@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/runner/contracts.d.ts

@@ -234,7 +234,7 @@ export interface FrameReceipt {
     text: string;
     /** Which frame this receipt settles. A boundary collector must not render a listing whose receipt is
      *  still pending (the frame is queued, not yet in the transcript). */
-    source: "git_status" | "agent_listing" | "skills_listing" | "date_change" | "output_style";
+    source: "git_status" | "agent_listing" | "skills_listing" | "date_change" | "output_style" | "approval_feedback";
     /** Runs inside the `message_end` walk (synchronous, never awaited): advances the run-local record
      *  and parks any session write for the next serialization point. */
     commit: (entryId: string) => void;
@@ -396,17 +396,15 @@ export interface Prepared {
     effectiveReadFace?: ContainmentFace;
     /** owned — the same observation on the WRITE seat (`TaskResult.effectiveWriteFace`). */
     effectiveWriteFace?: ContainmentFace;
-    /** The normalized deny ADDITIONS in force (deployment ∪ task ∪ checkpoint seed; built-ins
-     *  excluded), echoed on `TaskResult.effectiveReadDenyPatterns`. Present iff non-empty; a defensive
-     *  copy (the wide-scope working array stays the engine's own). */
+    /** The normalized deny ADDITIONS in force (deployment ∪ task ∪ checkpoint seed; built-ins excluded), echoed on
+     *  `TaskResult.effectiveReadDenyPatterns`. Present iff non-empty; a defensive copy (the working array stays the engine's). */
     effectiveReadDenyPatterns?: readonly import("../../tools/fs/read-deny.js").NormalizedReadDenyEntry[];
     /** The memory-visibility observation prepareMemory minted (echoed on
      *  `TaskResult.effectiveMemoryScopes`). Always present on a completed prepare (the memory-less
      *  states are their own values); the seat is optional only so a Prepared shape without the phase
      *  cannot fabricate one. */
     effectiveMemoryScopes?: import("../types.js").EffectiveMemoryScopes;
-    /** The per-task logical cwd ref when a real shell is mounted (else undefined). The Runner
-     *  reads `cwdRef.current` after each tool to detect a `cd` move and emit `workspace_changed`. */
+    /** The per-task logical cwd ref when a real shell is mounted (else undefined); read after each tool for `workspace_changed`. */
     cwdRef?: CwdRef;
     /** The root the hand tools resolve root-relative spellings against (present with hands; read-only hands included). */
     handsRoot?: string;
@@ -478,6 +476,11 @@ export interface Prepared {
      *  admission died with that leg, so the resumed bytes are judged (and admitted for their pre-spawn re-establishment)
      *  on THIS leg — a deny row found now vetoes, an operator's edit is judged on the `rejudge` seat. */
     shellReadCheck?: import("../../tools/fs/shell-read-check.js").ShellReadCheck;
+    crossBoundary?: {
+        readonly check: import("../cross-boundary-taint.js").CrossBoundaryCheck | undefined;
+        settle(): Promise<void>;
+        storeWaits(): number;
+    };
     /** The ORG adjudication face, re-resolved on a durable RESUME before an approved
      *  pending call executes. The resume path bypasses the harness gate by design (a human already
      *  adjudicated the checkpointed call), which is exactly where org policy skew is most likely: the
@@ -1004,56 +1007,42 @@ export interface Prepared {
      *  calls themselves never pass through the recorded seam (they ride the separate compaction-brain
      *  wrapper), so the snapshot is never polluted by a summary request. */
     lastBrainContext: () => CompactionForkContext | undefined;
-    /** Narrow workspace reader for compaction working-file attachments (LONGRUN-2): reads a task file
-     *  via the SAME env the hands ran against (so remote/k8s/E2B tasks read the container's tree, not
-     *  the control plane's). Present only when the hands are enabled — without an env there is no
-     *  workspace to re-read. null = unreadable (deleted/binary/transport error); callers skip it.
-     *  `{ withheld }` = the target matches the sensitive-path read deny list — the
-     *  attachment is deliberately withheld and the consumer must SAY so (an annotation, never a silent
-     *  skip: a silently missing attachment reads as "file gone", which is a different fact). */
-    readTaskFile?: (path: string) => Promise<string | null | {
-        withheld: {
-            pattern: string;
-        };
-    }>;
+    /** The post-compaction restore (`MaybeCompactOptions.workingFileAttachments.restore`): re-reads the candidates through
+     *  the leg's one file reader under the run's synthetic-Read judge — the user attachment's own path read — deduplicated
+     *  against the read state the summary leaves, and mints their attachment frames (`readCompactionRestore`); a file it
+     *  does not deliver — or whose frame the transcript does not take — is reported (`onError` phase `degraded`,
+     *  classification `attachment-read`). Present only with hands. */
+    compactionRestore?: Required<Pick<NonNullable<import("../auto-compaction.js").MaybeCompactOptions["workingFileAttachments"]>, "restore" | "undelivered">>;
     /** CC post-compact restore parity (2026-07-03): the task's READ files, most recent
-     *  first (from the hands' readFileState `lastReadAt` stamps). The compaction working-file
-     *  attachment prefers this over the modified set — CC restores what the model RECENTLY READ,
-     *  including untouched reference files. Present only with hands (same gate as readTaskFile).
-     *  Seeded entries are excluded — their content lives in the system-prompt lane, which
-     *  compaction never touches, so re-attaching them into the summary would be a duplicate. */
+     *  first (from the hands' readFileState `lastReadAt` stamps). The restore prefers this over the modified set — CC
+     *  restores what the model RECENTLY READ, including untouched reference files. Present only with hands.
+     *  Seeded entries are excluded — their content lives in the system-prompt lane, which compaction never touches. */
     recentlyReadFiles?: () => string[];
     /** Canonicalizes a raw (often relative, model-typed) path the
-     *  SAME way the hands toolkit does (`resolveKey` against the same containment root `readTaskFile`
-     *  uses), so `maybeCompact`'s kept-tail/instruction-source exclusions compare paths in the SAME
+     *  SAME way the hands toolkit does (`resolveKey` against the hands' containment root), so `maybeCompact`'s
+     *  kept-tail/instruction-source exclusions compare paths in the SAME
      *  coordinate `recentlyReadFiles()` already uses — without this a plain string match silently never
-     *  fires for the common relative-vs-canonical case. Present only with hands (same gate as
-     *  readTaskFile); absent there is no containment root to resolve against, and every path source is
-     *  already in the same raw coordinate anyway. */
+     *  fires for the common relative-vs-canonical case. Present only with hands; absent there is no
+     *  containment root to resolve against, and every path source is already in the same raw coordinate anyway. */
     normalizeAttachmentPath?: (raw: string) => Promise<string>;
     /** Recognizes the hands Read tool's own dedup-stub markers
      *  ({@link isReadDedupStubResult}), so `maybeCompact`'s kept-tail scan can tell a SUBSTANTIVE Read
      *  result from a stub hit whose original full transmission may already be summarized away. Present
-     *  only with hands (same gate as readTaskFile). */
+     *  only with hands. */
     isDedupStubResult?: (resultText: string) => boolean;
     /** Wired to `MaybeCompactOptions.onApplied` by every compaction lane (CC 220 clears readFileState at its
-     *  compaction landing site, @388663). Drops the non-seeded read-state entries
-     *  (the summary just replaced the Read results the dedup stubs point at) and re-registers the files
-     *  that were re-attached WHOLE. Present only with hands (same gate as readTaskFile).
-     *  `preserveReadState` carries the kept-tail-visible files that were
-     *  deliberately skipped for re-attachment — their existing entry must survive the clear too (same
-     *  reasoning as a seeded entry: the model's view of the file did not change).
+     *  compaction landing site, @388663). Drops every read-state entry the summary took out of view
+     *  (`readFileStateAfterSummary`); the restored files then re-register through their frames' own commits. Present
+     *  only with hands. `preserveReadState` carries the files the context the summary leaves still shows — their
+     *  existing entry survives the clear (the model's view of the file did not change).
      *
      *  SCOPE — read "every compaction lane" as exactly that and no wider. The request-layer
      *  stale-result pass takes a Read body off the wire with no compaction at all, and retires its own
      *  entries at its own landing site (`prepare-context-lane.ts`'s `landStaleResultClears`) through the
-     *  SAME function this seat calls, on its `tool-results-cleared` arm: ONE retirement mechanism, two
-     *  ways for content to leave. Taken as a claim about every SHRINK mechanism this sentence was true
+     *  SAME function this seat calls, on its `transmissions-gone` arm (the guard trim's dropped tool results and attachment frames too):
+     *  ONE retirement mechanism, several ways for content to leave. Taken as a claim about every SHRINK mechanism this sentence was true
      *  of the lanes it named and silently false of the one it did not. */
-    onCompactionApplied?: (attachedComplete: ReadonlyArray<{
-        path: string;
-        content: string;
-    }>, preserveReadState?: ReadonlyArray<string>) => void;
+    onCompactionApplied?: (preserveReadState: ReadonlyArray<string>) => void;
     /** The live diagnostics lane (present only when the gate passed — manager w/ registry +
      *  write hands + not opted out). `registry` is drained by runtask at turn boundaries; `nudge` is
      *  called (fire-and-forget) after each successful edit/write so the language server re-analyzes. */
@@ -1725,6 +1714,9 @@ export interface RunInternals {
         };
         contentSafety: import("../memory-engine/delegation-provenance.js").DelegationContentSafety;
     };
+    /** The run TREE's cross-boundary token — the tree's ONE state is reached from it by the engine alone: the spawning leg hands its
+     *  own down (the delegation and workflow lanes), so a bit any leg sets is read by every other at its next judgment; a root leg mints one. */
+    crossBoundaryTree?: import("../cross-boundary-taint.js").CrossBoundaryTreeToken;
     /**
      * The SESSION-scoped org-admission freeze for a SAME-SESSION continuation
      * that is NOT a checkpoint resume: a retained background child revived through the in-process resume
@@ -2938,6 +2930,7 @@ export interface ManualCompactRef {
  */
 export type EndOfTaskCompaction = {
     compacted: boolean;
+    pass?: string;
     tokensBefore?: number;
     freedTokens?: number;
     triggerTokens?: number;

package/dist/core/runner/cross-boundary-lane.d.ts

@@ -0,0 +1,87 @@
+/**
+ * The device lane's cross-boundary WIRING for one leg: the tree's shared state ref, the session record that carries the state from
+ * one leg of a session to the next, and the gate seat whose ONE obligation reading the station and both exits share.
+ *
+ * WHERE THE STATE LIVES. The tree's state is one object, reached from the tree's opaque token (`RunInternals.crossBoundaryTree`,
+ * `ToolExecuteContext.crossBoundaryTreeForChildren`) through this module alone; each leg joins into it what it knows at prepare (its
+ * environment's declaration, its session's newest record, its posture) and every bit an exit sets lands there before the call
+ * runs. Each leg's session holds a record (`CROSS_BOUNDARY_RECORD_TYPE`) of the state its content was produced under — written only
+ * for an armed tree: at prepare and at an exit (before the call runs) when the state grew past what the session already says, and at
+ * a leg's end (before a suspend's row is put, when the leg settles) also when conversation content follows the newest record. A
+ * write that fails refuses its call (or its row) on a governed tree; a prepare's or a settle's, and any write on a tree that is not
+ * governed, mints `config.cross_boundary_record_unwritten`. A record covers the content before it: a leg that takes over a session
+ * whose content no record covers (none on the branch, or after the newest), on an armed tree, reads that content as off-target.
+ *
+ * THE OBLIGATION of a call is read off three things at the moment it is asked ({@link crossBoundaryObligation}): the legs the
+ * call travels (its roster row's declaration, or what the dispatching code gives per call), whether the environment the `env`
+ * leg reaches declares itself the target NOW, and the tree's state NOW.
+ */
+import type { AgentTool } from "../../internal/harness.js";
+import type { SessionTreeEntry } from "../../internal/harness-types.js";
+import { type CrossBoundaryCheck, type CrossBoundaryPosture, type CrossBoundaryTreeToken } from "../cross-boundary-taint.js";
+import { type ToolRoster } from "../tool-roster.js";
+import type { RunnerDeps } from "../types.js";
+/** A new tree with no bit set, and the token that names it — the one mint of a token. */
+export declare function mintCrossBoundaryTree(): CrossBoundaryTreeToken;
+/** The tree a leg joins: the one its handed token names, or a new one (a root leg) — synchronous, so the phases that hand the token
+ *  down never wait on the session. A token the engine did not mint names no tree it can read: reported, and the leg's tree reads as
+ *  the strictest state. */
+export declare function joinedCrossBoundaryTree(handed: CrossBoundaryTreeToken | undefined, report: (message: string) => void): CrossBoundaryTreeToken;
+/** One leg's cross-boundary wiring (see the module header). */
+export interface CrossBoundaryLane {
+    /** The tree's token — the one the leg's children are handed. */
+    readonly token: CrossBoundaryTreeToken;
+    /** The station and the exits are ENGAGED on this leg: a posture is declared, the leg runs on a target, or its tree is governed —
+     *  each fixed at prepare, so no live consumer flips between two readings mid-run. */
+    readonly stationEngaged: boolean;
+    /** The gate seat, minted once the leg's roster and tool instances exist; undefined on a leg whose station is not engaged. */
+    seat(view: CrossBoundaryLegView): CrossBoundaryCheck | undefined;
+    /** The seat minted by {@link seat}, for the resumed call's exit. */
+    readonly check: CrossBoundaryCheck | undefined;
+    /** Write the record the tree's state owes this leg's session: the new entry's id, or undefined when nothing was owed (or, on a tree
+     *  that is not governed, the write failed and was reported); throws when it cannot be written on a governed tree. With `atLeaf` (a
+     *  suspend: a leg's end), the record also covers the content after the newest one and is written only as the child of that leaf
+     *  (the row then points at it). */
+    owe(atLeaf?: string): Promise<string | undefined>;
+    /** The tree is armed, so the session OWES the tree's record and a parked row says a reader must read it — on a tree that is not
+     *  governed a failed write leaves the record missing (the notice says so), and the reader then reads the content after the newest
+     *  record as off-target. */
+    recorded(): boolean;
+    /** The leg settles: the record that covers what it added is written, a failure reported loudly (the next leg then reads the
+     *  content after the newest record as off-target). */
+    settle(): Promise<void>;
+    /** How many times this leg's record writes have waited on the session store — a station that judged before an exit reads again
+     *  when the count moved across it (the exit's own form: judged again after a wait). */
+    storeWaits(): number;
+}
+/** What the seat reads per call: the live roster (the legs a row declares) and the mounted instances (a `"per_call"` resolver). */
+export interface CrossBoundaryLegView {
+    readonly tools: readonly AgentTool[];
+    readonly roster: {
+        readonly current: ToolRoster | undefined;
+    };
+}
+export interface CrossBoundaryLaneInput {
+    /** The tree this leg joins ({@link joinedCrossBoundaryTree}), or none — a new tree. */
+    token?: CrossBoundaryTreeToken;
+    /** The posture door's reading (`undefined` = undeclared). */
+    posture: CrossBoundaryPosture | undefined;
+    /** The run fold: this leg's environment declares the target, or the row it resumes was minted on one. */
+    externalContentTargetActive: boolean;
+    /** The leg's own environment — read for its CURRENT declaration at each judgment. */
+    env: {
+        readonly externalContentTarget?: boolean;
+    };
+    session: {
+        getBranch(): Promise<ReadonlyArray<SessionTreeEntry>>;
+        getLeafId(): Promise<string | null>;
+        appendCustomEntry(customType: string, data?: unknown): Promise<string>;
+    };
+    resumeLeg: boolean;
+    sessionId: string;
+    runId: string;
+    hostTaskId: string;
+    deps: Pick<RunnerDeps, "onError" | "onNotice" | "tracer">;
+}
+/** The leg's lane: the tree ref joined with what this leg knows, the session's record read and (when the state grew) written. */
+export declare function prepareCrossBoundaryLane(input: CrossBoundaryLaneInput): Promise<CrossBoundaryLane>;

package/dist/core/runner/cross-boundary-lane.js

@@ -0,0 +1,190 @@
+import { BOUNDARY_LEGS, CROSS_BOUNDARY_RECORD_TYPE, CROSS_BOUNDARY_TAINT_BITS, STRICTEST_CROSS_BOUNDARY_TREE, crossBoundaryObligation, crossBoundaryPostureUndeclaredNotice, crossBoundaryRecordUnwrittenNotice, crossBoundaryRecordData, crossBoundaryTreeCovers, crossBoundaryTreeGoverned, joinCrossBoundaryTree, readCrossBoundaryRecord, } from "../cross-boundary-taint.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+import { policyCannotAnswer } from "../real-approval.js";
+import { thrownText } from "../thrown-value.js";
+import { rosterEntryNamed } from "../tool-roster.js";
+import { emitTrace } from "../trace.js";
+const TREE_STATE = new WeakMap();
+export function mintCrossBoundaryTree() {
+    const token = Object.freeze(Object.create(null));
+    TREE_STATE.set(token, { current: Object.freeze({}) });
+    return token;
+}
+export function joinedCrossBoundaryTree(handed, report) {
+    if (handed !== undefined && TREE_STATE.has(handed))
+        return handed;
+    const token = mintCrossBoundaryTree();
+    if (handed !== undefined) {
+        report("a cross-boundary tree token the engine did not mint was handed to this leg — it reads its tree as armed, observed and governed");
+        TREE_STATE.get(token).current = STRICTEST_CROSS_BOUNDARY_TREE;
+    }
+    return token;
+}
+const EVERY_LEG = Object.freeze([...BOUNDARY_LEGS]);
+const bitsOf = (t) => CROSS_BOUNDARY_TAINT_BITS.filter((b) => t[b] === true);
+function legsOfCall(view, legEnv, token, call, report) {
+    const roster = view.roster.current;
+    const row = roster !== undefined ? rosterEntryNamed(roster, call.toolName) : undefined;
+    if (row === undefined)
+        return { legs: EVERY_LEG, env: undefined };
+    if (row.boundaryLegs !== "per_call")
+        return { legs: row.boundaryLegs, env: legEnv };
+    const strictest = (why) => (report(`tool "${row.name}" declares its boundary legs per call, and its boundaryLegsFor ${why} — the call reads as every leg, off the target (the strictest reading)`), { legs: EVERY_LEG, env: undefined });
+    const resolve = view.tools.find((t) => t.name === row.name)?.boundaryLegsFor;
+    if (typeof resolve !== "function")
+        return strictest("is missing");
+    let given;
+    try {
+        given = resolve(call.args, { tree: token });
+    }
+    catch (err) {
+        return strictest(`threw (${thrownText(err)})`);
+    }
+    const { legs, env } = (typeof given === "object" && given !== null ? given : {});
+    if (!Array.isArray(legs) || !legs.every((l) => BOUNDARY_LEGS.some((b) => b === l)) || (env !== undefined && (typeof env !== "object" || env === null)))
+        return strictest("answered outside its type ({ legs: a list of boundary legs, env?: an environment })");
+    return { legs: legs, env: env ?? legEnv };
+}
+export async function prepareCrossBoundaryLane(input) {
+    const { posture, externalContentTargetActive, env, session, resumeLeg, sessionId, runId, hostTaskId, deps } = input;
+    const report = (message) => deps.onError?.(new Error(message), { phase: "config", sessionId });
+    const token = input.token ?? mintCrossBoundaryTree();
+    const ref = TREE_STATE.get(token);
+    if (ref === undefined)
+        throw new TypeError("prepareCrossBoundaryLane: the token names no tree (resolve it with joinedCrossBoundaryTree)");
+    let branch;
+    try {
+        branch = await session.getBranch();
+    }
+    catch (err) {
+        report(`the session's cross-boundary record could not be read (${thrownText(err)}) — this leg reads its tree as armed, observed and governed`);
+    }
+    const read = branch !== undefined ? readCrossBoundaryRecord(branch) : undefined;
+    if (read?.kind === "malformed")
+        report(`${read.why} — this leg reads its tree as armed, observed and governed`);
+    const fromRecord = read === undefined ? STRICTEST_CROSS_BOUNDARY_TREE : read.kind === "absent" ? {} : read.tree;
+    let recorded = read?.kind === "recorded" ? read.tree : {};
+    const own = { ...(externalContentTargetActive ? { targetExecutionArmed: true } : {}), ...(posture === "multi_tenant" ? { governed: true } : {}) };
+    let tree = joinCrossBoundaryTree(joinCrossBoundaryTree(ref.current, fromRecord), own);
+    if (tree.targetExecutionArmed === true && read !== undefined && read.kind !== "malformed" && read.uncoveredContent)
+        tree = joinCrossBoundaryTree(tree, { offTargetReadObserved: true });
+    ref.current = tree;
+    const stationEngaged = posture !== undefined || externalContentTargetActive || crossBoundaryTreeGoverned(tree);
+    const unwritten = (phase, err) => deliverEngineNotice(deps.onNotice, crossBoundaryRecordUnwrittenNotice({ sessionId, runId, phase, governed: crossBoundaryTreeGoverned(ref.current), cause: thrownText(err) }));
+    let writing = Promise.resolve();
+    let storeWaits = 0;
+    const write = (phase, atLeaf) => {
+        const next = writing.then(async () => {
+            let leafAt = atLeaf;
+            let cover = phase === "suspend" || phase === "settle";
+            let written;
+            for (;;) {
+                const state = ref.current;
+                if (state.targetExecutionArmed !== true)
+                    return written;
+                const grown = !crossBoundaryTreeCovers(recorded, state);
+                if (!grown && !cover)
+                    return written;
+                try {
+                    if (!grown) {
+                        storeWaits++;
+                        const now = readCrossBoundaryRecord((await session.getBranch()));
+                        if (now.kind !== "malformed" && !now.uncoveredContent) {
+                            cover = false;
+                            continue;
+                        }
+                    }
+                    if (leafAt !== undefined) {
+                        storeWaits++;
+                        if ((await session.getLeafId()) !== leafAt)
+                            throw new Error("the session moved past the row's leaf before its record could be written");
+                    }
+                    storeWaits++;
+                    const entryId = await session.appendCustomEntry(CROSS_BOUNDARY_RECORD_TYPE, crossBoundaryRecordData(state));
+                    if (typeof entryId !== "string" || entryId.length === 0)
+                        throw new Error(`the session store answered the record's append with no entry id (${typeof entryId})`);
+                    if (leafAt !== undefined && (storeWaits++, await session.getLeafId()) !== entryId)
+                        throw new Error("the record the session store appended is not the session's new leaf");
+                    recorded = state;
+                    written = entryId;
+                    if (leafAt !== undefined)
+                        leafAt = entryId;
+                    cover = false;
+                }
+                catch (err) {
+                    if (crossBoundaryTreeGoverned(ref.current))
+                        throw err;
+                    unwritten(phase, err);
+                    recorded = state;
+                    return written;
+                }
+            }
+        });
+        writing = next.catch(() => undefined);
+        return next;
+    };
+    const owe = (atLeaf) => write(atLeaf !== undefined ? "suspend" : "exit", atLeaf);
+    const trace = (phase, call) => emitTrace(deps.tracer, () => ({ kind: "permission.cross_boundary_taint", version: 1, taskId: hostTaskId, runId, phase, taint: bitsOf(ref.current), governed: ref.current.governed === true, ...(call !== undefined ? { toolName: call.toolName, ...(call.toolCallId !== undefined ? { toolCallId: call.toolCallId } : {}) } : {}), ts: Date.now() }));
+    if (tree.targetExecutionArmed === true) {
+        trace(resumeLeg ? "resume" : "prepare");
+        if (posture === undefined && tree.governed !== true)
+            deliverEngineNotice(deps.onNotice, crossBoundaryPostureUndeclaredNotice({ sessionId, runId, tree }));
+        await write("prepare").catch((err) => unwritten("prepare", err));
+    }
+    let check;
+    const lane = {
+        token,
+        stationEngaged,
+        get check() {
+            return check;
+        },
+        seat(view) {
+            if (!stationEngaged)
+                return undefined;
+            const obligationOf = (call, say) => {
+                const { legs, env: reached } = legsOfCall(view, env, token, call, say);
+                try {
+                    return crossBoundaryObligation(legs, reached?.externalContentTarget === true, ref.current);
+                }
+                catch (err) {
+                    say(`the cross-boundary obligation of "${call.toolName}" could not be read (${thrownText(err)}) — the call reads as every leg, off the target`);
+                    return crossBoundaryObligation(EVERY_LEG, false, ref.current);
+                }
+            };
+            const quiet = () => undefined;
+            check = {
+                obligation: (call) => obligationOf(call, report),
+                async exit(call, decidedBy) {
+                    for (;;) {
+                        const now = obligationOf(call, quiet);
+                        if (now.mandate && policyCannotAnswer({ action: "ask", requiresRealApproval: true }, decidedBy)) {
+                            return {
+                                kind: "unconfirmed",
+                                message: `tool "${call.toolName}" needs a person's confirmation: this run executes on a target device${ref.current.offTargetReadObserved === true ? " and has since let content from beyond it in, so a call that reaches beyond the device or back into it" : ", so a call that writes beyond the device"} is put to a person — this call was allowed by a configuration, not a person, and was not executed`,
+                            };
+                        }
+                        if (now.record && ref.current.offTargetReadObserved !== true) {
+                            ref.current = joinCrossBoundaryTree(ref.current, { offTargetReadObserved: true });
+                            trace("observed", call);
+                        }
+                        const judged = ref.current;
+                        try {
+                            await owe();
+                        }
+                        catch (err) {
+                            return { kind: "unrecorded", message: `tool "${call.toolName}" was not executed: the session's cross-boundary record could not be written before it ran (${thrownText(err)}) — on a governed tree a call that owes its record does not run without it; refused fail-closed` };
+                        }
+                        if (ref.current === judged)
+                            return undefined;
+                    }
+                },
+            };
+            return check;
+        },
+        owe,
+        storeWaits: () => storeWaits,
+        recorded: () => ref.current.targetExecutionArmed === true,
+        settle: () => write("settle").then(() => undefined, (err) => unwritten("settle", err)),
+    };
+    return lane;
+}

package/dist/core/runner/decide-continuation.d.ts

@@ -121,9 +121,9 @@ export declare function mintDecideRecord(cp: Checkpoint, facts: HostDecisionFact
 }): GateOutcome;
 /**
  * Capture-time domain check for a decide outcome's TEXT payloads — the review lanes' `editedPlan` /
- * `reason` and the approval lane's deny `reason`. All are persisted (the recorded winner's payload,
- * compared when an `env_failed` reopen replays it) and all are fenced into the model-facing
- * continuation reminder. The declared wire type is a string; a value outside it reads one way in this
+ * `reason`, the approval lane's deny `reason` and its allow `feedback`. All are persisted (the recorded winner's payload,
+ * compared when an `env_failed` reopen replays it) and all reach the model-facing continuation (the plan and the
+ * notes fenced into its reminder, the feedback as the person's own words). The declared wire type is a string; a value outside it reads one way in this
  * process and another after a JSON round-trip, and reaches the reminder as whatever its stringification
  * happens to be. Worse, the pre-CAS tag-hygiene check and the fence BOTH reach the value through
  * `String.prototype.replace`: an object carrying its own `replace` is therefore read twice and may
@@ -133,7 +133,7 @@ export declare function mintDecideRecord(cp: Checkpoint, facts: HostDecisionFact
  * is named in the message only — `CheckpointError`'s structured `detail.field` is a closed set covering
  * the approval lane's payload names, and widening it is a wire-surface change of its own.
  */
-export declare function assertOutcomeText(value: string | undefined, field: "editedPlan" | "reason"): void;
+export declare function assertOutcomeText(value: string | undefined, field: "editedPlan" | "reason" | "feedback"): void;
 /**
  * The continuation prompt for a resumed run. The vendored harness only exposes
  * `prompt(text)` (it always appends a user message — there is no "continue from tool results" entry), so

package/dist/core/runner/decide-continuation.js

@@ -8,6 +8,7 @@ import { facetOf, isGateKind, isQuestionGate } from "../pause-registry.js";
 import { humanRefusalSentence, policyCannotAnswer, screenApproverAttribution } from "../tool-policy.js";
 import { mintGateOutcome } from "./gate-exit.js";
 import { delimitUntrusted, REVIEWER_NOTE_MAX_BODY } from "../untrusted-text.js";
+import { writtenFeedback } from "./approval-feedback.js";
 import { engineCardOf } from "../tool-roster.js";
 export function resumeDecisionWasNegative(resume) {
     const o = resume.outcome;
@@ -52,7 +53,8 @@ export function sameWinner(incoming, persisted) {
         incoming.decision === persisted.decision &&
         deepJsonEqual(incoming.updatedInput, persisted.updatedInput) &&
         deepJsonEqual(incoming.answer, persisted.answer) &&
-        (persisted.reason === undefined || incoming.reason === persisted.reason));
+        (persisted.reason === undefined || incoming.reason === persisted.reason) &&
+        (persisted.feedback === undefined || writtenFeedback(incoming.feedback) === writtenFeedback(persisted.feedback)));
 }
 export function pendingContentAskCallId(cp) {
     return cp.pendingAction.kind === "tool_approval" && engineCardOf(cp.pendingAction) === "question" ? cp.pendingAction.toolCallId : undefined;

package/dist/core/runner/gate-exit.d.ts

@@ -118,12 +118,16 @@ export declare function createSettlementLedger(call: {
  */
 export declare function cloneObserverInput(input: unknown): unknown;
 /**
- * The input a gate exit decided on, as the call's record keeps it ({@link ToolGateResult.finalInput}): a deep,
- * FROZEN copy — never the live object the tool receives (a tool or a later layer writing into its own arguments
- * must not rewrite what the gate decided), and never writable by a reader; the deny observer gets a writable
- * {@link cloneObserverInput} of it. A graph `structuredClone` refuses (functions, handles) is kept as a shallow
- * copy frozen at its own top level only — its members are the live arguments' own, and freezing those would
- * freeze the call's input under the tool.
+ * The input a gate exit decided on, as the call's record keeps it ({@link ToolGateResult.finalInput}): a PLAIN-DATA PROJECTION of
+ * it, deep and FROZEN — never the live input (a tool, a later layer or the caller writing into its own arguments cannot rewrite
+ * what the gate decided), and never writable by a reader; the deny observer gets a writable {@link cloneObserverInput} of it. Read
+ * by the engine's one receipt ({@link RECORD_RECEIPT}), so nothing of the caller's runs: every record and list copied off its own
+ * enumerable data members, and every member that is not data replaced by a marker naming what it was (`[not recorded: …]`) — a
+ * Map, a Date, a class instance, a function or a bigint by a marker, never by reference; a symbol-keyed member's marker joins its
+ * container's list of them (`[not recorded: symbol-keyed members]`, under a key no data member holds). On an ALLOW exit too: the
+ * record is the projection while the call runs with the value itself — the gate's own copy (`ownArgs`: records and lists, a getter
+ * already read into data) recorded as it is save a bigint, the member closing a cycle and containers past the bound, which are
+ * markers. A value the receipt refuses whole (a Proxy, a function, a Map in place of the arguments) is recorded as its marker.
  */
 export declare function frozenInputSnapshot(input: unknown): unknown;
 /** What one `classic.PreToolUse` screening came to: an answer the receipt took (`undefined` = no opinion), or the
@@ -211,9 +215,10 @@ export interface GatePass {
      *  behind the policy's answer could not land in between. Returns the gate result (a park's suspension or the
      *  exit's record). Writer: the dispatch (`runToolGate`, which wires `runGateLanes`). Reader: the fold's tail. */
     readonly afterFold: (pass: GatePass) => Promise<ToolGateResult>;
-    /** borrowed-mutable — the FINAL args, always the pass's own immutable value (`ownArgs`): the model's input as taken at
-     *  the entry, rewritten by the phase-1 hook, by the policy rewrite on the ask path and by the exits' rewrite fold.
-     *  Writers: the dispatch (phase 1), the lanes, the exits. */
+    /** borrowed-mutable — the FINAL args, the pass's own immutable value (`ownArgs`): the model's input as taken at the entry,
+     *  rewritten by the phase-1 hook, by the policy rewrite on the ask path and by the exits' rewrite fold — save on a refusal
+     *  of a value nothing took ({@link untakenValueExit}), where it holds that value as given and only the deny exit's receipt
+     *  reads it. Writers: the dispatch (phase 1), the lanes, the exits. */
     currentInput: unknown;
     /** borrowed-mutable — the adjudication request. Minted over the pass's args so the record is whole from
      *  the first station, and RE-MINTED by the adjudication station over the FINAL post-screen args (the
@@ -341,9 +346,24 @@ export declare function engineFailClosedExit(pass: GatePass, reason: string): Pr
 /** The refusal sentence for args the gate could not take into its own copy (`ownArgs` refused them), naming what. */
 export declare const unownedArgsMessage: (subject: string, reason: string) => string;
 /**
- * The model's args could not be taken into the pass's own copy (a function, a shared buffer, a typed array): nobody judged
- * them, so nothing may run them. The single deny exit (the observer fires), in the policy layer's word — the value is the
- * deployment's own (a host driving the gate; the runner's calls are always clonable).
+ * A value nothing took — the model's args the pass could not take into its own copy (`ownArgs`: a function, a shared buffer, a
+ * typed array; {@link unownedArgsMessage}), or a resolution's edit no approval can be bound to (`bindableArgsOf`) — is refused
+ * here, through the single deny exit (the observer fires): nobody judged it, so nothing may run it, and it is no args of the
+ * call, so no reading of the tool's runs over it. The refusal carries no judged bytes (no `updatedInput`): the pass holds the
+ * value as given, and the deny exit's one receipt records it (`finalInput`, its plain-data projection — one marker when the
+ * receipt refuses it whole: a Map, a Date, a class instance, a Proxy or a function in place of the arguments). In the refusing
+ * layer's word: the resolution's for an edit (the lanes mint its `presentation_failed` record), the policy layer's for the
+ * model's args ({@link unownedArgsExit}).
+ */
+export declare function untakenValueExit(pass: GatePass, untaken: {
+    readonly value: unknown;
+    readonly message: string;
+    readonly deniedBy: Extract<DeniedBy, "policy" | "ask_resolution">;
+}): Promise<ToolGateResult>;
+/**
+ * The model's args could not be taken into the pass's own copy (a function, a shared buffer, a typed array): the dispatch seeded
+ * the pass with them as given, and they leave through the exit for a value nothing took, in the policy layer's word — the value is
+ * the deployment's own (a host driving the gate; the runner's calls are always clonable).
  */
 export declare function unownedArgsExit(pass: GatePass, reason: string): Promise<ToolGateResult>;
 /** The hook's OWN deny in phase 1. A PreToolUse hook deny does NOT fire `permissionDenied`