7.52.0 → 7.53.0

package/dist/core/checkpoint-store.js

@@ -305,7 +305,7 @@ export function summarizeCheckpoint(cp) {
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
-export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control"]);
+export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"]);
 export const isCheckpointConfigRefusalCode = (word) => CHECKPOINT_CONFIG_REFUSAL_CODES.some((w) => w === word);
 export class CheckpointError extends Error {
     code;
@@ -399,13 +399,13 @@ export function resolveCheckpointStore(spec, deps) {
             throw checkpointStoreExecutionUndeclared("TaskSpec.checkpointStore", spec.checkpointStore);
         return spec.checkpointStore;
     }
-    if (deps.checkpointStore !== undefined && deps.checkpointStore.execution?.outcome !== true) {
+    if (deps.checkpointStore !== undefined && deps.checkpointStore?.execution?.outcome !== true) {
         throw checkpointStoreExecutionUndeclared("RunnerDeps.checkpointStore", deps.checkpointStore);
     }
     return deps.checkpointStore;
 }
 export function checkpointStoreExecutionUndeclared(seat, store) {
-    const ctor = store.constructor?.name;
+    const ctor = store?.constructor?.name;
     const name = typeof ctor === "string" && ctor.length > 0 && ctor !== "Object" ? ` (${ctor})` : "";
     const e = new Error(`${seat}: the wired CheckpointStore${name} does not declare \`execution = { outcome: true }\` — the execution-outcome ` +
         "record (recordExecutionOutcome, and reopen refusing a recorded row) is a required member of the store contract; " +

package/dist/core/compliance.js

@@ -1,3 +1,4 @@
+import { describeRejectedValue } from "./tool-search-setting.js";
 export const COMPLIANCE_CAPABILITIES = Object.freeze(["mcp_servers", "workflows", "web_fetch", "org_memory_mount"]);
 export const BUILTIN_COMPLIANCE_DENIES = {
     hipaa: ["web_fetch", "org_memory_mount"],
@@ -26,7 +27,8 @@ export function resolveComplianceDenies(posture) {
 export function complianceCapabilityProblem(cap, owner) {
     if (COMPLIANCE_CAPABILITIES.some((member) => member === cap))
         return undefined;
-    return (`${owner} contains "${String(cap)}", not a member of the closed capability set ` +
+    const shown = (typeof cap === "object" && cap !== null) || typeof cap === "function" ? describeRejectedValue(cap) : `"${String(cap)}"`;
+    return (`${owner} contains ${shown}, not a member of the closed capability set ` +
         `(${COMPLIANCE_CAPABILITIES.join(", ")}) — a misspelled deny must never silently not-enforce.`);
 }
 export const WEB_FETCH_TOOL_NAME = "WebFetch";

package/dist/core/effective-path-target.d.ts

@@ -245,17 +245,36 @@ export declare function readCallTarget(env: ExecutionEnv | undefined, call: Tool
     readonly root?: string | undefined;
     readonly cwd?: string | undefined;
 }, signal?: AbortSignal, leads?: ReadonlyMap<string, string | undefined>): Promise<CallTargetReading>;
+/** The gate's entry records the loop's reading of this call's arguments against the face it stamps on the call. */
+export declare function stampArgsReading(face: object, read: (args: unknown) => unknown): void;
 /**
- * `req` with its arguments replaced by `args` and — when `req` carries a reading of its own args — a reading of the NEW
- * args taken the same way (same environment, same root / cwd, same face). Every seat that rewrites a request's arguments
- * and hands it on (a composition's rewrite cascade, a re-judgment of the final or an edited form) goes through here, so the
- * next layer never judges a request its reading does not describe. `signal` is the CURRENT call's: a reading never carries
- * one call's cancellation into another's. `undefined` ⇒ nothing to re-read: use `{ ...req, args }`.
+ * `args` as the called tool will run them — its argument preparation and schema coercions, the reading the loop gave the
+ * model's call — for the call `req` belongs to; `args` itself when nothing was stamped (a bare request outside a Runner:
+ * a host judging a call reads it the tool's way first). Every seat that adopts a rewrite (a hook's, a policy's, a
+ * person's edit) takes it through here before anything judges it, so what is judged is what runs. A value the reading
+ * leaves as it is comes back as ITSELF (the same object: a target reading taken for it still describes it).
+ */
+export declare function argsAsTheToolReads(req: {
+    readonly face?: object | undefined;
+}, args: unknown): unknown;
+/** `args` through one call's reading `read` (the face-less seat: the resumed call reads through its live tool): ITSELF when the
+ *  reading leaves its bytes as they are, else the reading's value, recorded as read from `args`. */
+export declare function argsReadBy(read: (args: unknown) => unknown, args: unknown): unknown;
+/** The value `args` was read from, when a reading moved it; otherwise `args` itself. */
+export declare function argsReadFrom(args: unknown): unknown;
+/**
+ * `req` with its arguments replaced by `args` AS THE TOOL READS THEM ({@link argsAsTheToolReads}) and — when `req` carries
+ * a reading of its own target — a reading of the NEW args taken the same way (same environment, same root / cwd, same
+ * face). Every seat that rewrites a request's arguments and hands it on (a composition's rewrite cascade, a re-judgment of
+ * the final or an edited form) goes through here, so the next layer never judges a request its reading does not describe
+ * nor arguments the tool would run differently. `signal` is the CURRENT call's: a reading never carries one call's
+ * cancellation into another's.
  */
 export declare function withArgsReading<R extends {
     readonly args: unknown;
     readonly targetReading?: CallTargetReading | undefined;
-}>(req: R, args: unknown, signal: AbortSignal | undefined): Promise<R> | undefined;
+    readonly face?: object | undefined;
+}>(req: R, args: unknown, signal: AbortSignal | undefined): Promise<R>;
 /** The request's target reading, when it describes the request's own `args` (the object it was taken for); otherwise
  *  nothing — a rule lane then judges the lexical view it always judged. Every rule lane reads the reading through here. */
 export declare function callTargetReadingOf(req: {

package/dist/core/effective-path-target.js

@@ -3,6 +3,7 @@ import { declaredPathTargetOf, pathTargetValue, protectivePathTargetOf } from ".
 import { symlinkChainHops } from "./path-identity.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, withGateTimeout } from "./gate-bounded-await.js";
 import { thrownText } from "./thrown-value.js";
+import { canonicalize } from "./canonical-json.js";
 export function pathTargetBaseOf(pt, bases) {
     return (pt?.base ?? "cwd") === "root" ? bases.root : (bases.cwd ?? bases.root);
 }
@@ -146,10 +147,31 @@ export async function readCallTarget(env, call, signal, leads) {
     REREAD.set(reading, (args, rereadSignal) => readCallTarget(env, { ...call, args }, rereadSignal, leads));
     return reading;
 }
-export function withArgsReading(req, args, signal) {
+const ARGS_READING = new WeakMap();
+export function stampArgsReading(face, read) {
+    ARGS_READING.set(face, read);
+}
+export function argsAsTheToolReads(req, args) {
+    const read = req.face === undefined ? undefined : ARGS_READING.get(req.face);
+    return read === undefined ? args : argsReadBy(read, args);
+}
+export function argsReadBy(read, args) {
+    const out = read(args);
+    if (out === args || canonicalize(out) === canonicalize(args))
+        return args;
+    if (typeof out === "object" && out !== null)
+        READ_FROM.set(out, args);
+    return out;
+}
+const READ_FROM = new WeakMap();
+export function argsReadFrom(args) {
+    return typeof args === "object" && args !== null && READ_FROM.has(args) ? READ_FROM.get(args) : args;
+}
+export async function withArgsReading(req, args, signal) {
+    const read = argsAsTheToolReads(req, args);
     const reading = callTargetReadingOf(req);
     const reread = reading === undefined ? undefined : REREAD.get(reading);
-    return reread === undefined ? undefined : reread(args, signal).then((targetReading) => ({ ...req, args, targetReading }));
+    return reread === undefined ? { ...req, args: read } : { ...req, args: read, targetReading: await reread(read, signal) };
 }
 function viewFrom(v) {
     if (v.lexical === undefined)

package/dist/core/engine-notice.d.ts

@@ -68,7 +68,7 @@ export interface EngineNotice {
      *    as usual. Audience `user`; once per prepared task for the skill and request lists (`detail.sessionId` present), once
      *    per Runner for the deployment's (at construction, no session). `detail: { sessionId?, entries: [{ source, entry,
      *    reason, skill?, list? }] }` (`source` ∈ `skill` / `request` / `deployment`; `skill` and `list` only on a skill's;
-     *    `reason` ∈ {@link import("./allow-entry.js").ALLOW_ENTRY_INERT_REASONS}).
+     *    `reason` ∈ {@link import("./allow-entry.js").ALLOW_ENTRY_INERT_REASONS}; `entry` is the entry as written — the message spells it — when it is at most `NOTICE_RULE_TEXT_MAX` (1 024) code points; a longer one is cut to 1 024 plus the truncation mark, 1 025 in all).
      *  - `"mods.registration_refused"` — an extension registration was not mounted: a registration admitted before it
      *    answered `{ refuse }` on `plugin.register`, or failed while judging it (fail-closed). The run goes on without it.
      *    Audience `user` (the seat is in `detail`). Once per refused registration per run. `detail: { name, seat, tier,
@@ -439,7 +439,18 @@ export interface EngineNotice {
      *    complete absolute path (only a foreign writer or a hand edit makes one; every engine write face refuses it): they
      *    take no part in this run's checks — a deny or ask row among them protects nothing — until they are rewritten or
      *    removed. Once per run, by whichever read met them first. `detail: { rows, count, sessionId, runId }` — `rows`
-     *    the first eight `{ rule, scopeRoot }` (each bounded), `count` all of them. Audience `user`.
+     *    the first eight `{ rule, scopeRoot }`, `count` all of them; `rule` is the rule text as the store served it, through the same reading
+     *    as `permission.allowed_tool_not_granted`'s `entries[].entry` (the original, not a spelling of it, when it is at most 1 024 code points;
+     *    a longer one is cut to 1 024 plus the truncation mark, 1 025 in all), `scopeRoot` neutralized and bounded. Audience `user`.
+     *  - `"config.session_rules_earlier_grammar"` — a session's stored permission rules (`RunnerDeps.sessionPolicyStore`) hold
+     *    entries the rule grammar they were written in reads as nothing: an allow entry admits nothing, and a `toolDeny` entry
+     *    this engine's grammar reads as no rule makes those rules refuse every call until they are rewritten. The message names
+     *    the session, the bucket, the entries (the first five, the rest counted), the reader's word and the way out. Audience
+     *    `user`. Once per distinct entry set per bucket per rule layer (the run's own rules, each ancestor's inherited ones).
+     *    `detail: { bucket, storedGrammar, entries: [{ entry, reader }], rewrite: { by, stampsGrammar }, rulesSessionId,
+     *    sessionId }` — `entries` every one, `entry` through the same reading as `permission.allowed_tool_not_granted`'s;
+     *    `reader` ∈ `no_rule` / `named_no_tool`; `rewrite.by` = `operator_write_without_rev`; `rulesSessionId` the session
+     *    whose rules they are (an ancestor's on a delegated child), `sessionId` the run that read them.
      *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
      *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own
      *    `durableApproval` opt-in with no live approver seat (`durableMandateSourceOf`, the predicate the

package/dist/core/gate-fold.js

@@ -8,6 +8,7 @@ import { createGateDeadline, awaitWriteProtectionJudgment, gateWaitFailureOf, wi
 import { shellReadFaceWords } from "../tools/fs/shell-read-face.js";
 import { failedJudgmentDeny } from "./runner/policy-throw.js";
 import { thrownText } from "./thrown-value.js";
+import { argsAsTheToolReads } from "./effective-path-target.js";
 import { foldHookAsk, refuseOutOfContractDecision } from "./tool-policy.js";
 import { applyUnansweredSilence, readStationAnswer, silencedBy } from "./shell-read-silence.js";
 import { asksUnstated, permissionSeatAt, unstatedAskMessage } from "./mode-policy.js";
@@ -37,10 +38,10 @@ export async function runGateFold(pass) {
             pass.classifierRound = attributed;
     }
     if ((pass.decision.action === "allow" || pass.decision.action === "ask") && pass.decision.updatedInput !== undefined) {
-        pass.policyRewrite = pass.decision.updatedInput;
+        pass.policyRewrite = argsAsTheToolReads(pass.req, pass.decision.updatedInput);
     }
     else if (pass.hookAsk?.updatedInput !== undefined) {
-        pass.policyRewrite = pass.hookAsk.updatedInput;
+        pass.policyRewrite = argsAsTheToolReads(pass.req, pass.hookAsk.updatedInput);
     }
     if (pass.hookAsk !== undefined && pass.decision.action !== "deny") {
         pass.decision = foldHookAsk(pass.decision, pass.hookAsk);

package/dist/core/gate-lanes.js

@@ -1,4 +1,4 @@
-import { withArgsReading } from "./effective-path-target.js";
+import { argsAsTheToolReads, withArgsReading } from "./effective-path-target.js";
 import { attest, attestationOf, decisionText, foldHookAsk, ownArgs, refusalOf, refuseOutOfContractDecision } from "./tool-policy.js";
 import { arbitrateByMode, classifyAsk, decisionAskClassesOf, fileCommandOptionsSentence, persistedRuleMandateOf, ruleClearanceOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
 import { classifierParseFailureDenyMessage, denialLimitFallbackMessage, rungDidNotRule, unarmedWindow } from "./auto-mode.js";
@@ -16,7 +16,7 @@ import { catalogRuleFaceOf } from "./tool-registry.js";
 import { callFaceSeat } from "./tool-roster.js";
 import { heldBy, wireOf } from "./tool-name-readings.js";
 import { asksUnstated, modeAcceptsFileCommand, permissionSeatAt, unstatedAskMessage } from "./mode-policy.js";
-import { ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON } from "./permission-rule-org.js";
+import { ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, orgUnreadableClause } from "./permission-rule-org.js";
 import { exitGate, passAskFace, unownedArgsMessage } from "./runner/gate-exit.js";
 import { readOrgRuleLane, readPersistedRuleLane } from "./rule-lane-reads.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
@@ -137,14 +137,14 @@ export async function runGateLanes(pass) {
             orgTightenCount += 1;
             pass.deniedBy = "org";
             pass.denyCause = undefined;
-            return { decision: refusalOf({ action: "deny", message: `an organization policy rule (${rule}) denies this call`, decisionReason: ORG_RULE_DECISION_REASON }, args), org: undefined };
+            return { decision: refusalOf({ action: "deny", message: `an organization policy rule (${rule}) denies this call${unreadable !== undefined ? `, ${orgUnreadableClause(unreadable)}` : ""}`, decisionReason: ORG_RULE_DECISION_REASON }, args), org: undefined };
         }
         if (decided.action === "deny")
             return { decision: decided, org: undefined };
         orgTightenCount += 1;
         orgRealApprovalRequired = true;
         const orgRuleMessage = unreadable !== undefined
-            ? `an organization policy rule (${rule}) may reach this call, which could not be read against it (${unreadable}) — a person must decide`
+            ? `an organization policy rule (${rule}) may reach this call, ${orgUnreadableClause(unreadable)} — a person must decide`
             : `an organization policy rule (${rule}) requires approval for this call`;
         return {
             decision: decided.action === "ask"
@@ -160,8 +160,7 @@ export async function runGateLanes(pass) {
     const orgAnswer = await applyOrgLayer(pass.decision, finalArgs);
     pass.decision = orgAnswer.decision;
     const readPersistedRules = (req) => readPersistedRuleLane(input.persistedRules, req, input.abortSignal);
-    const reread = pass.policyRewrite !== undefined ? withArgsReading(pass.req, pass.policyRewrite, pass.callSignal ?? input.abortSignal) : undefined;
-    const laneReq = Object.freeze(reread !== undefined ? await reread : { ...pass.req, ...(pass.policyRewrite !== undefined ? { args: pass.policyRewrite } : {}) });
+    const laneReq = Object.freeze(pass.policyRewrite !== undefined ? await withArgsReading(pass.req, pass.policyRewrite, pass.callSignal ?? input.abortSignal) : { ...pass.req });
     const laneAnswer = input.persistedRules !== undefined && wireOf("lanes.persistedLaneSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME ? await readPersistedRules(laneReq) : undefined;
     {
         const tightened = applyPersistedTightening(pass.decision, laneAnswer, laneReq);
@@ -558,7 +557,7 @@ export async function runGateLanes(pass) {
                 pass.deniedBy = "policy";
                 break;
             }
-            editArgs = taken.value;
+            editArgs = argsAsTheToolReads(pass.req, taken.value);
             if (round >= 3) {
                 editDenied = {
                     action: "deny",
@@ -589,7 +588,7 @@ export async function runGateLanes(pass) {
                         editHookAsk = ask;
                     }
                     if (hr.updatedInput !== undefined) {
-                        editArgs = hr.updatedInput;
+                        editArgs = argsAsTheToolReads(pass.req, hr.updatedInput);
                         editRewrittenSinceHuman = true;
                     }
                 }
@@ -622,7 +621,7 @@ export async function runGateLanes(pass) {
                 }
             }
             if (recheck.updatedInput !== undefined) {
-                editArgs = recheck.updatedInput;
+                editArgs = argsAsTheToolReads(pass.req, recheck.updatedInput);
                 editRewrittenSinceHuman = true;
             }
             const editOrg = await applyOrgLayer(recheck, editArgs);
@@ -632,8 +631,7 @@ export async function runGateLanes(pass) {
                 break;
             }
             let editLane;
-            const editReread = withArgsReading(pass.req, editArgs, callSignal ?? input.abortSignal);
-            const editLaneReq = Object.freeze(editReread !== undefined ? await editReread : { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
+            const editLaneReq = Object.freeze(await withArgsReading(pass.req, editArgs, callSignal ?? input.abortSignal));
             if (input.persistedRules !== undefined && wireOf("lanes.persistedEditSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME) {
                 editLane = await readPersistedRules(editLaneReq);
                 const editTightened = applyPersistedTightening(recheck, editLane, editLaneReq);
@@ -653,7 +651,7 @@ export async function runGateLanes(pass) {
             }
             if (recheck.action === "allow") {
                 if (recheck.updatedInput !== undefined) {
-                    editArgs = recheck.updatedInput;
+                    editArgs = argsAsTheToolReads(pass.req, recheck.updatedInput);
                     editRewrittenSinceHuman = true;
                 }
                 if (editRewrittenSinceHuman && asksUnstated(recheck, permissionSeatAt(input, editArgs)?.seat, input.permissionMode?.())) {
@@ -662,7 +660,7 @@ export async function runGateLanes(pass) {
                 }
             }
             if (recheck.updatedInput !== undefined) {
-                editArgs = recheck.updatedInput;
+                editArgs = argsAsTheToolReads(pass.req, recheck.updatedInput);
                 editRewrittenSinceHuman = true;
             }
             let editFacts;

package/dist/core/gate-outcome.d.ts

@@ -336,12 +336,17 @@ export type CauseTableCoversEveryDeniedBy = AssertAllKeysHandled<Exclude<DeniedB
  *  allow or deny) and from BOTH stations (this gate's own classifier step, and an ANCESTOR's frozen
  *  classifier reached through the inherited policy chain, whose allow and deny carry it out on the same seat
  *  that carries the FORM): which model it was for, which one answered, and — only when the ladder moved —
- *  the rung it left and why. ABSENT reads UNKNOWN, never "the seat answered" (that is `fallback` absent WITH
- *  the member present), and a consumer cannot tell its two causes apart from the record alone: no
- *  classification happened, or one ran on a decider given no candidate ladder and can name no model (a
- *  hand-built decider; a parked ancestor's cross-process rebuild, whose single fresh leg has none). A block
- *  at the DENIAL-LIMIT bound reaches no attribution seat: it becomes an ask, and the disposition names that
- *  resolution. Additive. Invariant I6 ({@link screenGateOutcome}) screens its shape. */
+ *  the rung it left and why. It is the classification's account, not the settlement's: a classification that
+ *  RULED keeps it whoever then decided the call — a call whose question a person then answered (an ask a
+ *  station after the classifier raised, or a block at the DENIAL-LIMIT bound, which becomes an ask) carries
+ *  it beside that person's settlement on {@link GateOutcome}; who decided is read from the settlement
+ *  (`human_allowed`, `policy_allowed`, …), never from this member's presence. ABSENT reads UNKNOWN, never
+ *  "the seat answered" (that is `fallback` absent WITH the member present), and a consumer cannot tell its
+ *  three causes apart from the record alone: no classification happened; one ran on a decider given no
+ *  candidate ladder and can name no model (a hand-built decider; a parked ancestor's cross-process rebuild,
+ *  whose single fresh leg has none); or one did not rule (it could not run, or replied with no verdict) and
+ *  handed the question to the approval seat, whose settlement then names the resolution that ask reached.
+ *  Additive. Invariant I6 ({@link screenGateOutcome}) screens its shape. */
 export type GateDisposition = {
     kind: "allowed";
     classifier?: AutoModeClassifierRound;

package/dist/core/governance-codes.d.ts

@@ -138,7 +138,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.read_deny_swapped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.path_view_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.credential_not_withheld", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "mods.registration_refused", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.credential_origin_mismatch", "route.response_model_mismatch", "route.tool_call_id_folded", "route.finish_reason_unknown", "route.stream_end_ignored", "route.extra_body_reserved_dropped", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "tool_result.media_refused", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable", "permission.entry_mode_clamped"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.read_deny_swapped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.path_view_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.credential_not_withheld", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "config.session_rules_earlier_grammar", "permission.allowed_tool_not_granted", "mods.registration_refused", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.credential_origin_mismatch", "route.response_model_mismatch", "route.tool_call_id_folded", "route.finish_reason_unknown", "route.stream_end_ignored", "route.extra_body_reserved_dropped", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "tool_result.media_refused", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable", "permission.entry_mode_clamped"];
 /** A catalogued code (see {@link ENGINE_NOTICE_CODES}); {@link NOTICE_MINTER} says who mints it. NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */
@@ -187,6 +187,7 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "permission.read_deny_unapplied": "user";
     readonly "permission.rule_store_unavailable": "user";
     readonly "permission.rule_row_dropped": "user";
+    readonly "config.session_rules_earlier_grammar": "user";
     readonly "permission.allowed_tool_not_granted": "user";
     readonly "mods.registration_refused": "user";
     readonly "memory.capture_opted_out": "user";
@@ -309,6 +310,7 @@ declare const NOTICE_MINTER_TABLE: {
     readonly "permission.read_deny_unapplied": "engine";
     readonly "permission.rule_store_unavailable": "engine";
     readonly "permission.rule_row_dropped": "engine";
+    readonly "config.session_rules_earlier_grammar": "engine";
     readonly "permission.allowed_tool_not_granted": "engine";
     readonly "mods.registration_refused": "engine";
     readonly "peer.inbound_disposition": "engine";

package/dist/core/governance-codes.js

@@ -151,6 +151,7 @@ export const ENGINE_NOTICE_CODES = Object.freeze([
     "permission.read_deny_unapplied",
     "permission.rule_store_unavailable",
     "permission.rule_row_dropped",
+    "config.session_rules_earlier_grammar",
     "permission.allowed_tool_not_granted",
     "mods.registration_refused",
     "peer.inbound_disposition",
@@ -246,6 +247,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "permission.read_deny_unapplied": "user",
     "permission.rule_store_unavailable": "user",
     "permission.rule_row_dropped": "user",
+    "config.session_rules_earlier_grammar": "user",
     "permission.allowed_tool_not_granted": "user",
     "mods.registration_refused": "user",
     "memory.capture_opted_out": "user",
@@ -349,6 +351,7 @@ const NOTICE_MINTER_TABLE = {
     "permission.read_deny_unapplied": "engine",
     "permission.rule_store_unavailable": "engine",
     "permission.rule_row_dropped": "engine",
+    "config.session_rules_earlier_grammar": "engine",
     "permission.allowed_tool_not_granted": "engine",
     "mods.registration_refused": "engine",
     "peer.inbound_disposition": "engine",

package/dist/core/hands-band-screen.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Total over what a deployment can hand the seat: absent passes; a value that is not a plain record, a member the record does not
+ * have, or a member holding a value it does not take refuses by name (`config.invalid_argument`, `detail.field` = `RunnerDeps.hands`
+ * or `RunnerDeps.hands.<member>`) — a band setting the engine cannot read is never run as if it were absent. A member holding
+ * `undefined` is absence, as on every optional seat.
+ */
+export declare function screenHandsBandOptions(value: unknown): void;

package/dist/core/hands-band-screen.js

@@ -0,0 +1,32 @@
+const HANDS_BAND_MEMBERS = {
+    bashReadonlyAllow: { takes: "a list of command-name strings", ok: (v) => Array.isArray(v) && v.every((c) => typeof c === "string") },
+    commitCoAuthor: { takes: "a string or false", ok: (v) => typeof v === "string" || v === false },
+    readImageDownsampler: { takes: "a function or false", ok: (v) => typeof v === "function" || v === false },
+    beforeWrite: { takes: "a function", ok: (v) => typeof v === "function" },
+    autoBackgroundOnTimeout: { takes: "a boolean", ok: (v) => typeof v === "boolean" },
+};
+const kindOf = (v) => (v === null ? "null" : Array.isArray(v) ? "an array" : typeof v);
+export function screenHandsBandOptions(value) {
+    if (value === undefined)
+        return;
+    const refuse = (field, problem) => {
+        const e = new Error(`${field} ${problem} — a hands band setting the engine cannot read is refused rather than ignored.`);
+        e.code = "config.invalid_argument";
+        e.detail = { field };
+        throw e;
+    };
+    const proto = typeof value === "object" && value !== null ? Object.getPrototypeOf(value) : undefined;
+    if (typeof value !== "object" || value === null || Array.isArray(value) || (proto !== Object.prototype && proto !== null)) {
+        refuse("RunnerDeps.hands", `must be a plain record of hands band settings (got ${kindOf(value)})`);
+    }
+    for (const key of Object.keys(value)) {
+        const v = value[key];
+        if (v === undefined)
+            continue;
+        if (!Object.hasOwn(HANDS_BAND_MEMBERS, key))
+            refuse(`RunnerDeps.hands.${key}`, `is not a hands band setting (the settings: ${Object.keys(HANDS_BAND_MEMBERS).join(", ")})`);
+        const member = HANDS_BAND_MEMBERS[key];
+        if (!member.ok(v))
+            refuse(`RunnerDeps.hands.${key}`, `must be ${member.takes} (got ${kindOf(v)})`);
+    }
+}

package/dist/core/hooks.d.ts

@@ -1,7 +1,7 @@
 import type { ActorAssertion, DocumentContent, ImageContent, TextContent } from "../internal/llm.js";
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
 import type { DecisionReason, PermissionResult, ResolvedAsk, ToolCallFace, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
-import type { CallTargetStamp } from "./effective-path-target.js";
+import { type CallTargetStamp } from "./effective-path-target.js";
 import type { GateOutcome } from "./gate-outcome.js";
 import { type PreToolUseScreening } from "./runner/gate-exit.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./rule-lane-reads.js";
@@ -629,9 +629,9 @@ export interface ParkAttemptFailed {
  */
 export type OrgGateVerdict = {
     status: "available";
-    /** The org rule that speaks for this call, if any. Deny outranks ask; there is no allow bucket. An
-     *  `unreadable` member (the lexer's reason) says the call could not be READ against `rule` — an
-     *  org rule that may reach it — so `behavior` is `ask` and the message names the reason. */
+    /** The org rule that speaks for this call, if any. Deny outranks ask; there is no allow bucket. An `unreadable` member says why
+     *  `rule` could not be judged against the call (the message names it): the call could not be READ against it (the lexer's reason;
+     *  `behavior` is `ask`), or the row is one the org layer does not read, standing at its strictest reading (`deny`, or `ask`). */
     verdict?: {
         behavior: "deny" | "ask";
         rule: string;
@@ -727,11 +727,13 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
     onNotifyError?: (failure: import("./safe-notify.js").SafeNotifyFailure) => void;
     /** The call. `toolName` is the name every policy, hook and name-keyed table of this gate reads — the wire name of the
      *  tool the call dispatches to: the Runner's station resolves a call made under an alias through the roster
-     *  (`rosterToolName`) before this gate runs; a host driving the gate resolves it the same way. */
+     *  (`rosterToolName`) before this gate runs; a host driving the gate resolves it the same way. `readArguments` = the loop's
+     *  reading of the call's args: stamped on the call's face, every rewrite this gate adopts is read through it (`argsAsTheToolReads`). */
     event: {
         toolCallId: string;
         toolName: string;
         input: Record<string, unknown>;
+        readArguments?: (args: unknown) => unknown;
     };
     /** The run/leg identity envelope, put verbatim on every {@link PreToolUseEvent} this
      *  gate call builds and on every {@link PermissionDeniedPayload} it emits. The Runner supplies its

package/dist/core/hooks.js

@@ -1,4 +1,5 @@
-import { abortedSeatDeny, decisionText, describeThrown, isEngineRefusal, ownArgs, refuseOutOfContractDecision, unaskedSeatAnswer } from "./tool-policy.js";
+import { argsAsTheToolReads, stampArgsReading } from "./effective-path-target.js";
+import { abortedSeatDeny, decisionText, describeThrown, isEngineRefusal, ownArgs, ownedReading, refuseOutOfContractDecision, unaskedSeatAnswer } from "./tool-policy.js";
 import { createSettlementLedger, engineFailClosedExit, hookDenyExit, unownedArgsExit } from "./runner/gate-exit.js";
 import { classicEventBase, dispatchClassic, ENGINE_CORE_ANSWER, engineCore, failedHandlerClause, judgedInputOf, observePermissionDenied, recordScreeningChain } from "./mods/stations.js";
 import { runGateFold } from "./gate-fold.js";
@@ -235,7 +236,8 @@ export async function runToolGate(input) {
         screening,
         afterFold: runGateLanes,
         currentInput: args,
-        req: Object.freeze({ toolName, args, toolCallId, ...(() => { const f = input.toolFaceOf?.(toolName); return f !== undefined ? { face: f } : {}; })() }),
+        req: Object.freeze({ toolName, args, toolCallId, ...(() => { const f = input.toolFaceOf?.(toolName); const read = event.readArguments; if (f !== undefined && read !== undefined)
+                stampArgsReading(f, ownedReading(read)); return f !== undefined ? { face: f } : {}; })() }),
         preToolContext: [],
         hookAsk: undefined,
         parkFailed: undefined,
@@ -261,7 +263,7 @@ export async function runToolGate(input) {
                 return hookDenyExit(pass, screening.deniedReason(r));
             }
             if (r.updatedInput !== undefined) {
-                pass.currentInput = r.updatedInput;
+                pass.currentInput = argsAsTheToolReads(pass.req, r.updatedInput);
             }
             if (r.action === "ask") {
                 pass.hookAsk = r;