@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/gate-lanes.js

@@ -1,6 +1,6 @@
-import { withArgsReading } from "./effective-path-target.js";
-import { attest, attestationOf, decisionText, foldHookAsk, ownArgs, refusalOf, refuseOutOfContractDecision } from "./tool-policy.js";
-import { arbitrateByMode, classifyAsk, decisionAskClassesOf, fileCommandOptionsSentence, persistedRuleMandateOf, ruleClearanceOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
+import { argsAsTheToolReads, withArgsReading } from "./effective-path-target.js";
+import { attest, attestationOf, bindableArgsOf, decisionText, foldHookAsk, mergeAttestation, refusalOf, refuseOutOfContractDecision, withAttestation } from "./tool-policy.js";
+import { arbitrateByMode, classifyAsk, decisionAskClassesOf, fileCommandOptionsSentence, persistedRuleMandateOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
 import { classifierParseFailureDenyMessage, denialLimitFallbackMessage, rungDidNotRule, unarmedWindow } from "./auto-mode.js";
 import { classifierNoRulingArm, settleNoRulingAsk } from "./classifier-unavailable-arm.js";
 import { SETTLEMENT_NOBODY_JUDGED } from "./gate-outcome.js";
@@ -10,14 +10,14 @@ import { applyPersistedTightening, disclosedRuleSet } from "./persisted-rule-arm
 import { skillAllowDecision, skillRowRefusal } from "./skill-grant.js";
 import { allowRuleShadowOf } from "./allow-entry.js";
 import { CD_GIT_COMPOUND_SENTENCE, changesDirectoryBeforeGit, readOnlyShellVerdict } from "./read-only-shell.js";
-import { readShellCommand } from "./shell-lexer.js";
+import { readShellCommand } from "./shell-run-candidates.js";
 import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
 import { catalogRuleFaceOf } from "./tool-registry.js";
 import { callFaceSeat } from "./tool-roster.js";
 import { heldBy, wireOf } from "./tool-name-readings.js";
 import { asksUnstated, modeAcceptsFileCommand, permissionSeatAt, unstatedAskMessage } from "./mode-policy.js";
-import { ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON } from "./permission-rule-org.js";
-import { exitGate, passAskFace, unownedArgsMessage } from "./runner/gate-exit.js";
+import { ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, orgUnreadableClause } from "./permission-rule-org.js";
+import { exitGate, passAskFace, untakenValueExit } from "./runner/gate-exit.js";
 import { readOrgRuleLane, readPersistedRuleLane } from "./rule-lane-reads.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, withGateTimeout } from "./gate-bounded-await.js";
@@ -34,9 +34,9 @@ const ruleStoreUnreadableOf = (lane) => lane?.unreadable === true && lane.reason
 export async function runGateLanes(pass) {
     const { input, toolName, toolCallId, callSignal, ledger, notifier, screening, adjudicate, resolveAsk, suspendAsk } = pass;
     const boundedAwaitDeadlineMs = createGateDeadline(input, notifier);
-    let orgRealApprovalRequired = false;
     let markedThisRound;
     let approvedWithArgs = false;
+    let editAskedOrigin;
     let carriedOwnAsk;
     const takeApprovedEdit = (read) => {
         carriedOwnAsk = read.outstanding ?? (pass.decision.action === "ask" ? pass.decision : undefined);
@@ -112,7 +112,6 @@ export async function runGateLanes(pass) {
         const answer = await readOrgRuleLane(input.orgRules, Object.freeze({ toolName, args, toolCallId, ...callFaceSeat(pass.req.face) }), input.abortSignal);
         if (answer.status === "unavailable") {
             orgEvidence = { revisionAbsent: "unavailable", ruleAbsent: "unavailable" };
-            orgRealApprovalRequired = true;
             await notifier.notifyAsync(() => input.orgRules?.onUnavailable?.({ toolName, toolCallId, message: answer.disclosures.join("; ") }), "toolGate.orgSnapshotUnavailable");
             const orgUnavailableMessage = `tool "${toolName}" needs approval: this deployment is org-governed and cannot currently adjudicate ` +
                 `against an organization policy snapshot — every allow tightens to a real approval until it can`;
@@ -137,14 +136,13 @@ export async function runGateLanes(pass) {
             orgTightenCount += 1;
             pass.deniedBy = "org";
             pass.denyCause = undefined;
-            return { decision: refusalOf({ action: "deny", message: `an organization policy rule (${rule}) denies this call`, decisionReason: ORG_RULE_DECISION_REASON }, args), org: undefined };
+            return { decision: refusalOf({ action: "deny", message: `an organization policy rule (${rule}) denies this call${unreadable !== undefined ? `, ${orgUnreadableClause(unreadable)}` : ""}`, decisionReason: ORG_RULE_DECISION_REASON }, args), org: undefined };
         }
         if (decided.action === "deny")
             return { decision: decided, org: undefined };
         orgTightenCount += 1;
-        orgRealApprovalRequired = true;
         const orgRuleMessage = unreadable !== undefined
-            ? `an organization policy rule (${rule}) may reach this call, which could not be read against it (${unreadable}) — a person must decide`
+            ? `an organization policy rule (${rule}) may reach this call, ${orgUnreadableClause(unreadable)} — a person must decide`
             : `an organization policy rule (${rule}) requires approval for this call`;
         return {
             decision: decided.action === "ask"
@@ -160,8 +158,7 @@ export async function runGateLanes(pass) {
     const orgAnswer = await applyOrgLayer(pass.decision, finalArgs);
     pass.decision = orgAnswer.decision;
     const readPersistedRules = (req) => readPersistedRuleLane(input.persistedRules, req, input.abortSignal);
-    const reread = pass.policyRewrite !== undefined ? withArgsReading(pass.req, pass.policyRewrite, pass.callSignal ?? input.abortSignal) : undefined;
-    const laneReq = Object.freeze(reread !== undefined ? await reread : { ...pass.req, ...(pass.policyRewrite !== undefined ? { args: pass.policyRewrite } : {}) });
+    const laneReq = Object.freeze(pass.policyRewrite !== undefined ? await withArgsReading(pass.req, pass.policyRewrite, pass.callSignal ?? input.abortSignal) : { ...pass.req });
     const laneAnswer = input.persistedRules !== undefined && wireOf("lanes.persistedLaneSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME ? await readPersistedRules(laneReq) : undefined;
     {
         const tightened = applyPersistedTightening(pass.decision, laneAnswer, laneReq);
@@ -224,19 +221,21 @@ export async function runGateLanes(pass) {
             pass.currentInput = pass.policyRewrite;
             pass.req = Object.freeze({ ...pass.req, args: pass.policyRewrite, ...(laneReq.targetReading !== undefined ? { targetReading: laneReq.targetReading } : {}) });
         }
-        const ruleMayClear = () => ruleClearanceOf(pass.decision.action === "ask" ? pass.decision : undefined, mandateMarksNow()).ruleMayClear;
-        const classMayClear = () => pass.decision.action === "ask" && classifyAsk(pass.decision, askOriginFacts(orgAnswer.org, laneAnswer)).row.ruleMayClear;
+        const originFacts = askOriginFacts(orgAnswer.org, laneAnswer);
+        if (pass.decision.action === "ask")
+            classifyStanding(pass.decision, originFacts);
+        const allowMayClear = () => pass.decision.action === "ask" && pass.askClassification?.row.ruleMayClear === true;
         let personalEvidence = { dotsAbsent: input.persistedRules === undefined ? "not_wired" : "not_adjudicated" };
         if (laneAnswer?.unreadable === true)
             personalEvidence = { dotsAbsent: "unavailable" };
         let laneCoverage;
         const questionTool = wireOf("lanes.allowLayerQuestionSkip", pass.req) === ASK_USER_QUESTION_TOOL_NAME;
-        const allowLayerMayClear = () => !orgRealApprovalRequired &&
+        const laneIsProvenance = orgAnswer.org === undefined &&
             pass.decision.action === "ask" &&
             pass.decision.requiresRealApproval !== true &&
             pass.decision.decisionReason !== "hook" &&
             !questionTool &&
-            !markedUnresolvable();
+            !originFacts.markedUnresolvable;
         const unionDotsOf = (rules) => {
             const seen = new Set();
             const union = [];
@@ -251,7 +250,7 @@ export async function runGateLanes(pass) {
             }
             return { dots: union };
         };
-        if (input.persistedRules && allowLayerMayClear()) {
+        if (input.persistedRules && laneIsProvenance) {
             const answer = laneAnswer ?? {};
             laneCoverage = answer.coverage;
             personalEvidence = answer.hit?.behavior === "ask" ? unionDotsOf(answer.hit.rules) : { dotsAbsent: answer.unreadable === true ? "unavailable" : "no_match" };
@@ -298,7 +297,7 @@ export async function runGateLanes(pass) {
                 const hit = match();
                 if (hit === undefined)
                     continue;
-                if (allowLayerMayClear() && ruleMayClear() && classMayClear()) {
+                if (allowMayClear()) {
                     pass.decision = hit.clear();
                     await hit.afterClear();
                     if (member !== "hook")
@@ -313,7 +312,6 @@ export async function runGateLanes(pass) {
             const { allowRuleShadowed: _claimed, ...standing } = pass.decision;
             pass.decision = shadows.length > 0 ? { ...standing, allowRuleShadowed: shadows } : standing;
         }
-        const originFacts = askOriginFacts(orgAnswer.org, laneAnswer);
         let noRulingMinted = false;
         const fallbackAskOf = (standingAsk, fallback, latestBlockedAction) => {
             const { classifierNoRuling: _why, ...standing } = standingAsk;
@@ -324,7 +322,7 @@ export async function runGateLanes(pass) {
             const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
             pass.decision = stampAskOrigin(stamped, originFacts, classifyStanding(stamped, originFacts));
         }
-        if (allowLayerMayClear() && pass.decision.action === "ask" && ruleMayClear() && classMayClear() && pass.probeBoundaryDeclined !== true && wireOf("lanes.readOnlyShellAllow", pass.req) === COMMAND_RULE_TOOL) {
+        if (allowMayClear() && pass.probeBoundaryDeclined !== true && wireOf("lanes.readOnlyShellAllow", pass.req) === COMMAND_RULE_TOOL) {
             const commandParam = catalogRuleFaceOf(COMMAND_RULE_TOOL)?.primaryParams[0] ?? "command";
             const args = pass.req.args;
             const command = typeof args === "object" && args !== null && !Array.isArray(args) ? args[commandParam] : undefined;
@@ -345,7 +343,7 @@ export async function runGateLanes(pass) {
             }
         }
         if (pass.toolCheckRaised !== true && pass.decision.action !== "deny") {
-            const read = await checkTool(pass.decision, pass.currentInput, orgAnswer.org, pass.policyRewrite, () => allowLayerMayClear() && ruleMayClear() && classMayClear());
+            const read = await checkTool(pass.decision, pass.currentInput, orgAnswer.org, pass.policyRewrite, allowMayClear);
             if (read?.kind === "denied")
                 refuseByExtension(read.deny);
             else if (read?.kind === "cleared")
@@ -543,22 +541,27 @@ export async function runGateLanes(pass) {
                 }
             }
             approvedWithArgs = pass.decision.action === "allow" && pass.decision.updatedInput !== undefined;
+            if (approvedWithArgs && askBeforeResolve.action === "ask")
+                editAskedOrigin = askBeforeResolve.origin;
         }
     }
     if (approvedWithArgs && pass.decision.action === "allow" && pass.decision.updatedInput !== undefined) {
         let editArgs = pass.decision.updatedInput;
         let editDenied;
         let editRewrittenSinceHuman = false;
+        let editAnswer = pass.decision;
         let unanswered;
         const refusedAtResolution = (d) => { editDenied = d; pass.deniedBy = "ask_resolution"; };
         for (let round = 0;; round++) {
-            const taken = ownArgs(editArgs);
+            const taken = bindableArgsOf(toolName, editArgs);
             if (!taken.ok) {
-                editDenied = { action: "deny", message: unownedArgsMessage(`the approved edit for "${toolName}"`, taken.reason) };
-                pass.deniedBy = "policy";
-                break;
+                const origin = attestationOf(editAnswer, { toolCallId, toolName })?.origin ?? editAskedOrigin;
+                if (origin === undefined)
+                    throw new Error(`the approved edit for "${toolName}" reached its refusal without an origin word — the origin stamp precedes every resolution`);
+                ledger.set({ settlement: { kind: "presentation_failed", who: { party: "none" }, when: Date.now() }, origin });
+                return await untakenValueExit(pass, { value: editArgs, message: taken.refusal, deniedBy: "ask_resolution" });
             }
-            editArgs = taken.value;
+            editArgs = argsAsTheToolReads(pass.req, taken.value);
             if (round >= 3) {
                 editDenied = {
                     action: "deny",
@@ -589,7 +592,7 @@ export async function runGateLanes(pass) {
                         editHookAsk = ask;
                     }
                     if (hr.updatedInput !== undefined) {
-                        editArgs = hr.updatedInput;
+                        editArgs = argsAsTheToolReads(pass.req, hr.updatedInput);
                         editRewrittenSinceHuman = true;
                     }
                 }
@@ -622,7 +625,7 @@ export async function runGateLanes(pass) {
                 }
             }
             if (recheck.updatedInput !== undefined) {
-                editArgs = recheck.updatedInput;
+                editArgs = argsAsTheToolReads(pass.req, recheck.updatedInput);
                 editRewrittenSinceHuman = true;
             }
             const editOrg = await applyOrgLayer(recheck, editArgs);
@@ -632,8 +635,7 @@ export async function runGateLanes(pass) {
                 break;
             }
             let editLane;
-            const editReread = withArgsReading(pass.req, editArgs, callSignal ?? input.abortSignal);
-            const editLaneReq = Object.freeze(editReread !== undefined ? await editReread : { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
+            const editLaneReq = Object.freeze(await withArgsReading(pass.req, editArgs, callSignal ?? input.abortSignal));
             if (input.persistedRules !== undefined && wireOf("lanes.persistedEditSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME) {
                 editLane = await readPersistedRules(editLaneReq);
                 const editTightened = applyPersistedTightening(recheck, editLane, editLaneReq);
@@ -653,16 +655,17 @@ export async function runGateLanes(pass) {
             }
             if (recheck.action === "allow") {
                 if (recheck.updatedInput !== undefined) {
-                    editArgs = recheck.updatedInput;
+                    editArgs = argsAsTheToolReads(pass.req, recheck.updatedInput);
                     editRewrittenSinceHuman = true;
                 }
-                if (editRewrittenSinceHuman && asksUnstated(recheck, permissionSeatAt(input, editArgs)?.seat, input.permissionMode?.())) {
+                const answeredRecheck = withAttestation(recheck, mergeAttestation(pass.req, attestationOf(editAnswer, pass.req), attestationOf(recheck, pass.req), "answer"));
+                if (asksUnstated(answeredRecheck, pass.req, editArgs, permissionSeatAt(input, editArgs)?.seat, input.permissionMode?.())) {
                     recheck = { action: "ask", message: permissionSeatAt(input, editArgs)?.question ?? unstatedAskMessage(toolName) };
                     pass.tightenedBy = "unstated";
                 }
             }
             if (recheck.updatedInput !== undefined) {
-                editArgs = recheck.updatedInput;
+                editArgs = argsAsTheToolReads(pass.req, recheck.updatedInput);
                 editRewrittenSinceHuman = true;
             }
             let editFacts;
@@ -692,6 +695,7 @@ export async function runGateLanes(pass) {
             if (editRead?.kind === "approved") {
                 carriedOwnAsk = editRead.outstanding ?? (editDecision.action === "ask" ? editDecision : undefined);
                 editArgs = editRead.allow.updatedInput;
+                editAnswer = editRead.allow;
                 editRewrittenSinceHuman = false;
                 continue;
             }
@@ -737,6 +741,9 @@ export async function runGateLanes(pass) {
                 break;
             }
             editArgs = rr.updatedInput;
+            editAnswer = rr;
+            if (editAskDecision.action === "ask")
+                editAskedOrigin = editAskDecision.origin;
             editRewrittenSinceHuman = false;
         }
         const rejudged = () => editDenied === undefined || editDenied === unanswered?.deny;

package/dist/core/gate-outcome.d.ts

@@ -31,13 +31,16 @@ import { type AutoModeClassifierRound, type AutoModeFallbackCause } from "./auto
  *    timer over the synchronous leg) elapsed with no answer.
  *  - `park_sla_expired` — a DURABLE park's SLA deadline passed and the host's sweep resolved it as a deny
  *    (FACET A). A store `expire`/`reap` produces no `tool_end` and therefore no settlement.
- *  - `no_approver` — headless: no approver (or no question face) is wired, or the deny posture string.
+ *  - `no_approver` — headless: no approver (or no question face) is wired, or the deny posture string (arguments no approval
+ *    can be bound to are refused there in the binding's own sentence, under this word).
  *  - `approver_unavailable` — the approver (or an ancestor's frozen approver) answered the ROUTING question
  *    "nobody reachable", and no park took the ask.
  *  - `approver_error` — the approver threw.
  *  - `approver_contract` — the approver answered outside its contract (a non-boolean verdict, an
  *    unreadable member, a timeout-settled allow, a refused attribution…).
- *  - `presentation_failed` — the args or the edit could not be safely presented/adopted (unclonable).
+ *  - `presentation_failed` — at a seat with an approver, the arguments could not be bound (`bindableArgsOf`: not a record of plain
+ *    JSON data nested at most 256 levels deep): the asked ones — nobody was asked — or a resolution's edit (the engine's resolver's
+ *    or, recorded by the gate, a host resolver's) — its yes is not used.
  *  - `blanket_allow_refused` — an allow NO PERSON JUDGED met a `requiresRealApproval` ask: a blanket
  *    `onAsk:"allow"`, or an approver's allow it reported as the deployment's policy (`settledBy: "policy"`).
  *  - `task_aborted` — the wait's abort signal ended it (the run's own end, or a turn-level interrupt).
@@ -218,7 +221,8 @@ export type SettlementRefusalTableCoversEveryKind = AssertAllKeysHandled<Exclude
  *    the ask on a durable queue instead), and the two sites that treat it as headless anyway say so at
  *    their own call, because they are the ones with no park route left.
  *  - `approver_error` / `approver_contract` / `presentation_failed` — the approver was there and the
- *    engine could not use it. A defect to report, not a deployment with nobody home.
+ *    engine could not use its answer, or could not put these arguments before it (or adopt its edit). Not a
+ *    deployment with nobody home: with no approver, such arguments are refused under `no_approver`.
  *  - `task_aborted` — the run ended; nothing is escalating anywhere.
  */
 export declare const SETTLEMENT_NOBODY_JUDGED: {
@@ -336,12 +340,17 @@ export type CauseTableCoversEveryDeniedBy = AssertAllKeysHandled<Exclude<DeniedB
  *  allow or deny) and from BOTH stations (this gate's own classifier step, and an ANCESTOR's frozen
  *  classifier reached through the inherited policy chain, whose allow and deny carry it out on the same seat
  *  that carries the FORM): which model it was for, which one answered, and — only when the ladder moved —
- *  the rung it left and why. ABSENT reads UNKNOWN, never "the seat answered" (that is `fallback` absent WITH
- *  the member present), and a consumer cannot tell its two causes apart from the record alone: no
- *  classification happened, or one ran on a decider given no candidate ladder and can name no model (a
- *  hand-built decider; a parked ancestor's cross-process rebuild, whose single fresh leg has none). A block
- *  at the DENIAL-LIMIT bound reaches no attribution seat: it becomes an ask, and the disposition names that
- *  resolution. Additive. Invariant I6 ({@link screenGateOutcome}) screens its shape. */
+ *  the rung it left and why. It is the classification's account, not the settlement's: a classification that
+ *  RULED keeps it whoever then decided the call — a call whose question a person then answered (an ask a
+ *  station after the classifier raised, or a block at the DENIAL-LIMIT bound, which becomes an ask) carries
+ *  it beside that person's settlement on {@link GateOutcome}; who decided is read from the settlement
+ *  (`human_allowed`, `policy_allowed`, …), never from this member's presence. ABSENT reads UNKNOWN, never
+ *  "the seat answered" (that is `fallback` absent WITH the member present), and a consumer cannot tell its
+ *  three causes apart from the record alone: no classification happened; one ran on a decider given no
+ *  candidate ladder and can name no model (a hand-built decider; a parked ancestor's cross-process rebuild,
+ *  whose single fresh leg has none); or one did not rule (it could not run, or replied with no verdict) and
+ *  handed the question to the approval seat, whose settlement then names the resolution that ask reached.
+ *  Additive. Invariant I6 ({@link screenGateOutcome}) screens its shape. */
 export type GateDisposition = {
     kind: "allowed";
     classifier?: AutoModeClassifierRound;

package/dist/core/governance-codes.d.ts

@@ -48,7 +48,8 @@ export declare function governanceRetryClass(code: string): GovernanceRetryClass
  * fixed the roster (`config.tool_mount_denied`), a
  * member over a roster row's wire bound (`config.tool_roster_bound` / `config.tool_name_too_long` /
  * `config.tool_contract_too_long`), a schema over the row's key bounds (`config.tool_schema_bound`), a
- * declared face or result card the schema / namespace cannot carry (`config.tool_face_invalid`), a name or
+ * declared face or result card the schema / namespace cannot carry (`config.tool_face_invalid` — also the code an MCP server entry's
+ * unreadable `toolFaces` is refused with at the task preparation door and at `materializeMcpTools`), a name or
  * alias outside the caller tool name contract — one no rule can name, or one carrying the protocol namespace separator
  * (`config.tool_name_invalid`), an egress tool declared other than
  * `write` (`config.egress_requires_write_effect` — also minted, same meaning, for a protocol tool's resolved
@@ -138,7 +139,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.read_deny_swapped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.path_view_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.credential_not_withheld", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "mods.registration_refused", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.credential_origin_mismatch", "route.response_model_mismatch", "route.tool_call_id_folded", "route.finish_reason_unknown", "route.stream_end_ignored", "route.extra_body_reserved_dropped", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "tool_result.media_refused", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable", "permission.entry_mode_clamped"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.read_deny_swapped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.path_view_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.credential_not_withheld", "config.cross_boundary_posture_undeclared", "config.cross_boundary_record_unwritten", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "config.session_rules_earlier_grammar", "permission.allowed_tool_not_granted", "mods.registration_refused", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.credential_origin_mismatch", "route.response_model_mismatch", "route.tool_call_id_folded", "route.finish_reason_unknown", "route.stream_end_ignored", "route.extra_body_reserved_dropped", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "tool_result.media_refused", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable", "permission.entry_mode_clamped"];
 /** A catalogued code (see {@link ENGINE_NOTICE_CODES}); {@link NOTICE_MINTER} says who mints it. NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */
@@ -187,6 +188,7 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "permission.read_deny_unapplied": "user";
     readonly "permission.rule_store_unavailable": "user";
     readonly "permission.rule_row_dropped": "user";
+    readonly "config.session_rules_earlier_grammar": "user";
     readonly "permission.allowed_tool_not_granted": "user";
     readonly "mods.registration_refused": "user";
     readonly "memory.capture_opted_out": "user";
@@ -218,6 +220,8 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "config.peer_admission_out_of_range": "operator";
     readonly "config.secret_env_scrubbed": "operator";
     readonly "config.credential_not_withheld": "operator";
+    readonly "config.cross_boundary_posture_undeclared": "operator";
+    readonly "config.cross_boundary_record_unwritten": "operator";
     readonly "peer.inbound_disposition": "user";
     readonly "peer.held_settled": "user";
     readonly "peer.idle_subscription": "user";
@@ -304,11 +308,14 @@ declare const NOTICE_MINTER_TABLE: {
     readonly "config.peer_lane_unmounted": "engine";
     readonly "config.secret_env_scrubbed": "engine";
     readonly "config.credential_not_withheld": "engine";
+    readonly "config.cross_boundary_posture_undeclared": "engine";
+    readonly "config.cross_boundary_record_unwritten": "engine";
     readonly "config.permission_mode_unavailable": "engine";
     readonly "permission.ask_released_by_mode": "engine";
     readonly "permission.read_deny_unapplied": "engine";
     readonly "permission.rule_store_unavailable": "engine";
     readonly "permission.rule_row_dropped": "engine";
+    readonly "config.session_rules_earlier_grammar": "engine";
     readonly "permission.allowed_tool_not_granted": "engine";
     readonly "mods.registration_refused": "engine";
     readonly "peer.inbound_disposition": "engine";

package/dist/core/governance-codes.js

@@ -146,11 +146,14 @@ export const ENGINE_NOTICE_CODES = Object.freeze([
     "config.peer_lane_unmounted",
     "config.secret_env_scrubbed",
     "config.credential_not_withheld",
+    "config.cross_boundary_posture_undeclared",
+    "config.cross_boundary_record_unwritten",
     "config.permission_mode_unavailable",
     "permission.ask_released_by_mode",
     "permission.read_deny_unapplied",
     "permission.rule_store_unavailable",
     "permission.rule_row_dropped",
+    "config.session_rules_earlier_grammar",
     "permission.allowed_tool_not_granted",
     "mods.registration_refused",
     "peer.inbound_disposition",
@@ -246,6 +249,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "permission.read_deny_unapplied": "user",
     "permission.rule_store_unavailable": "user",
     "permission.rule_row_dropped": "user",
+    "config.session_rules_earlier_grammar": "user",
     "permission.allowed_tool_not_granted": "user",
     "mods.registration_refused": "user",
     "memory.capture_opted_out": "user",
@@ -277,6 +281,8 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.peer_admission_out_of_range": "operator",
     "config.secret_env_scrubbed": "operator",
     "config.credential_not_withheld": "operator",
+    "config.cross_boundary_posture_undeclared": "operator",
+    "config.cross_boundary_record_unwritten": "operator",
     "peer.inbound_disposition": "user",
     "peer.held_settled": "user",
     "peer.idle_subscription": "user",
@@ -344,11 +350,14 @@ const NOTICE_MINTER_TABLE = {
     "config.peer_lane_unmounted": "engine",
     "config.secret_env_scrubbed": "engine",
     "config.credential_not_withheld": "engine",
+    "config.cross_boundary_posture_undeclared": "engine",
+    "config.cross_boundary_record_unwritten": "engine",
     "config.permission_mode_unavailable": "engine",
     "permission.ask_released_by_mode": "engine",
     "permission.read_deny_unapplied": "engine",
     "permission.rule_store_unavailable": "engine",
     "permission.rule_row_dropped": "engine",
+    "config.session_rules_earlier_grammar": "engine",
     "permission.allowed_tool_not_granted": "engine",
     "mods.registration_refused": "engine",
     "peer.inbound_disposition": "engine",

package/dist/core/hands-band-screen.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Total over what a deployment can hand the seat: absent passes; a value that is not a plain record, a member the record does not
+ * have, or a member holding a value it does not take refuses by name (`config.invalid_argument`, `detail.field` = `RunnerDeps.hands`
+ * or `RunnerDeps.hands.<member>`) — a band setting the engine cannot read is never run as if it were absent. A member holding
+ * `undefined` is absence, as on every optional seat.
+ */
+export declare function screenHandsBandOptions(value: unknown): void;

package/dist/core/hands-band-screen.js

@@ -0,0 +1,32 @@
+const HANDS_BAND_MEMBERS = {
+    bashReadonlyAllow: { takes: "a list of command-name strings", ok: (v) => Array.isArray(v) && v.every((c) => typeof c === "string") },
+    commitCoAuthor: { takes: "a string or false", ok: (v) => typeof v === "string" || v === false },
+    readImageDownsampler: { takes: "a function or false", ok: (v) => typeof v === "function" || v === false },
+    beforeWrite: { takes: "a function", ok: (v) => typeof v === "function" },
+    autoBackgroundOnTimeout: { takes: "a boolean", ok: (v) => typeof v === "boolean" },
+};
+const kindOf = (v) => (v === null ? "null" : Array.isArray(v) ? "an array" : typeof v);
+export function screenHandsBandOptions(value) {
+    if (value === undefined)
+        return;
+    const refuse = (field, problem) => {
+        const e = new Error(`${field} ${problem} — a hands band setting the engine cannot read is refused rather than ignored.`);
+        e.code = "config.invalid_argument";
+        e.detail = { field };
+        throw e;
+    };
+    const proto = typeof value === "object" && value !== null ? Object.getPrototypeOf(value) : undefined;
+    if (typeof value !== "object" || value === null || Array.isArray(value) || (proto !== Object.prototype && proto !== null)) {
+        refuse("RunnerDeps.hands", `must be a plain record of hands band settings (got ${kindOf(value)})`);
+    }
+    for (const key of Object.keys(value)) {
+        const v = value[key];
+        if (v === undefined)
+            continue;
+        if (!Object.hasOwn(HANDS_BAND_MEMBERS, key))
+            refuse(`RunnerDeps.hands.${key}`, `is not a hands band setting (the settings: ${Object.keys(HANDS_BAND_MEMBERS).join(", ")})`);
+        const member = HANDS_BAND_MEMBERS[key];
+        if (!member.ok(v))
+            refuse(`RunnerDeps.hands.${key}`, `must be ${member.takes} (got ${kindOf(v)})`);
+    }
+}

package/dist/core/hooks.d.ts

@@ -1,7 +1,7 @@
 import type { ActorAssertion, DocumentContent, ImageContent, TextContent } from "../internal/llm.js";
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
 import type { DecisionReason, PermissionResult, ResolvedAsk, ToolCallFace, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
-import type { CallTargetStamp } from "./effective-path-target.js";
+import { type CallTargetStamp } from "./effective-path-target.js";
 import type { GateOutcome } from "./gate-outcome.js";
 import { type PreToolUseScreening } from "./runner/gate-exit.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./rule-lane-reads.js";
@@ -13,6 +13,7 @@ import type { WiringLegKind } from "./wiring-manifest.js";
 import type { PermissionSeatInputs } from "./mode-policy.js";
 import type { SkillGateSeats } from "./skill-grant.js";
 import type { AllowEntryGateSeats } from "./allow-entry.js";
+import type { CrossBoundaryGateSeat } from "./cross-boundary-taint.js";
 /**
  * The classic stations' faces and the two-phase tool gate. A deployment extends the engine through the mods bus
  * (`RunnerDeps.mods` / `TaskSpec.mods`, `src/core/mods/`): each sema station raises one `classic.*` event, and the
@@ -554,9 +555,10 @@ export interface ToolGateResult {
      *  as taken at the gate's entry, or what a hook, a policy or a person rewrote them to); re-validated by the loop. Present
      *  on every allow exit, whether or not anything rewrote (compare values to tell); absent on a block and a suspend. */
     updatedInput?: unknown;
-    /** The input this pass decided on (what a refusal refused, what an allowed call runs with) as a deep, FROZEN copy taken
-     *  at the exit — never the live args. Beside {@link gate} on both terminal exits; absent on the suspend exit. The deny
-     *  observer gets a detached, writable copy of it. */
+    /** The input this pass decided on (what a refusal refused, what an allowed call runs with) as a deep, FROZEN plain-data projection
+     *  taken at the exit — never the live args: on a refusal every member that is not data (a bigint, a Map, a Date, a class instance, a
+     *  function, an accessor, a symbol-keyed member) is a `[not recorded: …]` marker; an allow exit meets only the gate's own copy, so there
+     *  just a bigint, a cycle's closing member and containers past 256 levels are. Beside {@link gate} on both terminal exits; absent on the suspend exit. */
     finalInput?: unknown;
     /** A blocking refusal's structured details, when the refusing station minted any (the shell read station's
      *  `read_path_denied` / `readonly_out_of_root` cards): the loop attaches them to the error result it mints
@@ -611,9 +613,8 @@ export type ContentAskOutcome = {
  * happened" (no facility armed, or the closure took its sync-first decline) — that case hides nothing,
  * while this one does: the gate falls back to the synchronous approver chain either way (the
  * compensation contract — an uncommitted checkpoint is a safe fallback — is unchanged), but on a
- * headless deployment that fallback is the auto-deny whose text is "no approver is wired". True as far
- * as it goes, and the whole reason the call did not park lives somewhere else entirely (the host's
- * `onError` face). So the reason travels with the fall-through and the deny quotes it.
+ * headless deployment that fallback is the auto-deny whose text is "no approver is wired". True as far as it goes, and the whole
+ * reason the call did not park lives somewhere else entirely (the host's `onError` face). So the reason travels with the fall-through and the deny quotes it.
  */
 export interface ParkAttemptFailed {
     /** Why the park could not be minted — a sentence, already worded for a reader. */
@@ -629,9 +630,9 @@ export interface ParkAttemptFailed {
  */
 export type OrgGateVerdict = {
     status: "available";
-    /** The org rule that speaks for this call, if any. Deny outranks ask; there is no allow bucket. An
-     *  `unreadable` member (the lexer's reason) says the call could not be READ against `rule` — an
-     *  org rule that may reach it — so `behavior` is `ask` and the message names the reason. */
+    /** The org rule that speaks for this call, if any. Deny outranks ask; there is no allow bucket. An `unreadable` member says why
+     *  `rule` could not be judged against the call (the message names it): the call could not be READ against it (the lexer's reason;
+     *  `behavior` is `ask`), or the row is one the org layer does not read, standing at its strictest reading (`deny`, or `ask`). */
     verdict?: {
         behavior: "deny" | "ask";
         rule: string;
@@ -720,18 +721,20 @@ export type PersistedRuleAnswer = PersistedRuleHit | PersistedRuleCoverage | Per
  *  signal; when the caller also supplies {@link ToolGateInput.callSignal}, the Runner's closures
  *  additionally bind their waits to that per-call signal (`AbortSignal.any` of the two), so a turn
  *  interrupt releases a pending ask instead of leaving it hanging on the run's lifetime alone. */
-export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, AllowEntryGateSeats {
+export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, AllowEntryGateSeats, CrossBoundaryGateSeat {
     /** RB-473 batch 2b — bounded disclosure for a HOST callback that throws inside this gate call's
      *  isolation scope (onHookError itself, the deny observer, the durable-park observer). The runner
      *  wires this to an `observer.notify_failed` trace event; absent = counted only (unchanged). */
     onNotifyError?: (failure: import("./safe-notify.js").SafeNotifyFailure) => void;
     /** The call. `toolName` is the name every policy, hook and name-keyed table of this gate reads — the wire name of the
      *  tool the call dispatches to: the Runner's station resolves a call made under an alias through the roster
-     *  (`rosterToolName`) before this gate runs; a host driving the gate resolves it the same way. */
+     *  (`rosterToolName`) before this gate runs; a host driving the gate resolves it the same way. `readArguments` = the loop's
+     *  reading of the call's args: stamped on the call's face, every rewrite this gate adopts is read through it (`argsAsTheToolReads`). */
     event: {
         toolCallId: string;
         toolName: string;
         input: Record<string, unknown>;
+        readArguments?: (args: unknown) => unknown;
     };
     /** The run/leg identity envelope, put verbatim on every {@link PreToolUseEvent} this
      *  gate call builds and on every {@link PermissionDeniedPayload} it emits. The Runner supplies its
@@ -1092,12 +1095,11 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
      * The deny exit nobody judged: the call's approval could not be RESOLVED (`cause` — the approver
      * answered `unavailable`, no approver is wired, or an inherited durable mandate has no park facility on
      * this leg) and no durable park took the call, so the fail-closed deny STANDS. Fired once per such call
-     * from the gate's single deny exit, after every park re-route has had its attempt, with the facts the
-     * `delegation.ask_unresolvable` notice is composed from (`ask-unresolvable-notice.ts`);
-     * `parkLaneExisted` = a park lane was armed for this run; `remedy` = the caller-side change that would have let the
-     * call run, present for the causes that say nobody could be asked (`approver_unavailable`, `no_approver_wired`).
-     * Observe-only: a throwing seat never alters the deny. Absent ⇒ the deny stands silently (a host driving the gate
-     * directly, no notice sink).
+     * from the gate's single deny exit, after every park re-route has had its attempt, with the facts the `delegation.ask_unresolvable`
+     * notice is composed from (`ask-unresolvable-notice.ts`); `parkLaneExisted` = a park lane was armed for this run; `remedy` = the
+     * caller-side change that would have let the call run, present for the causes that say nobody could be asked (`approver_unavailable`,
+     * `no_approver_wired`) — for arguments no approval can be bound to, the binding's own sentence (the remedy's approver half would not
+     * let them run). Observe-only: a throwing seat never alters the deny. Absent ⇒ the deny stands silently (no notice sink).
      */
     onAskUnresolvable?: (info: {
         toolName: string;
@@ -1309,7 +1311,7 @@ export declare function createPreToolUseScreening(input: Pick<ToolGateInput, "ev
  * structural rather than restated.
  *
  * The mapping mirrors the gate's own phase 1 decision for decision:
- *  - no opinion → `allow`, contributing nothing;
+ *  - no opinion, and an `allow` → `allow`, contributing nothing (a constraint only tightens: it clears no question);
  *  - `deny` → `deny` in the fold's own words;
  *  - `ask` → `ask`, stamped `decisionReason:"hook"` (and the mandate, when the answer set it) so every consumer that
  *    distinguishes a screening ask from a policy ask reads the same fact one level down;

package/dist/core/hooks.js

@@ -1,4 +1,5 @@
-import { abortedSeatDeny, decisionText, describeThrown, isEngineRefusal, ownArgs, refuseOutOfContractDecision, unaskedSeatAnswer } from "./tool-policy.js";
+import { argsAsTheToolReads, stampArgsReading } from "./effective-path-target.js";
+import { abortedSeatDeny, decisionText, describeThrown, isEngineRefusal, ownArgs, ownedReading, refuseOutOfContractDecision, unaskedSeatAnswer } from "./tool-policy.js";
 import { createSettlementLedger, engineFailClosedExit, hookDenyExit, unownedArgsExit } from "./runner/gate-exit.js";
 import { classicEventBase, dispatchClassic, ENGINE_CORE_ANSWER, engineCore, failedHandlerClause, judgedInputOf, observePermissionDenied, recordScreeningChain } from "./mods/stations.js";
 import { runGateFold } from "./gate-fold.js";
@@ -185,8 +186,7 @@ export function createPreToolUseConstraintPolicy(chain, env) {
                     ...(r.updatedInput !== undefined ? { updatedInput: r.updatedInput } : {}),
                 };
             }
-            const stated = r.action === "allow" ? { decisionReason: "hook" } : {};
-            return r.updatedInput !== undefined ? { action: "allow", updatedInput: r.updatedInput, ...stated } : { action: "allow", ...stated };
+            return r.updatedInput !== undefined ? { action: "allow", updatedInput: r.updatedInput } : { action: "allow" };
         },
     }, "hook");
     recordScreeningChain(minted, chain);
@@ -235,7 +235,8 @@ export async function runToolGate(input) {
         screening,
         afterFold: runGateLanes,
         currentInput: args,
-        req: Object.freeze({ toolName, args, toolCallId, ...(() => { const f = input.toolFaceOf?.(toolName); return f !== undefined ? { face: f } : {}; })() }),
+        req: Object.freeze({ toolName, args, toolCallId, ...(() => { const f = input.toolFaceOf?.(toolName); const read = event.readArguments; if (f !== undefined && read !== undefined)
+                stampArgsReading(f, ownedReading(read)); return f !== undefined ? { face: f } : {}; })() }),
         preToolContext: [],
         hookAsk: undefined,
         parkFailed: undefined,
@@ -261,7 +262,7 @@ export async function runToolGate(input) {
                 return hookDenyExit(pass, screening.deniedReason(r));
             }
             if (r.updatedInput !== undefined) {
-                pass.currentInput = r.updatedInput;
+                pass.currentInput = argsAsTheToolReads(pass.req, r.updatedInput);
             }
             if (r.action === "ask") {
                 pass.hookAsk = r;