@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/tool-face-reader.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The READER of an MCP server's `toolFaces` declaration ({@link McpServerSpec.toolFaces}, the per-tool FACE overlay): `readToolFaces(declared)`,
+ * the face-side sibling of `readToolAxes` (`mcp-server-spec.ts`). The engine's preparation door and its MCP materialization entrance ask it
+ * (`locked-config.ts`), and a host that assembles the field from JSON (a console's write door, a deployment intake) asks it at its own door:
+ * one reading of the declaration, whoever asks and whenever. The mount ({@link applyMcpToolFaces}) then consumes the reader's copy and never
+ * the raw object, and judges each face against the materialized schema with the very judge this reader ends in.
+ *
+ * It sits beside `mcp-server-spec.ts` rather than in the runner directory the mount lives in: it is the declaration's door, not a station of
+ * the prepare path, and the public surface is tiered by where a symbol is declared (`readToolAxes` is `advanced` for the same reason).
+ */
+import { type McpServerSpec } from "./mcp-server-spec.js";
+/**
+ * {@link readToolFaces}'s answer. `ok: true` hands back a copy of the faces that the reader itself built, plain data and none of the caller's own
+ * objects; `faces` is absent when nothing is declared (no key at all, or an empty record). `ok: false` carries one sentence (its detail cut at
+ * 240 characters) naming the tool and the member that did not fit. What it may quote of the declaration is its structure and nothing of its content:
+ * a tool or member name (quoted, a tool name cut at 80 characters), the word a closed table refuses, a key or a list entry over its bound (its
+ * first 40 characters), a key a pattern parameter names, a count and its bound. It never quotes display text (`userFacingName`, `activity`) or
+ * the entries of a list that fits. These are the mount's judge's own sentences, the ones it announces at the listing, so the reader and the mount
+ * tell one operator one thing; `readToolAxes` refuses in the same sentence shape and names no word because an axis word is never a name the
+ * operator needs echoed to find the fault.
+ */
+export type ToolFacesRead = {
+    ok: true;
+    faces?: NonNullable<McpServerSpec["toolFaces"]>;
+} | {
+    ok: false;
+    problem: string;
+};
+/**
+ * The one reader of a raw `toolFaces` declaration — {@link McpServerSpec.toolFaces}, the per-tool FACE overlay — and the face-side sibling of
+ * `readToolAxes` (the safety axes `effect` / `egress` / `irreversibility` are that declaration's, read once, there). The preparation door asks it
+ * for every MCP server of a task (`config.tool_face_invalid` refuses the whole prepare — the code a caller tool's bad face has at the caller door;
+ * a declaration the entry's own plain-data receipt refuses first keeps `config.invalid_argument`), `materializeMcpTools` asks it per server (that
+ * server's dial fails, the same code), and a host that assembles the field from JSON asks it at its own door and hands the engine what it answered.
+ *
+ * It judges the declaration alone, which is everything the declaration can say without the tool's schema: the receipt of a plain-data
+ * declaration (`receiveDeclaration`: a Proxy, a map, a class instance, a getter that throws, a cycle, a nesting past the engine's one
+ * depth, a tool named `__proto__` are refusals that say where they sit), the shape of each face (the members the types have, each of its
+ * kind), then the very judge the mount runs (`toolFaceProblem`) minus the checks that need the schema — the five closed words
+ * (`family`, `pathTarget.access` / `base` / `absent`, `renderHints.approvalCard`), the bounds, and the cross-member rules (a write path
+ * target's `base: "root"` / `absent: "base"`, an inert `patternParam`). The checks that read the schema (a `param` that is a top-level
+ * property, the keys an approval card needs, the names a summary or a rule face lists) and the one that reads the minted tool (a result card
+ * lives under the tool's own namespace) stay with the listing, where the schema and the tool are known.
+ *
+ * Any one face that does not fit refuses the WHOLE declaration (`ok: false`): a face is an overlay applied whole or not at all, and a
+ * dropped face is a tool mounted without the protection its operator declared. Absent ⇒ `{ ok: true }`. An empty record is no declaration
+ * either; an empty face `{}` under a tool name is kept as written. An empty tool name is refused (no tool answers to it).
+ */
+export declare function readToolFaces(declared: unknown): ToolFacesRead;

package/dist/core/tool-face-reader.js

@@ -0,0 +1,94 @@
+import { dataKind, perToolEmptyName, perToolEntryRefusal, quotedName, receivePerToolDeclaration } from "./mcp-server-spec.js";
+import { isPlainRecord } from "./mods/kernel/receive.js";
+import { faceProblem } from "./runner/tool-face-overlay.js";
+import { inlineUntrusted } from "./untrusted-text.js";
+const TOOL_FACE_MEMBERS = { family: true, pathTarget: true, renderHints: true, ruleFace: true };
+const PATH_TARGET_KINDS = { param: "string", aliases: "list", access: "string", skillScopeEligible: "boolean", base: "string", absent: "string", patternParam: "string" };
+const PATH_TARGET_REQUIRED = ["param", "access"];
+const RENDER_HINT_KINDS = { userFacingName: "string", activity: "string", summaryParams: "list", resultCards: "list", approvalCard: "string" };
+const RULE_FACE_KINDS = { primaryParams: "list", params: "list" };
+function kindProblem(label, value, kind) {
+    if (value === undefined)
+        return undefined;
+    if (kind === "list")
+        return Array.isArray(value) && value.every((name) => typeof name === "string") ? undefined : `${label} is ${dataKind(value)}, not a list of strings`;
+    return typeof value === kind ? undefined : `${label} is ${dataKind(value)}, not a ${kind}`;
+}
+function membersOf(raw, label, names) {
+    if (!isPlainRecord(raw))
+        return `${label} is ${dataKind(raw)}, not an object`;
+    const unknown = Object.keys(raw).find((member) => !names.includes(member));
+    return unknown === undefined ? raw : `${label} has the unknown member ${quotedName(unknown)} (the members are ${names.join(", ")})`;
+}
+function ownMember(record, name) {
+    return Object.hasOwn(record, name) ? record[name] : undefined;
+}
+function readMembers(raw, label, kinds, required = []) {
+    const record = membersOf(raw, label, Object.keys(kinds));
+    if (typeof record === "string")
+        return record;
+    for (const member of required)
+        if (ownMember(record, member) === undefined)
+            return `${label}.${member} is missing`;
+    const entries = [];
+    for (const member of Object.keys(record)) {
+        const kind = kinds[member];
+        const value = record[member];
+        const problem = kindProblem(`${label}.${member}`, value, kind);
+        if (problem !== undefined)
+            return problem;
+        if (value === undefined || (kind === "boolean" && value === false))
+            continue;
+        entries.push([member, kind === "list" ? [...value] : value]);
+    }
+    return Object.fromEntries(entries);
+}
+function readOneToolFace(raw) {
+    const face = membersOf(raw, "the face", Object.keys(TOOL_FACE_MEMBERS));
+    if (typeof face === "string")
+        return face;
+    const records = { pathTarget: [PATH_TARGET_KINDS, PATH_TARGET_REQUIRED], renderHints: [RENDER_HINT_KINDS, []], ruleFace: [RULE_FACE_KINDS, []] };
+    const entries = [];
+    for (const member of Object.keys(face)) {
+        const value = face[member];
+        if (value === undefined)
+            continue;
+        if (member === "family") {
+            const problem = kindProblem("family", value, "string");
+            if (problem !== undefined)
+                return problem;
+            entries.push([member, value]);
+            continue;
+        }
+        const [kinds, required] = records[member];
+        const record = readMembers(value, member, kinds, required);
+        if (typeof record === "string")
+            return record;
+        entries.push([member, record]);
+    }
+    const typed = Object.fromEntries(entries);
+    return faceProblem(typed, undefined) ?? typed;
+}
+export function readToolFaces(declared) {
+    if (declared === undefined)
+        return { ok: true };
+    const received = receivePerToolDeclaration(declared, "toolFaces", "tool");
+    if (!received.ok)
+        return { ok: false, problem: received.problem };
+    const entries = [];
+    for (const [tool, raw] of Object.entries(received.perTool)) {
+        if (tool.length === 0)
+            return { ok: false, problem: perToolEmptyName("toolFaces", "tool") };
+        let face;
+        try {
+            face = readOneToolFace(raw);
+        }
+        catch {
+            face = "a member threw while it was read";
+        }
+        if (typeof face === "string")
+            return { ok: false, problem: perToolEntryRefusal("toolFaces", "tool", tool, inlineUntrusted(face, 240)) };
+        entries.push([tool, face]);
+    }
+    return entries.length > 0 ? { ok: true, faces: Object.fromEntries(entries) } : { ok: true };
+}

package/dist/core/tool-face.d.ts

@@ -198,6 +198,9 @@ export interface ToolRenderHints {
  */
 export interface ToolFaceDeclaration {
     family: ToolFamily;
+    /** The legs every call of the definition travels, or `"per_call"` when the code that dispatches it gives them per call. REQUIRED:
+     *  a definition that states none does not compile — no default, and no fail-closed reading as outside. */
+    boundaryLegs: import("./cross-boundary-taint.js").BoundaryLegsDeclaration;
     effect?: import("./tool-spec.js").ToolEffect;
     egress?: true;
     irreversibility?: "never" | "maybe" | "always";
@@ -232,6 +235,12 @@ export interface ToolFaceDeclaration {
  */
 export declare const TOOL_LEG_KINDS: readonly ["delegated", "teammate", "goal", "observer", "structured"];
 export type ToolLegKind = (typeof TOOL_LEG_KINDS)[number];
+/**
+ * The leg kinds that share their spawner's tool surface: a teammate is handed tools its spawner holds in its own right (the team's mailbox,
+ * scheduler and task list), so the layers above the leg decide its protocol rows and the leg's own lists do not. A protocol row that no kind
+ * of this table names is the leg's own channel — a finishing or hand-back tool its spawner never held — and no layer decides it.
+ */
+export declare const SPAWNER_SURFACE_LEG_KINDS: readonly ToolLegKind[];
 /**
  * One layer of a tool selector, as data: an allowed-tools list (absent = no allowlist on this layer) and a denied-tools list,
  * each a frozen copy of the entries a list was written with. A run's own layer is its `allowTools` and `excludeTools`; the
@@ -244,8 +253,9 @@ export interface ToolSelectorLayer {
 /**
  * The compiled tool selector of one run — the one answer to "is this tool available on this run", read at the roster valve
  * and on every later roster change (an MCP refresh or re-dial, the deferred-search lane), and handed down as the ceiling of
- * every run this one spawns (`layers`). A tool is admitted when it is a protocol tool of this run's leg kind, or when every
- * layer admits it: the layer's allowlist (if any) reaches it and its denylist does not.
+ * every run this one spawns (`layers`). A tool is admitted when it is the leg's own protocol channel, or when every layer
+ * admits it — the layer's allowlist (if any) reaches it and its denylist does not — or, for a protocol tool of a leg that shares
+ * its spawner's tool surface ({@link SPAWNER_SURFACE_LEG_KINDS}), when every layer ABOVE the leg's own admits it.
  */
 export interface ToolSelector {
     readonly layers: readonly ToolSelectorLayer[];
@@ -280,13 +290,12 @@ export interface ToolCatalogEntry {
     face: ToolFaceDeclaration;
     /** A `modelGate` class the default-bundle assembler stamps on this definition's default arm. */
     modelGate?: string;
-    /** The leg kinds whose legs rely on this tool as part of their protocol: on such a leg the tool's availability is not a
-     *  selector's to decide (an allowlist need not name it), and a denylist that reaches it there is a contradiction the run
-     *  refuses at prepare. */
+    /** The leg kinds whose legs rely on this tool as part of their protocol: the leg's OWN lists do not decide it (an allowlist need not
+     *  name it), and a denylist of the leg's own that reaches it is a contradiction the run refuses at prepare. Whether the layers ABOVE
+     *  the leg decide it follows the row's kinds ({@link SPAWNER_SURFACE_LEG_KINDS}): a row some kind of which shares its spawner's tool
+     *  surface is held exactly when the spawner may hold it; any other row is the leg's own channel, which no layer decides — an inherited
+     *  deny that reaches it is the same contradiction. */
     protocol?: readonly ToolLegKind[];
-    /** A protocol row the leg shares with the run that spawned it (the team task-list family a teammate shares with its leader): on its
-     *  leg the leg's OWN lists do not decide it, but the ceiling still does — the leg holds it exactly when its spawner may. */
-    protocolUnderCeiling?: true;
 }
 /**
  * The band-membership table over the mount tags: a host derives its hand band as the definitions listed under a

package/dist/core/tool-face.js

@@ -25,6 +25,7 @@ export const RENDER_HINT_MAX_CHARS = 64;
 export const RENDER_HINT_ACTIVITY_MAX_CHARS = 32;
 export const RENDER_HINT_MAX_LIST = 16;
 export const TOOL_LEG_KINDS = Object.freeze(["delegated", "teammate", "goal", "observer", "structured"]);
+export const SPAWNER_SURFACE_LEG_KINDS = Object.freeze(["teammate"]);
 export const MOUNT_TAG_IN_HANDS_BAND = {
     hands: true,
     backgroundTasks: true,

package/dist/core/tool-policy.d.ts

@@ -2,6 +2,7 @@ import { type AskOrigin, type AssertAllKeysHandled } from "./ask-origin.js";
 import { type ReadRootGrantScreen } from "./read-root-grant-screen.js";
 import { type Settlement } from "./gate-outcome.js";
 export { policyCannotAnswer, rowDemandsAPerson } from "./real-approval.js";
+import { type BindingFault } from "./canonical-json.js";
 import { type DecisionReason } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
 import { type RemovalGuardSeat } from "../tools/fs/removal-targets.js";
@@ -236,7 +237,8 @@ export interface EngineAttestation {
     readonly origin?: AskOrigin;
     /** The settled ask's class set (`ASK_CLASSES` order), when the minting station held one. */
     readonly classes?: readonly import("./ask-origin.js").AskClass[];
-    /** `boundInputHashOf` of the arguments the settlement licenses: an approver's edit, the snapshot shown, or the asked args. */
+    /** `exactBoundInputHashOf` of the arguments the settlement licenses (an approver's edit, the snapshot shown, or the asked
+     *  args); absent when they have none (outside the bindable domain) — such a record licenses no bytes. */
     readonly inputDigest?: string;
     /** The FORM of a classifier round that did not rule (a classifier deny's cause). */
     readonly classifierCause?: import("./gate-outcome.js").ClassifierDenyCause;
@@ -249,6 +251,9 @@ export interface EngineAttestation {
     /** Where a path deny row refused the call — the row, the view of the target it met, the face the call is on. The gate's
      *  exit mints the refusal's card from it; the judge that found the row is its only writer. */
     readonly pathDenial?: import("../tools/fs/safety.js").PathDenialEvidence;
+    /** A seat refused the call's arguments because no approval can be bound to them ({@link bindableArgsOf}): the refusal's
+     *  sentence, carried by the refusal itself — the gate's deny exit reads it (the remedy it gives) instead of judging again. */
+    readonly bindingRefusal?: string;
 }
 /** The members a station attests — everything but the call binding. */
 export type AttestationMembers = Omit<EngineAttestation, "toolCallId" | "toolName">;
@@ -422,6 +427,11 @@ export type PermissionResult = {
      *  in the one direction the stamp cannot reach (a caller composing its own ask) the claim is
      *  tightening-only: it can make an ask outlive a rule, never turn one into an allow. */
     probeMandated?: true;
+    /** This ask stands on the call's CROSS-BOUNDARY obligation — a person's confirmation
+     *  ({@link import("./cross-boundary-taint.js").crossBoundaryObligation}); the station mints it beside `requiresRealApproval`, the
+     *  decision receipt adds that bit to a policy's or hook's own. Its one carrier: the class (`cross_boundary`), the rule-silence word (`cross_boundary_taint`) and the
+     *  real-approval bit are all read off this member. Tightening-only: a policy self-declaring it opts its own ask out of automatic answering. */
+    crossBoundaryMandated?: true;
     /** This ask is MANDATED — no persisted allow rule and no STANDING ANSWER (a release remembered from an
      *  earlier call, at any scope, a session included) may retire it; only an answer produced for THIS call
      *  clears it — a person, a hook, a deployment's blanket `onAsk: "allow"` seat, or the live deciders the
@@ -592,6 +602,37 @@ export interface AskRuleEvidence {
 }
 /** The human/model-readable text of a decision. */
 export declare function decisionText(d: PermissionResult): string | undefined;
+/** Does a license (a record's `inputDigest`) cover the bytes that `runs`? The ONE judge — the gate's ledger keeps a settlement for
+ *  the bytes it licensed by it, and the unstated question asks whether an answer was given for these bytes by it. A license for
+ *  bytes covers what the tool reads them as ({@link argsReadFrom}: the one recorded step a reading took to `runs`). Compared by
+ *  the EXACT digest only: bytes outside the bindable domain have none and are covered by no license. */
+export declare function licenseCovers(licensed: string | undefined, runs: unknown): boolean;
+/**
+ * THE judge of whether an approval can be bound to arguments, and the arguments it binds — asked wherever an approval is about to
+ * be asked or adopted, and nowhere else: the ask resolver (its no-approver arm too) and the approval policy before anyone is asked,
+ * the resolver where it adopts a person's edit, the gate's approved-edit loop (an edit any resolver hands back), and — through the
+ * same judge and sentence — the durable decide's capture of one before the claim ({@link capturedJsonOf}). Bindable = a record of
+ * plain JSON data nested at most 256 levels deep ({@link bindableValueOf}, exactly the values with an exact digest — the SAME reading every
+ * license and mint takes), judged on the value as given with nothing of the caller's run (a getter is never called: a value read
+ * through one has no fixed bytes). Ok ⇒ the judge's frozen copy, engine-owned (`args` itself when owned already); else the ONE
+ * sentence ({@link bindingRefusalOf}).
+ */
+export declare function bindableArgsOf<T>(toolName: string, args: T): {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    refusal: string;
+};
+/** THE sentence refusing arguments no approval can be bound to, naming what the judge met and where (`args` is what it was given). */
+export declare function bindingRefusalOf(toolName: string, args: unknown, fault: BindingFault): string;
+/** Was the call ANSWERED for the bytes that run — does `d` carry an engine record ({@link attestationOf}) of a settled wait
+ *  whose license covers `runs`? A person's or the deployment approver's yes over these arguments is; a layer's allow is not,
+ *  whatever it says about itself, and neither is a yes given for other bytes (a later layer that rewrote them voids it here). */
+export declare function answeredFor(d: PermissionResult, call: {
+    toolCallId: string;
+    toolName: string;
+}, runs: unknown): boolean;
 /**
  * Gates tool calls before they execute (the production safety layer for "processing/changing data").
  *
@@ -878,9 +919,10 @@ export declare function constraintChainEntryOfSuppliedLayer(layer: ConstraintCha
  * different frozen deny data now digest differently.
  */
 export declare function constraintChainDigest(chain: readonly ConstraintChainEntry[]): string;
-/** Every member of the decision union — a member the union gains and this list lacks is a type error at `satisfies`.
- *  The receipt walks it: a contract member not held as an own enumerable data property is refused if a descriptor on the
- *  prototype chain holds one (an `undefined` data value spells absence). Not re-exported from `src/index.ts`. */
+/** Every member of the decision union, read off the member × arm table ({@link DECISION_MEMBER_ARMS}: a member the union gains
+ *  and the table lacks is a type error there). The receipt walks it: a contract member not held as an own enumerable data
+ *  property is refused if a descriptor on the prototype chain holds one (an `undefined` data value spells absence), and a
+ *  present one must sit on an arm its row holds. Not re-exported from `src/index.ts`. */
 export type DecisionMember = PermissionResult extends infer U ? (U extends unknown ? keyof U : never) : never;
 export declare const DECISION_MEMBERS: readonly DecisionMember[];
 /**
@@ -949,8 +991,10 @@ export type NamedToolPolicy = ToolPolicy & {
  *  which simply opts out of the audit). */
 export declare function toolPolicyNameSets(p: ToolPolicy | undefined): readonly ToolPolicyNameSets[];
 /**
- * Name-based allow/deny. `deny` always wins. If `allow` is provided, only those tools are permitted
- * (everything else denied). Without `allow`, everything not in `deny` is permitted. Each entry is read by the rule
+ * Name-based allow/deny. `deny` always wins. If `allow` is provided, only those tools may run (everything else denied) — a
+ * NARROWING: a tool the list names gets no objection, never consent, so a `passthrough`-seat tool it names still meets the
+ * mode's unstated question; consent is an allow entry (`RunnerDeps.allowedTools` / `TaskSpec.allowedTools`). Without
+ * `allow`, everything not in `deny` gets no objection. Each entry is read by the rule
  * syntax (`ruleSpellingOf`): a name, or `Tool()` / `Tool(*)` — the bare `Tool`, as every list reader reads them, once however
  * many spellings write it; any other spelling is not a tool name (`onInvalidName`), and neither is the wildcard `*` (`*`,
  * `*()`, `*(*)`) in `deny`: it names no tool, and the entry would be kept and never match. In `allow` it is one entry no tool
@@ -975,13 +1019,6 @@ export declare function createAllowDenyPolicy(opts: {
         list: "allow" | "deny";
         message: string;
     }) => void;
-    /**
-     * What an `allow` list HIT means. `"grant"` (default): the deployment named this tool as permitted — a statement
-     * (`decisionReason: "rule"`) that satisfies the fold's unstated rule for a passthrough-seat tool. `"narrowing"`: the
-     * list only bounds WHICH tools a lane may see (an agent definition's `allowTools`); a hit is scope, not consent, and
-     * answers a bare allow — the mode's unstated question still goes to a person. The deny list is unaffected.
-     */
-    scope?: "grant" | "narrowing";
 }): NamedToolPolicy;
 /**
  * What `createApprovalPolicy`'s `approve` may resolve to: a boolean, or the `AskOutcome` OBJECT minus the
@@ -1030,7 +1067,8 @@ export declare function createApprovalPolicy(opts: {
     approve: (req: ToolCallRequest, signal?: AbortSignal) => ApprovalSeatOutcome | Promise<ApprovalSeatOutcome>;
     /** Always-denied tools. */
     deny?: string[];
-    /** Always-allowed tools (only meaningful with `denyByDefault`). */
+    /** The exceptions to `denyByDefault` (only meaningful with it): tools that get no objection without an approval. A narrowing,
+     *  not consent — a `passthrough`-seat tool named here still meets the mode's unstated question; consent is an allow entry. */
     autoAllow?: string[];
     /** When true, deny anything not in `requireApproval` or `autoAllow`. Default false. */
     denyByDefault?: boolean;
@@ -1050,12 +1088,11 @@ export declare function createApprovalPolicy(opts: {
  * short-circuit — scanning continues, because a later policy may still `deny` (which outranks ask).
  * With no deny, the first `ask` wins; with neither, `allow`.
  *
- * **An allow is STATED or not.** A layer that names the call (an allow rule, a list entry, an approver's yes, a mode's
- * release) says WHY on its allow (`decisionReason`); a bare allow is "no objection" — an empty table, a list the call is
- * not on, a layer that does not know the tool. The combined allow carries the FIRST stated reason in layer order, and a
- * statement binds the arguments its layer judged: a layer that rewrites the arguments voids every statement before it (its
- * own allow, if it states one, speaks for the new arguments). For a tool whose permission seat is `passthrough` an
- * unstated allow is not a permission — the gate puts the mode's question to it; for every other tool the two forms run alike.
+ * **A layer's allow is no objection, never consent.** What a combined allow carries beyond that is the engine RECORDS its
+ * layers' stations minted (an approver's yes inside a layer, an ancestor classifier's attribution), accumulated per member
+ * group; a yes binds the bytes it was given (its license), so a layer that rewrites the arguments afterwards leaves a yes that
+ * no longer covers what runs. For a tool whose permission seat is `passthrough` the gate puts the mode's question to a
+ * combined allow unless an answer covers the bytes that run ({@link answeredFor}) — the allow layer answers it there.
  *
  * **Idempotency requirement:** because the fold continues past an `ask` to look for a later `deny`, a
  * policy's `check()` can be invoked even after an earlier policy returned `ask`. `check()` MUST be
@@ -1847,8 +1884,8 @@ export declare function refusalOf<D extends PermissionResult>(deny: D, judged: u
 /**
  * A PreToolUse hook's `ask` folded over a verdict by `deny > ask > allow` — the ONE law for the gate's first screening and for
  * an approved edit's re-screen. A deny stands. Over an allow, the hook's own ask, RECONSTRUCTED rather than spread (its message,
- * its real-approval demand, its rewrite) under the hook provenance the engine stamps. Over an ask, that ask keeps every member,
- * takes the hook provenance and the hook's real-approval demand, and its message carries the hook's beside its own — a person
+ * its real-approval demand and cross-boundary member, its rewrite) under the hook provenance the engine stamps. Over an ask, that ask keeps every member,
+ * takes the hook provenance and the hook's real-approval demand and cross-boundary member, and its message carries the hook's beside its own — a person
  * clearing one ask that stands for two gates sees both reasons.
  */
 export declare function foldHookAsk(verdict: Exclude<PermissionResult, {
@@ -1879,6 +1916,9 @@ export declare function ownArgs<T>(v: T, root?: string): {
     reason: string;
     cause?: unknown;
 };
+/** A call's argument reading (the loop's: the tool's preparation, the schema's coercions) whose every value is engine-owned
+ *  like a pass's args ({@link ownArgs}) — the gate's face seat and the resumed call's belt seat read through this one. */
+export declare function ownedReading(read: (args: unknown) => unknown): (args: unknown) => unknown;
 /**
  * A label for a value that was THROWN at us, safe to put in a fail-closed refusal. Never coerces: `String(x)`
  * throws on a null-prototype object or a untrusted `toString`/`Symbol.toPrimitive`, and the thrower here is
@@ -1983,10 +2023,14 @@ export type ResolverArmResult = (Extract<ResolvedAsk, {
     action: "allow";
 }> & {
     settlement?: Settlement;
-}) | (Extract<ResolvedAsk, {
+    bindingRefusal?: undefined;
+})
+/** `bindingRefusal`: the arm refused arguments no approval can be bound to — the record carries the sentence. */
+ | (Extract<ResolvedAsk, {
     action: "deny";
 }> & {
     settlement: Settlement;
+    bindingRefusal?: string;
 });
 /**
  * The DIRECTIONAL format controls, as a closed set (see {@link AskRequest.hasBidiControls}):