@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -36,7 +36,7 @@ import type { AssertAllKeysHandled } from "../ask-origin.js";
 import { type ChildClampSource } from "../child-clamp-seats.js";
 import type { InheritedGate, Prepared, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 import { type BlockedRef } from "./synthetic-tools.js";
-import { RosterBuilder } from "../tool-roster.js";
+import { RosterBuilder, type RosterAxisTables } from "../tool-roster.js";
 import type { ParentSpecSeat } from "../parent-spec-seat.js";
 import { type RosterSpec } from "./caller-roster.js";
 export interface PrepareCapsAndWorkflowInput {
@@ -48,8 +48,7 @@ export interface PrepareCapsAndWorkflowInput {
     /** borrowed-readonly — the deployment seats, whole: `runtimeCapsResolver`, `compliancePostureResolver`, `onError`, `onNotice`,
      *  `autoMode`, `brain`, `models`, and the Workflow mount's dozen deps (`workflowScriptRunner`,
      *  `workflowGovernanceBaseline`, `workflowRunStore`, `workflowJournalStore`, `workflowScriptStore`,
-     *  `onWorkflowAgentSpawn`, `workflowCompletionNotifier`, `workflowLimits`, `agents`, `builtinAgents`, `onBackgroundChildEvent`).
-     *  The self-orchestration predicate takes the whole record. */
+     *  `onWorkflowAgentSpawn`, `workflowCompletionNotifier`, `workflowLimits`, `agents`, `builtinAgents`, `onBackgroundChildEvent`). The self-orchestration predicate takes the whole record. */
     deps: RunnerDeps;
     /** borrowed-readonly — the seat this run hands its children (`checkpointSeatOf`, minted once by the driver right after the
      *  config doors): the plan-pair face reads the store it names, the Workflow mount hands the seat itself to its children. */
@@ -58,6 +57,7 @@ export interface PrepareCapsAndWorkflowInput {
      *  `onTaskNotification`, `workflowDepth`, the capture-floor getter reads `memoryCaptureAncestors`, and the arming reads
      *  the chain's auto-mode face (`inheritedGate.autoModeFace`). */
     internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume" | "questionFaceStripped" | "inheritedGate"> | undefined;
+    /** borrowed-readonly — the tree's cross-boundary token (inherited or minted), which the Workflow mount hands to its children. */ crossBoundaryTree: import("../cross-boundary-taint.js").CrossBoundaryTreeToken;
     /** borrowed-readonly — the acquired session; the classifier leg rebuilds its transcript window from `buildContext`. */
     session: Pick<StoredSession, "buildContext">;
     /** borrowed-readonly — the acquired session id (operator-line context, the refusal codes' phase record). */
@@ -76,9 +76,10 @@ export interface PrepareCapsAndWorkflowInput {
     thinking: ThinkingLevel | undefined;
     /** borrowed-readonly — the frozen preflight; only `mcp` (the compliance veto's mcp_servers conflict check). */
     lockedPreflight: Pick<LockedPreflight, "mcp">;
-    /** borrowed-mutable — the effect collection (`Prepared.toolEffects`). Writer here: ONE set, `Workflow → write`, at its mount.
-     *  Every other writer is the safety scan (the seed) and the later mounts (see the roster table on `Prepared.tools`). */
+    /** borrowed-mutable — the effect collection (`Prepared.toolEffects`): the safety scan's caller entries, then the mounts' writes. */
     toolEffects: Prepared["toolEffects"];
+    /** borrowed-mutable — the scan's axis tables, so the builder moves an alias's axes with its member (a phase test may omit them). */
+    safetyAxes?: RosterAxisTables;
     /** borrowed-readonly — the frozen tool-face snapshot the Workflow mount forwards (exclude / defer / alwaysLoad / restoreGated). */
     toolFaceSnapshot: ToolFaceSnapshot;
     /** borrowed-readonly — the resolved prompt profile (the Workflow mount's parentPromptProfile). */

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -117,8 +117,8 @@ function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, askSeat, runClampSource, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, delegated, sideCallBookRef } = input;
-    const roster = new RosterBuilder(toolEffects);
+    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, safetyAxes, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, askSeat, runClampSource, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, delegated, sideCallBookRef } = input;
+    const roster = new RosterBuilder(toolEffects, safetyAxes);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
         roster.mount(mounted, { source: callerMountSource(mounted), mountedBy: "scenario" });
@@ -329,7 +329,7 @@ export async function prepareCapsAndWorkflow(input) {
             scope: taskScope,
             notifier: deps.workflowCompletionNotifier,
             originatingSessionId: sessionId,
-            rootSessionId: internals?.rootSessionId ?? sessionId, ...(internals?.placementRoot !== undefined ? { placementRoot: internals.placementRoot } : {}),
+            rootSessionId: internals?.rootSessionId ?? sessionId, ...(internals?.placementRoot !== undefined ? { placementRoot: internals.placementRoot } : {}), crossBoundaryTree: input.crossBoundaryTree,
             taskRegistry: defaultTaskRegistry,
             taskNotification: internals?.onTaskNotification,
             taskOwner: hostTaskId,

package/dist/core/runner/prepare-config-doors.d.ts

@@ -10,8 +10,7 @@
  * the safety scan after it run BEFORE prepareTask's first await (`sessions.acquire`), so a caller
  * has no microtask window in which to mutate `spec.tools`/the face arrays between the snapshots,
  * the doors and the scan. An `async` wrapper — even with a zero-await body — would hand the caller
- * exactly that window (the driver's `await` yields one microtask). Pinned by the
- * `prepare-task-phase-pins` microtask-latch tests.
+ * exactly that window (the driver's `await` yields one microtask). Pinned by the `prepare-task-phase-pins` microtask-latch tests.
  *
  * Throws pass through unchanged: every `config.*` / `resume_at.*` refusal here is a DELIBERATE
  * at-the-door rejection (a throw before acquisition needs no cleanup), and the
@@ -23,7 +22,9 @@ import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
 import type { Model } from "../../internal/llm.js";
 import type { ThinkingLevel } from "../../internal/harness.js";
 import { type MicroCompactMachine } from "../context-edit.js";
-import { type LockedPreflight } from "../locked-config.js";
+import { type CrossBoundaryPosture } from "../cross-boundary-taint.js";
+import { recordedModeSeed } from "../checkpoint-store.js";
+import { type ConfigDoorEntry, type LockedPreflight } from "../locked-config.js";
 import { type ResolvedRole } from "../roles.js";
 import { type ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import type { SessionStore } from "../session.js";
@@ -136,8 +137,7 @@ export interface PrepareConfigDoorsInput {
 export interface PrepareConfigDoorsResult {
     /** owned (by the caller, from here on) — the REBOUND spec: identical to the input object unless
      *  `spec.agents` was set, in which case it is a shallow copy whose `tools` is the
-     *  withAgents-rebuilt roster. Every later phase (the safety scan above all — T21) must read THIS,
-     *  never the original input. */
+     *  withAgents-rebuilt roster. Every later phase (the safety scan above all — T21) must read THIS, never the original input. */
     spec: RosterSpec;
     /** owned — the frozen task-start copies of the caller's tool-face control arrays; the driver compiles the leg's selector
      *  from them, and the selector (with the disclosure lists) is the ONLY thing later face reads consult. Frozen-immutable. */
@@ -146,7 +146,7 @@ export interface PrepareConfigDoorsResult {
     promptProfile: "simple" | "classic";
     /** owned — the host selector values (`TaskSpec.promptRole` / `TaskSpec.promptForm`, validated) the assembly selects on. */
     promptHost: ReturnType<typeof resolveHost>;
-    /** owned — the center binding (`TaskSpec.promptBinding`, validated) the center layer's scoped overlays select on. */
+    /** owned — the run's binding (`TaskSpec.promptBinding`, validated): the selector value every overlay's `when.binding` reads. */
     promptBinding: string | undefined;
     /** owned — the administrator lock snapshot; the rest of prepare reads guarded slots through it. */
     lockedPreflight: LockedPreflight;
@@ -155,17 +155,15 @@ export interface PrepareConfigDoorsResult {
     resolvedInteractionPosture: "interactive" | "headless" | undefined;
     /** owned, frozen — the run's approval seat ({@link resolveAskSeat}), the one read of the seats; later phases read only this. */
     askSeat: AskSeat;
-    /** owned — the validated/resolved microCompact knob ({@link resolveMicroCompactKnob}
-     *  for the door + placement reasoning). The per-run state builder consumes exactly these values —
-     *  the deps bag is never re-read after this door. */
+    /** owned — the validated/resolved microCompact knob ({@link resolveMicroCompactKnob} for the door + placement reasoning). The per-run
+     *  state builder consumes exactly these values — the deps bag is never re-read after this door. */
     microCompactKnob: {
         machine: MicroCompactMachine;
         clearOnRejection: boolean;
     };
     /** owned — the resolved role; its `systemPrompt` seat is still read at prompt-input time. */
     resolvedRole: ResolvedRole;
-    /** owned — the resolved main model (`resolvedRole.model`, re-exposed as the name every later
-     *  phase reads). */
+    /** owned — the resolved main model (`resolvedRole.model`, re-exposed as the name every later phase reads). */
     model: Model;
     /** owned — caller-explicit > role default > model default; undefined = off. */
     thinking: ThinkingLevel | undefined;
@@ -190,8 +188,7 @@ export interface PrepareConfigDoorsResult {
     /** owned — the NORMALIZED per-leg delegation-evidence standard: the deps seat read
      *  ONCE, in this synchronous pre-await stretch, screened, and absent folded to the "static-face"
      *  default. The delegation wrap consumes THIS value, never the live deps object — a deps seat
-     *  mutated (or getter-backed) after the door must not present an unscreened value to the mark
-     *  branch (the read-once posture). */
+     *  mutated (or getter-backed) after the door must not present an unscreened value to the mark branch (the read-once posture). */
     memoryDelegationEvidence: "static-face" | "attested-only";
     /** owned — the lowered skills-listing budget seats (`TaskSpec.skillListingBudgetFraction` /
      *  `skillListingMaxDescChars`): the renderer's two numbers, resolved once against the resolved main
@@ -212,9 +209,10 @@ export interface PrepareConfigDoorsResult {
     /** owned, out-param cell — created EMPTY here; the brain-call wiring later installs into
      *  `.current`. Returned so driver and harness share one cell identity. */
     brainCallGuardrailRef: BrainCallGuardrailRef;
-    /** owned — the resolved outer brain-call guardrail (task > deployment > default; undefined per
-     *  the resolver's off states). */
+    /** owned — the resolved outer brain-call guardrail (task > deployment > default; undefined per the resolver's off states). */
     brainCallGuardrailMs: number | undefined;
+    /** owned — the screened cross-boundary posture: the deps seat read ONCE, a bad value refused; absent stays `undefined` (undeclared is its own fact). */
+    crossBoundaryPosture: CrossBoundaryPosture | undefined;
 }
 /** The microCompact knob door (坏值响亮度默认律, the sibling knob doors' form:
  *  interactionPosture / toolModelGate / staleToolResultOffload). Placement is load-bearing:
@@ -230,4 +228,49 @@ export declare function resolveMicroCompactKnob(bag: RunnerDeps["microCompact"])
     machine: MicroCompactMachine;
     clearOnRejection: boolean;
 };
+/** The seat a checkpoint-store resolution is judged at: the store the task's own config names, else the deployment's. */
+export declare const checkpointStoreSeat: (spec: {
+    checkpointStore?: unknown;
+}) => "taskConfig" | "deps";
+/** The first door of a resume: its re-supplied config is a record. A `null`, a primitive or an array where the record is declared is refused by name
+ *  (`config.invalid_argument`), through the same channel as every door after it, before any of its members is read. */
+export declare function assertResumeConfigRecord(config: unknown): void;
+/** The spec the value doors read: a prepare's (its roster is faces) or a resume's re-supplied config (no objective, no session id). */
+type ValueDoorSpec = Omit<TaskSpec, "tools" | "objective" | "sessionId" | "userAttachments"> & Partial<Pick<TaskSpec, "objective" | "sessionId">>;
+type ConfigValueDoorsResult = Pick<PrepareConfigDoorsResult, "toolFaceLists" | "promptHost" | "promptBinding" | "lockedPreflight" | "microCompactKnob" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "usageWindows" | "brainCallGuardrailMs" | "crossBoundaryPosture"> & {
+    skillListingSeats: {
+        fraction: unknown;
+        maxDescChars: unknown;
+    };
+    skills: TaskSpec["skills"];
+};
+/**
+ * The phase's VALUE doors as ONE function with two callers — each judges a declared value against its own vocabulary, reading only the
+ * spec, the deployment's deps, the session store the Runner was constructed over and whether the leg resumes: {@link prepareConfigDoors}
+ * enters them as they stand, and a resume's screen before the claim (`refuseResumeDoors`) enters them through the resume's refusal
+ * channel, so a resume prepare would refuse here is refused before it consumes the row. `enter(seat, door)` names the input that carries
+ * each value; what a door resolves is returned. Every door is total over what a plain-JSON caller can hand it: a `null`, a primitive or an
+ * array where a record is declared is refused by its own code, never read through.
+ */
+export declare function configValueDoors(input: {
+    spec: ValueDoorSpec;
+    deps: RunnerDeps;
+    resumeLeg: boolean;
+    sessions: SessionStore;
+}, enter?: ConfigDoorEntry): ConfigValueDoorsResult;
+/**
+ * The doors a RESUMED leg's prepare refuses at, run as one screen BEFORE the claim — prepare's own functions, so a refusal carries
+ * the very sentence and code prepare throws: the mode doors (`refusePermissionModeDoors`), the output-style seat, the approval
+ * reach, the skills invoked by name (the part no roster changes), the attachments (a resume sends no new human message, so any
+ * entry is refused), the leg declarations of the tools it re-supplies (this phase's first door), this phase's value doors over the config, the deployment's deps and the session store the Runner holds
+ * ({@link configValueDoors}, the retention capability door included) and the mode words the row recorded (`recordedModeSeed`).
+ * It leaves by the resume's ONE refusal channel (`asResumeConfigRefusal`:
+ * `checkpoint.config_refused`, `detail.code` = prepare's code, `detail.field` = `"taskConfig"`, `"deps"` or `"inheritedGate"`)
+ * where prepare would end the leg `failed` after the claim — the row consumed on a store without `reopen`, replayed as a system
+ * retry on one with it, which a configuration fix cannot reach. Before the claim the row stays `pending` and byte-identical and the
+ * corrected resume redeems the same token. A throw that is none of prepare's codes leaves as it was thrown. Returns the config the
+ * leg is handed: the caller's, its MCP servers and A2A peers the frozen entries the lock layer judged (read once, dialed as judged).
+ */
+export declare function refuseResumeDoors<C extends ValueDoorSpec & Pick<TaskSpec, "userAttachments">>(config: C, recordedGate: Parameters<typeof recordedModeSeed>[0], deps: RunnerDeps, sessions: SessionStore): C;
 export declare function prepareConfigDoors(input: PrepareConfigDoorsInput): PrepareConfigDoorsResult;
+export {};

package/dist/core/runner/prepare-config-doors.js

@@ -2,24 +2,32 @@ import { resolveBrainCallGuardrailMs } from "../../brain/timeout.js";
 import { assertContainmentFaceValue } from "../../tools/fs/index.js";
 import { MICRO_COMPACT_MACHINES } from "../context-edit.js";
 import { assertAddOnlySeats } from "../child-clamp-seats.js";
+import { CROSS_BOUNDARY_POSTURES } from "../cross-boundary-taint.js";
 import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
-import { resolveCheckpointStore } from "../checkpoint-store.js";
+import { recordedModeSeed, resolveCheckpointStore } from "../checkpoint-store.js";
+import { asResumeConfigRefusal, refusePermissionModeDoors } from "../mode-policy.js";
+import { resolveOutputStyleFrame } from "../output-style.js";
+import { screenUserAttachments } from "../user-attachment.js";
+import { screenUserInvokedSkills } from "../skill-grant.js";
+import { readSkillsSeat } from "./skills-seat.js";
+import { screenHandsBandOptions } from "../hands-band-screen.js";
 import { assertAutoConsolidationWirable } from "./memory-consolidation-driver.js";
 import { isModelPriced, malformedPricingField, modelCostToPricing } from "../pricing.js";
-import { preflightLockedConfig } from "../locked-config.js";
+import { ENTER_AS_IS, preflightLockedConfig } from "../locked-config.js";
 import { assertRetentionCapability } from "../retention.js";
 import { resolveModel, resolveTaskModel, roleModelIfSet } from "../roles.js";
 import { resolveSkillListingBudget } from "../skill-listing-budget.js";
 import { describeRejectedValue } from "../tool-search-setting.js";
 import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from "../tool-model-gate.js";
 import { resolveUsageWindows } from "../usage-window-store.js";
-import { deriveAskEffective, resolveAskSeat, resolveQuestionSeam } from "../wiring-manifest.js";
+import { deriveAskEffective, resolveAskSeat, resolveQuestionSeam, screenApprovalReach } from "../wiring-manifest.js";
 import { resolveHost } from "../../prompt-assembly/select.js";
 import { resolvePromptBinding } from "../../prompt-assembly/overlay.js";
 import { assertPeerPresenceValue } from "../../agents/peer-directory.js";
 import { snapshotDefinitionLists } from "../../agents/tool-filter.js";
 import { TOTAL_TOKENS_REMINDER_MODES } from "./turn-attachments.js";
 import { rosterFaceOf } from "./caller-roster.js";
+import { assertToolBoundaryLegs } from "../tool-roster.js";
 import { refuseRenamedDelegationMounts } from "./sub-agent-deny-lists.js";
 const TASK_LIMIT_KEY_DICT = {
     maxTokens: true,
@@ -48,8 +56,8 @@ export function limitConfigError(code, message) {
 export function resolveTaskLimits(limits) {
     if (limits === undefined)
         return undefined;
-    if (typeof limits !== "object" || Array.isArray(limits)) {
-        throw limitConfigError("config.limit_invalid", `TaskSpec.limits must be an object (got ${Array.isArray(limits) ? "an array" : typeof limits})`);
+    if (typeof limits !== "object" || limits === null || Array.isArray(limits)) {
+        throw limitConfigError("config.limit_invalid", `TaskSpec.limits must be an object (got ${limits === null ? "null" : Array.isArray(limits) ? "an array" : typeof limits})`);
     }
     const raw = limits;
     const legal = TASK_LIMIT_KEYS;
@@ -66,13 +74,13 @@ export function resolveTaskLimits(limits) {
         if (value === undefined)
             continue;
         if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
-            throw limitConfigError("config.limit_invalid", `TaskSpec.limits.${key} must be a finite, non-negative number (got ${String(value)}) — an unevaluable ceiling is not a ceiling, and folding it to a default would run the task under a limit nobody chose.`);
+            throw limitConfigError("config.limit_invalid", `TaskSpec.limits.${key} must be a finite, non-negative number (got ${describeRejectedValue(value)}) — an unevaluable ceiling is not a ceiling, and folding it to a default would run the task under a limit nobody chose.`);
         }
     }
     const notice = raw.approachNotice;
     if (notice !== undefined && notice !== false) {
         if (typeof notice !== "object" || notice === null || Array.isArray(notice)) {
-            throw limitConfigError("config.limit_invalid", `TaskSpec.limits.approachNotice must be \`false\` or { at?: [first, second] } (got ${String(notice)})`);
+            throw limitConfigError("config.limit_invalid", `TaskSpec.limits.approachNotice must be \`false\` or { at?: [first, second] } (got ${describeRejectedValue(notice)})`);
         }
         const at = notice.at;
         if (at !== undefined) {
@@ -147,34 +155,51 @@ function resolveClearOnRejection(bag) {
     }
     return declared ?? true;
 }
-export function prepareConfigDoors(input) {
-    const { deps, sessions, resume, internals } = input;
-    let spec = input.spec;
-    assertNoRetiredRunnerDeps(deps);
-    assertPeerPresenceValue(spec.peerPresence);
-    assertRestoreGatedToolsValue(spec.restoreGatedTools);
-    const microCompactKnob = resolveMicroCompactKnob(deps.microCompact);
+function deploymentWord(raw, seat, words, absent, code, why) {
+    if (raw === undefined)
+        return absent;
+    const word = words.find((w) => w === raw);
+    if (word !== undefined)
+        return word;
+    const got = typeof raw === "string" ? JSON.stringify(raw.length > 64 ? `${raw.slice(0, 64)}…` : raw) : raw === null ? "null" : Array.isArray(raw) ? "an array" : typeof raw;
+    const spelled = words.map((w) => `"${w}"`);
+    throw limitConfigError(code, `RunnerDeps.${seat} must be ${spelled.slice(0, -1).join(", ")} or ${spelled.at(-1)} when present (got ${got}) — ${why}`);
+}
+export const checkpointStoreSeat = (spec) => (spec.checkpointStore !== undefined ? "taskConfig" : "deps");
+export function assertResumeConfigRecord(config) {
+    if (config === null || typeof config !== "object" || Array.isArray(config)) {
+        throw limitConfigError("config.invalid_argument", `the resume's taskConfig must be an object — the TaskSpec the run suspended with (got ${config === null ? "null" : Array.isArray(config) ? "an array" : typeof config})`);
+    }
+}
+export function configValueDoors(input, enter = ENTER_AS_IS) {
+    const { spec, deps, resumeLeg, sessions } = input;
+    enter("deps", () => assertNoRetiredRunnerDeps(deps));
+    enter("taskConfig", () => assertPeerPresenceValue(spec.peerPresence));
+    enter("taskConfig", () => assertRestoreGatedToolsValue(spec.restoreGatedTools));
+    const microCompactKnob = enter("deps", () => resolveMicroCompactKnob(deps.microCompact));
+    const toolFaceListRefusal = (message, reason) => {
+        const e = new Error(message);
+        e.code = "config.tool_face_control";
+        e.detail = { reason };
+        return e;
+    };
     const assertToolNameListValue = (value, seat) => {
         if (value === undefined)
             return;
         if (!Array.isArray(value)) {
-            const e = new Error(`TaskSpec.${seat} must be an array of tool names or absent (got ${value === null ? "null" : typeof value}) — a garbage list must refuse loudly, never be read as "no ${seat}".`);
-            e.code = "config.tool_face_control";
-            throw e;
+            throw toolFaceListRefusal(`TaskSpec.${seat} must be an array of tool names or absent (got ${value === null ? "null" : typeof value}) — a garbage list must refuse loudly, never be read as "no ${seat}".`, "not_a_list");
         }
         const entries = value;
         for (const entry of entries) {
             if (typeof entry !== "string") {
-                const e = new Error(`TaskSpec.${seat} entries must be strings (got ${entry === null ? "null" : typeof entry}).`);
-                e.code = "config.tool_face_control";
-                throw e;
+                throw toolFaceListRefusal(`TaskSpec.${seat} entries must be strings (got ${entry === null ? "null" : typeof entry}).`, "not_a_string");
             }
         }
     };
-    assertToolNameListValue(spec.allowTools, "allowTools");
-    assertToolNameListValue(spec.excludeTools, "excludeTools");
-    assertToolNameListValue(spec.deferTools, "deferTools");
-    assertToolNameListValue(spec.alwaysLoadTools, "alwaysLoadTools");
+    enter("taskConfig", () => assertToolNameListValue(spec.allowTools, "allowTools"));
+    enter("taskConfig", () => assertToolNameListValue(spec.excludeTools, "excludeTools"));
+    enter("taskConfig", () => assertToolNameListValue(spec.deferTools, "deferTools"));
+    enter("taskConfig", () => assertToolNameListValue(spec.alwaysLoadTools, "alwaysLoadTools"));
     const toolFaceLists = {
         allow: spec.allowTools ? Object.freeze([...spec.allowTools]) : undefined,
         exclude: spec.excludeTools ? Object.freeze([...spec.excludeTools]) : undefined,
@@ -186,116 +211,134 @@ export function prepareConfigDoors(input) {
                 ? Object.freeze([...spec.restoreGatedTools])
                 : undefined,
     };
-    const promptProfile = resolveModelPromptTraits({ id: "" }, spec, internals).promptProfile;
-    const promptHost = resolveHost(spec);
-    const promptBinding = resolvePromptBinding(spec);
-    if (spec.resumeAt !== undefined) {
-        if (resume) {
-            const e = new Error("resumeAt cannot be combined with a durable resume");
-            e.code = "resume_at.conflicts_resume";
+    const promptHost = enter("taskConfig", () => resolveHost(spec));
+    const promptBinding = enter("taskConfig", () => resolvePromptBinding(spec));
+    if (spec.resumeAt !== undefined)
+        enter("taskConfig", () => {
+            if (resumeLeg) {
+                const e = new Error("resumeAt cannot be combined with a durable resume");
+                e.code = "resume_at.conflicts_resume";
+                throw e;
+            }
+            if (!spec.sessionId) {
+                const e = new Error("resumeAt requires a sessionId (the session to branch)");
+                e.code = "resume_at.no_session";
+                throw e;
+            }
+        });
+    enter("taskConfig", () => assertContainmentFaceValue(spec.readFace, "read", "spec"));
+    enter("deps", () => assertContainmentFaceValue(deps.readFace, "read", "deps"));
+    enter("taskConfig", () => assertContainmentFaceValue(spec.writeFace, "write", "spec"));
+    enter("deps", () => assertContainmentFaceValue(deps.writeFace, "write", "deps"));
+    enter("taskConfig", () => assertAddOnlySeats(spec));
+    const memoryDelegationEvidence = enter("deps", () => deploymentWord(deps.memoryDelegationEvidence, "memoryDelegationEvidence", ["static-face", "attested-only"], "static-face", "config.memory_delegation_evidence", "an unevaluable evidence standard is refused loudly, never folded to either standard."));
+    const memoryProvenance = enter("deps", () => deploymentWord(deps.memoryProvenance, "memoryProvenance", ["off", "carry"], "carry", "config.memory_provenance", "an unevaluable provenance mode is refused loudly, never folded to either mode."));
+    const memoryCapturePolicy = enter("deps", () => deploymentWord(deps.memoryCapturePolicy, "memoryCapturePolicy", ["open", "governed", "capture-required"], "open", "config.memory_capture_policy", "an unevaluable capture posture is refused loudly, never folded to any posture (the fault arms differ per posture, so a guess would pick a polarity nobody configured)."));
+    const crossBoundaryPosture = enter("deps", () => deploymentWord(deps.crossBoundaryPosture, "crossBoundaryPosture", CROSS_BOUNDARY_POSTURES, undefined, "config.cross_boundary_posture", "an unevaluable posture is refused loudly, never folded to either word (an absent seat is undeclared, which is its own fact)."));
+    enter("deps", () => assertAutoConsolidationWirable(deps));
+    if (spec.resumeAtMode !== undefined)
+        enter("taskConfig", () => {
+            if (spec.resumeAt === undefined) {
+                const e = new Error(`resumeAtMode ${describeRejectedValue(spec.resumeAtMode)} requires resumeAt (there is no branch target to position against)`);
+                e.code = "resume_at.mode_without_target";
+                throw e;
+            }
+            if (spec.resumeAtMode !== "at" && spec.resumeAtMode !== "before") {
+                const e = new Error(`resumeAtMode ${describeRejectedValue(spec.resumeAtMode)} is invalid — expected "at" (inclusive branch, the default) or "before" (exclusive branch)`);
+                e.code = "resume_at.invalid_mode";
+                throw e;
+            }
+        });
+    if (spec.toolMaterializeStrategy !== undefined && spec.toolMaterializeStrategy !== "swap" && spec.toolMaterializeStrategy !== "static")
+        enter("taskConfig", () => {
+            const e = new Error(`toolMaterializeStrategy must be "swap" or "static" (got ${JSON.stringify(spec.toolMaterializeStrategy)}).`);
+            e.code = "config.tool_materialize_invalid";
             throw e;
-        }
-        if (!spec.sessionId) {
-            const e = new Error("resumeAt requires a sessionId (the session to branch)");
-            e.code = "resume_at.no_session";
+        });
+    if (spec.memoryPersistenceCapable !== undefined && typeof spec.memoryPersistenceCapable !== "boolean")
+        enter("taskConfig", () => {
+            const e = new Error(`memoryPersistenceCapable must be a boolean when present (got ${JSON.stringify(spec.memoryPersistenceCapable)}) — a non-boolean would silently read as capable.`);
+            e.code = "config.memory_persistence_invalid";
             throw e;
-        }
-    }
-    assertContainmentFaceValue(spec.readFace, "read", "spec");
-    assertContainmentFaceValue(deps.readFace, "read", "deps");
-    assertContainmentFaceValue(spec.writeFace, "write", "spec");
-    assertContainmentFaceValue(deps.writeFace, "write", "deps");
-    assertAddOnlySeats(spec);
-    const memoryDelegationEvidenceRaw = deps.memoryDelegationEvidence;
-    if (memoryDelegationEvidenceRaw !== undefined && memoryDelegationEvidenceRaw !== "static-face" && memoryDelegationEvidenceRaw !== "attested-only") {
-        const evidence = memoryDelegationEvidenceRaw;
-        const got = typeof evidence === "string"
-            ? JSON.stringify(evidence.length > 64 ? `${evidence.slice(0, 64)}…` : evidence)
-            : evidence === null
-                ? "null"
-                : Array.isArray(evidence)
-                    ? "an array"
-                    : typeof evidence;
-        const e = new Error(`RunnerDeps.memoryDelegationEvidence must be "static-face" or "attested-only" when present (got ${got}) — ` +
-            `an unevaluable evidence standard is refused loudly, never folded to either standard.`);
-        e.code = "config.memory_delegation_evidence";
-        throw e;
-    }
-    const memoryDelegationEvidence = memoryDelegationEvidenceRaw === "attested-only" ? "attested-only" : "static-face";
-    const memoryProvenanceRaw = deps.memoryProvenance;
-    if (memoryProvenanceRaw !== undefined && memoryProvenanceRaw !== "off" && memoryProvenanceRaw !== "carry") {
-        const got = typeof memoryProvenanceRaw === "string"
-            ? JSON.stringify(memoryProvenanceRaw.length > 64 ? `${memoryProvenanceRaw.slice(0, 64)}…` : memoryProvenanceRaw)
-            : memoryProvenanceRaw === null
-                ? "null"
-                : Array.isArray(memoryProvenanceRaw)
-                    ? "an array"
-                    : typeof memoryProvenanceRaw;
-        const e = new Error(`RunnerDeps.memoryProvenance must be "off" or "carry" when present (got ${got}) — ` + `an unevaluable provenance mode is refused loudly, never folded to either mode.`);
-        e.code = "config.memory_provenance";
-        throw e;
-    }
-    const memoryProvenance = memoryProvenanceRaw === "off" ? "off" : "carry";
-    const memoryCapturePolicyRaw = deps.memoryCapturePolicy;
-    if (memoryCapturePolicyRaw !== undefined && memoryCapturePolicyRaw !== "open" && memoryCapturePolicyRaw !== "governed" && memoryCapturePolicyRaw !== "capture-required") {
-        const got = typeof memoryCapturePolicyRaw === "string"
-            ? JSON.stringify(memoryCapturePolicyRaw.length > 64 ? `${memoryCapturePolicyRaw.slice(0, 64)}…` : memoryCapturePolicyRaw)
-            : memoryCapturePolicyRaw === null
-                ? "null"
-                : Array.isArray(memoryCapturePolicyRaw)
-                    ? "an array"
-                    : typeof memoryCapturePolicyRaw;
-        const e = new Error(`RunnerDeps.memoryCapturePolicy must be "open", "governed" or "capture-required" when present (got ${got}) — ` +
-            `an unevaluable capture posture is refused loudly, never folded to any posture (the fault arms differ per posture, so a guess would pick a polarity nobody configured).`);
-        e.code = "config.memory_capture_policy";
-        throw e;
-    }
-    const memoryCapturePolicy = memoryCapturePolicyRaw === "governed" ? "governed" : memoryCapturePolicyRaw === "capture-required" ? "capture-required" : "open";
-    assertAutoConsolidationWirable(deps);
-    if (spec.resumeAtMode !== undefined) {
-        if (spec.resumeAt === undefined) {
-            const e = new Error(`resumeAtMode "${spec.resumeAtMode}" requires resumeAt (there is no branch target to position against)`);
-            e.code = "resume_at.mode_without_target";
+        });
+    if (spec.toolMaterializeStrategy === "static" && spec.deferSelfResolve === false)
+        enter("taskConfig", () => {
+            const e = new Error(`toolMaterializeStrategy "static" cannot be combined with deferSelfResolve: false — with the direct-call ` +
+                `lane disabled a placeholder is never swapped and never self-resolves, so no deferred tool could ever be ` +
+                `called. Use "swap", or leave deferSelfResolve on.`);
+            e.code = "config.tool_materialize_unreachable";
             throw e;
-        }
-        if (spec.resumeAtMode !== "at" && spec.resumeAtMode !== "before") {
-            const e = new Error(`resumeAtMode "${String(spec.resumeAtMode)}" is invalid — expected "at" (inclusive branch, the default) or "before" (exclusive branch)`);
-            e.code = "resume_at.invalid_mode";
-            throw e;
-        }
-    }
-    if (spec.toolMaterializeStrategy !== undefined && spec.toolMaterializeStrategy !== "swap" && spec.toolMaterializeStrategy !== "static") {
-        const e = new Error(`toolMaterializeStrategy must be "swap" or "static" (got ${JSON.stringify(spec.toolMaterializeStrategy)}).`);
-        e.code = "config.tool_materialize_invalid";
-        throw e;
-    }
-    if (spec.memoryPersistenceCapable !== undefined && typeof spec.memoryPersistenceCapable !== "boolean") {
-        const e = new Error(`memoryPersistenceCapable must be a boolean when present (got ${JSON.stringify(spec.memoryPersistenceCapable)}) — a non-boolean would silently read as capable.`);
-        e.code = "config.memory_persistence_invalid";
-        throw e;
-    }
-    if (spec.toolMaterializeStrategy === "static" && spec.deferSelfResolve === false) {
-        const e = new Error(`toolMaterializeStrategy "static" cannot be combined with deferSelfResolve: false — with the direct-call ` +
-            `lane disabled a placeholder is never swapped and never self-resolves, so no deferred tool could ever be ` +
-            `called. Use "swap", or leave deferSelfResolve on.`);
-        e.code = "config.tool_materialize_unreachable";
-        throw e;
-    }
-    if (resume === undefined && spec.objective.trim().length === 0) {
+        });
+    if (!resumeLeg && (spec.objective ?? "").trim().length === 0) {
         const e = new Error("TaskSpec.objective is empty — a task needs an instruction (an empty user message is rejected by strict model endpoints and would fail every later request of the session).");
         e.code = "config.empty_objective";
         throw e;
     }
-    const lockedPreflight = preflightLockedConfig(spec, deps);
-    assertRetentionCapability({
-        policy: deps.retentionPolicy,
-        locked: lockedPreflight.lockedKeys.has("retentionPolicy"),
+    const lockedPreflight = preflightLockedConfig(spec, deps, enter);
+    const declaredSkills = spec.skills;
+    const skills = declaredSkills === undefined ? undefined : enter("taskConfig", () => readSkillsSeat(declaredSkills));
+    enter("deps", () => screenHandsBandOptions(deps.hands));
+    const skillListingSeats = { fraction: spec.skillListingBudgetFraction, maxDescChars: spec.skillListingMaxDescChars };
+    enter("taskConfig", () => resolveSkillListingBudget(skillListingSeats));
+    enter("taskConfig", () => resolveTaskLimits(spec.limits));
+    enter("taskConfig", () => resolveAttachmentsConfig(spec.attachments));
+    if (spec.resourceSuspend !== undefined)
+        enter("taskConfig", () => {
+            const declared = spec.resourceSuspend;
+            if (typeof declared !== "object" || declared === null || Array.isArray(declared)) {
+                throw limitConfigError("config.limit_invalid", `TaskSpec.resourceSuspend must be an object carrying a non-empty \`scope\` (got ${declared === null ? "null" : Array.isArray(declared) ? "an array" : typeof declared}) — it is the allocation every resource checkpoint is filed under.`);
+            }
+            const rsus = declared;
+            if (typeof rsus.scope !== "string" || rsus.scope === "") {
+                throw limitConfigError("config.limit_invalid", `TaskSpec.resourceSuspend.scope must be a non-empty string (got ${describeRejectedValue(rsus.scope)}) — it is the multi-tenant isolation key every resource checkpoint is filed under.`);
+            }
+            for (const key of ["totalBudgetUsd", "totalTokens", "maxSlices", "ttlMs"]) {
+                const value = rsus[key];
+                if (value === undefined)
+                    continue;
+                if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+                    throw limitConfigError("config.limit_invalid", `TaskSpec.resourceSuspend.${key} must be a finite, non-negative number (got ${describeRejectedValue(value)}) — an unevaluable allocation is not an allocation, and a NaN here blinds even the validated per-slice window.`);
+                }
+            }
+        });
+    const usageWindows = enter("deps", () => resolveUsageWindows(deps.usageWindows));
+    const taskGuardrail = spec.limits?.brainCallGuardrailMs;
+    const brainCallGuardrailMs = enter(taskGuardrail != null ? "taskConfig" : "deps", () => resolveBrainCallGuardrailMs(taskGuardrail ?? deps.brainCallGuardrailMs));
+    const checkpointStore = enter(checkpointStoreSeat(spec), () => resolveCheckpointStore(spec, deps));
+    const taskStore = checkpointStoreSeat(spec) === "taskConfig" ? checkpointStore : undefined;
+    const retention = { policy: deps.retentionPolicy, locked: lockedPreflight.lockedKeys.has("retentionPolicy") };
+    enter("deps", () => assertRetentionCapability({
+        ...retention,
         stores: [
             { name: "sessionStore", store: sessions },
-            { name: "checkpointStore", store: resolveCheckpointStore(spec, deps) },
+            { name: "checkpointStore", store: taskStore === undefined ? checkpointStore : undefined },
             { name: "toolResultStore", store: deps.toolResultStore },
         ],
+    }));
+    if (taskStore !== undefined)
+        enter("taskConfig", () => assertRetentionCapability({ ...retention, stores: [{ name: "checkpointStore", store: taskStore }] }));
+    return { toolFaceLists, promptHost, promptBinding, lockedPreflight, skillListingSeats, skills, microCompactKnob, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailMs, crossBoundaryPosture };
+}
+export function refuseResumeDoors(config, recordedGate, deps, sessions) {
+    asResumeConfigRefusal("taskConfig", () => {
+        refusePermissionModeDoors(config);
+        resolveOutputStyleFrame(config.outputStyle);
+        screenApprovalReach(config.approvalReach);
+        screenUserInvokedSkills(config);
+        screenUserAttachments(config.userAttachments, { resumeLeg: true });
+        assertToolBoundaryLegs(config.tools);
     });
+    const { lockedPreflight, skills } = configValueDoors({ spec: config, deps, resumeLeg: true, sessions }, asResumeConfigRefusal);
+    asResumeConfigRefusal("inheritedGate", () => void recordedModeSeed(recordedGate));
+    return { ...config, ...(config.mcp !== undefined ? { mcp: lockedPreflight.mcp ?? [] } : {}), ...(config.a2a !== undefined ? { a2a: lockedPreflight.a2a ?? [] } : {}), skills };
+}
+export function prepareConfigDoors(input) {
+    const { deps, sessions, resume, internals } = input;
+    assertToolBoundaryLegs(input.spec.tools);
+    let spec = input.spec;
+    const { toolFaceLists, promptHost, promptBinding, lockedPreflight, skillListingSeats, skills, microCompactKnob, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailMs, crossBoundaryPosture } = configValueDoors({ spec, deps, resumeLeg: resume !== undefined, sessions });
+    spec = Object.create(Object.getPrototypeOf(spec), { ...Object.getOwnPropertyDescriptors(spec), skills: { value: skills, enumerable: skills !== undefined, writable: false, configurable: false } });
+    const promptProfile = resolveModelPromptTraits({ id: "" }, spec, internals).promptProfile;
     const resolvedInteractionPosture = spec.interactionPosture ?? internals?.parentInteractionPosture ?? deps.interactionPosture;
     const askSeat = resolveAskSeat(spec, deps);
     {
@@ -344,25 +387,7 @@ export function prepareConfigDoors(input) {
             }
         }
     }
-    resolveTaskLimits(spec.limits);
-    resolveAttachmentsConfig(spec.attachments);
-    if (spec.resourceSuspend !== undefined) {
-        const rsus = spec.resourceSuspend;
-        if (typeof rsus.scope !== "string" || rsus.scope === "") {
-            throw limitConfigError("config.limit_invalid", `TaskSpec.resourceSuspend.scope must be a non-empty string (got ${String(rsus.scope)}) — it is the multi-tenant isolation key every resource checkpoint is filed under.`);
-        }
-        for (const key of ["totalBudgetUsd", "totalTokens", "maxSlices", "ttlMs"]) {
-            const value = rsus[key];
-            if (value === undefined)
-                continue;
-            if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
-                throw limitConfigError("config.limit_invalid", `TaskSpec.resourceSuspend.${key} must be a finite, non-negative number (got ${String(value)}) — an unevaluable allocation is not an allocation, and a NaN here blinds even the validated per-slice window.`);
-            }
-        }
-    }
-    const usageWindows = resolveUsageWindows(deps.usageWindows);
     const brainCallGuardrailRef = {};
-    const brainCallGuardrailMs = resolveBrainCallGuardrailMs(spec.limits?.brainCallGuardrailMs ?? deps.brainCallGuardrailMs);
     const mountedRoster = spec.tools;
     if (spec.agents !== undefined && spec.agents.length > 0) {
         const pool = spec.tools ?? [];
@@ -427,11 +452,7 @@ export function prepareConfigDoors(input) {
     if (gateDecision.survivors !== undefined) {
         spec = { ...spec, tools: gateDecision.survivors };
     }
-    const skillListingBudget = resolveSkillListingBudget({
-        fraction: spec.skillListingBudgetFraction,
-        maxDescChars: spec.skillListingMaxDescChars,
-        model,
-    });
+    const skillListingBudget = resolveSkillListingBudget({ ...skillListingSeats, model });
     const modelGate = Object.freeze({
         removedByClass: gateDecision.removedByClass,
         unknownClasses: gateDecision.unknownClasses,
@@ -460,7 +481,7 @@ export function prepareConfigDoors(input) {
         memoryDelegationEvidence,
         skillListingBudget,
         memoryProvenance,
-        memoryCapturePolicy,
+        memoryCapturePolicy, crossBoundaryPosture,
         usageWindows,
         brainCallGuardrailRef,
         brainCallGuardrailMs,