@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/tool-policy.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
-import { withArgsReading } from "./effective-path-target.js";
+import { argsReadFrom, carryArgsReadFrom, withArgsReading } from "./effective-path-target.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { decisionAskClassesOf, headlessDenialMessage } from "./ask-origin.js";
 import { ownReadRootCandidate, readRootGrantSeat } from "./read-root-grant-screen.js";
@@ -12,12 +12,12 @@ import { join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { protectivePathTargetOf, shellFaceToolNames } from "./tool-registry.js";
 import { heldBy } from "./tool-name-readings.js";
-import { boundInputHashOf } from "./canonical-json.js";
+import { bindableValueOf, boundInputHashOf, describeBindingFault, exactBoundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
 import { describeRejectedValue } from "./tool-search-setting.js";
 import { egressText, egressThrownText } from "./untrusted-egress.js";
-import { assertNoRetiredToolPolicyKeys, RETIRED_DECISION_MEMBERS } from "./retired-keys.js";
-import { isEngineRefusal, nestedRecordsOf, receiveContract, receiveNestedRecords, refusedOutOfContract, screenContractValues } from "./decision-receipt.js";
+import { assertNoRetiredKeys, assertNoRetiredToolPolicyKeys, RETIRED_DECISION_MEMBERS, RETIRED_TOOL_POLICY_KEYS } from "./retired-keys.js";
+import { DECISION_MEMBER_ARMS, isEngineRefusal, nestedRecordsOf, receiveContract, receiveNestedRecords, refusedOutOfContract, screenContractValues } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "./permission-rules.js";
 import { ruleSpellingOf } from "./permission-rule-syntax.js";
@@ -45,6 +45,7 @@ const ATTESTATION_GROUP_OF = {
     unresolvableCause: "unresolvableCause",
     foldedClasses: "foldedClasses",
     pathDenial: "pathDenial",
+    bindingRefusal: "bindingRefusal",
 };
 const ATTESTATION_MEMBERS = Object.keys(ATTESTATION_GROUP_OF);
 const groupLead = (g) => ATTESTATION_MEMBERS.find((k) => ATTESTATION_GROUP_OF[k] === g);
@@ -146,9 +147,31 @@ export const ASK_EVIDENCE_ABSENCE_VALUES = ["not_wired", "not_adjudicated", "una
 export function decisionText(d) {
     return d.message;
 }
+export function licenseCovers(licensed, runs) {
+    return licensed !== undefined && (licensed === exactBoundInputHashOf(runs) || licensed === exactBoundInputHashOf(argsReadFrom(runs)));
+}
+export function bindableArgsOf(toolName, args) {
+    const bound = bindableValueOf(args);
+    if (!bound.ok)
+        return { ok: false, refusal: bindingRefusalOf(toolName, args, bound.fault) };
+    if (typeof args === "object" && args !== null && OWNED_ARGS.has(args))
+        return { ok: true, value: args };
+    if (typeof bound.value === "object" && bound.value !== null)
+        OWNED_ARGS.add(bound.value);
+    return { ok: true, value: bound.value };
+}
+export function bindingRefusalOf(toolName, args, fault) {
+    return (`no approval can be bound to the arguments of "${toolName}": they hold ${inlineUntrusted(describeBindingFault(args, fault), 300)} — an approval binds arguments that are ` +
+        `a record of plain JSON data (records, dense lists, strings, finite numbers, booleans, null; no getter, hidden member, Proxy, ` +
+        `function, symbol, bigint or object of another kind; no cycle or shared object) nested at most 256 levels deep; denied fail-closed`);
+}
+export function answeredFor(d, call, runs) {
+    const record = attestationOf(d, call);
+    return record?.settlement !== undefined && licenseCovers(record.inputDigest, runs);
+}
 const TOOL_POLICY_CARRIED_MEMBERS = ["projection", "pathRules", "writeGuardRows", "nameSets"];
 export function carriedMembersOf(p) {
-    assertNoRetiredToolPolicyKeys(p);
+    assertNoRetiredKeys(p, RETIRED_TOOL_POLICY_KEYS, "ToolPolicy");
     const out = {};
     const carry = (k) => {
         const v = p[k];
@@ -259,12 +282,7 @@ export function constraintChainDigest(chain) {
     return `cpv1:${createHash("sha256").update(stableJson(chain)).digest("hex")}`;
 }
 const ALLOW = Object.freeze({ action: "allow" });
-const ALLOW_BY_RULE = Object.freeze({ action: "allow", decisionReason: "rule" });
-export const DECISION_MEMBERS = Object.keys({
-    action: 0, updatedInput: 0, message: 0, decisionReason: 0, requiresRealApproval: 0, denialLimitFallback: 0, classifierNoRuling: 0, allowRuleShadowed: 0, probeReason: 0,
-    probeCause: 0, probeMandated: 0, mandated: 0, mandate: 0, probeReadRootCandidate: 0, matchedAskRule: 0, ruleEvidence: 0, segmentCoverage: 0,
-    origin: 0, askClass: 0, classes: 0, guards: 0, ruleUnreadable: 0, authoredBy: 0, foldedAskClasses: 0, attestation: 0,
-});
+export const DECISION_MEMBERS = Object.keys(DECISION_MEMBER_ARMS);
 const HOOK_RESULT_MEMBERS = [...DECISION_MEMBERS, "additionalContext"];
 const HOOK_SEAM_UNREAD = new Set(["decisionReason"]);
 const HOOK_SEAM_OPTIONAL = new Set(["action"]);
@@ -315,7 +333,10 @@ export function refuseOutOfContractDecision(d, opts) {
         return refusedOutOfContract(`a permission decision's members could not be detached from the layer that returned them (${ownedRewrite.reason}) — ` +
             `the engine keeps its own copy of what it read; denied fail-closed`);
     }
-    const receipt = Object.freeze(attestation !== undefined ? { ...detached.value, attestation } : detached.value);
+    carryArgsReadFrom(contract.updatedInput, rewrite);
+    const held = detached.value;
+    const value = held.crossBoundaryMandated === true && held.requiresRealApproval !== true ? { ...held, requiresRealApproval: true } : held;
+    const receipt = Object.freeze(attestation !== undefined ? { ...value, attestation } : value);
     for (const v of Object.values(receipt))
         if (Array.isArray(v))
             Object.freeze(v);
@@ -355,6 +376,7 @@ export function toolPolicyNameSets(p) {
     return Array.isArray(sets) ? sets : [];
 }
 export function createAllowDenyPolicy(opts) {
+    assertNoRetiredKeys(opts, RETIRED_ALLOW_DENY_POLICY_OPTIONS, "createAllowDenyPolicy");
     const invalid = [];
     const screen = (entries, list) => {
         if (entries === undefined)
@@ -444,10 +466,13 @@ export function createAllowDenyPolicy(opts) {
             if (allow && !nameListHolds(allow, req) && !namespacedCoveringHit(allowCovering, req)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in the allowlist` };
             }
-            return allow && opts.scope !== "narrowing" ? ALLOW_BY_RULE : ALLOW;
+            return ALLOW;
         },
     };
 }
+const RETIRED_ALLOW_DENY_POLICY_OPTIONS = Object.freeze({
+    scope: "an allow list is only ever a narrowing now (a tool it does not name is denied; a tool it names gets no objection, not consent) — drop the option, and put the consent in the allow layer: `RunnerDeps.allowedTools` for the deployment's, `TaskSpec.allowedTools` for a request's",
+});
 export function createApprovalPolicy(opts) {
     if (opts.approvalTimeoutMs !== undefined && !Number.isFinite(opts.approvalTimeoutMs)) {
         throw new Error(`createApprovalPolicy: approvalTimeoutMs must be a finite number of ms (got ${opts.approvalTimeoutMs}) — omit it to wait indefinitely`);
@@ -481,17 +506,17 @@ export function createApprovalPolicy(opts) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
             if (nameListHolds(need, req) || namespacedCoveringHit(needCovering, req)) {
-                const attestOver = (inputDigest) => (d, settlement) => ({ ...d, attestation: mintAttestation(req, { settlement, origin: "policy", inputDigest }) });
+                const attestOver = (inputDigest) => (d, settlement, bindingRefusal) => ({ ...d, attestation: mintAttestation(req, { settlement, origin: "policy", ...(inputDigest !== undefined ? { inputDigest } : {}), ...(bindingRefusal !== undefined ? { bindingRefusal } : {}) }) });
                 const unasked = unaskedSeatAnswer(req, signal, { aborted: `approval aborted for "${req.toolName}" (run or turn interrupted)`, unreachable: `approval for "${req.toolName}" was not requested: nobody can be asked about this call` }, "policy");
                 if (unasked !== undefined)
                     return unasked;
-                const shown = tryCloneArgs(req.args);
-                if (!shown.ok) {
-                    return attestOver(boundInputHashOf(req.args))({ action: "deny", message: `approval for "${req.toolName}" could not present the args safely (unclonable value: ${shown.reason}) — denied fail-closed` }, settledByNobody("presentation_failed"));
-                }
-                const askedDigest = boundInputHashOf(shown.value);
+                const bound = bindableArgsOf(req.toolName, req.args);
+                if (!bound.ok)
+                    return attestOver(undefined)({ action: "deny", message: bound.refusal }, settledByNobody("presentation_failed"), bound.refusal);
+                const shown = { value: structuredClone(bound.value) };
+                const askedDigest = exactBoundInputHashOf(shown.value);
                 const attest = attestOver(askedDigest);
-                const heldWhileWaiting = () => boundInputHashOf(req.args) === askedDigest;
+                const heldWhileWaiting = () => licenseCovers(askedDigest, req.args);
                 const changedWhilePending = () => attest({
                     action: "deny",
                     message: `the arguments of "${req.toolName}" changed while its approval was pending — denied fail-closed ` +
@@ -544,7 +569,7 @@ export function createApprovalPolicy(opts) {
                 return attest({ action: "deny", message: `approval denied for "${req.toolName}"` }, settledByDecider("person", "refused", undefined));
             }
             if (nameListHolds(auto, req) || namespacedCoveringHit(autoCovering, req))
-                return ALLOW_BY_RULE;
+                return ALLOW;
             if (opts.denyByDefault) {
                 return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
             }
@@ -587,7 +612,6 @@ export function combinePolicies(...policies) {
             let asked;
             let current = Object.freeze({ ...req });
             let rewrite;
-            let stated;
             let records;
             let ruleAskText;
             let probeMandateSeen = false;
@@ -612,13 +636,8 @@ export function combinePolicies(...policies) {
                     continue;
                 }
                 if (d.updatedInput !== undefined) {
-                    const reread = withArgsReading(current, d.updatedInput, signal);
-                    current = Object.freeze(reread !== undefined ? await reread : { ...current, args: d.updatedInput });
+                    current = Object.freeze(await withArgsReading(current, d.updatedInput, signal));
                     rewrite = d;
-                    stated = d.action === "allow" ? d.decisionReason : undefined;
-                }
-                else if (d.action === "allow" && stated === undefined && d.decisionReason !== undefined) {
-                    stated = d.decisionReason;
                 }
                 if (d.action === "allow" && d.attestation !== undefined)
                     records = mergeAttestation(req, records, d.attestation);
@@ -663,8 +682,7 @@ export function combinePolicies(...policies) {
                 const out = merged !== undefined ? { ...withClasses, updatedInput: merged } : withClasses;
                 return folded.size > 0 ? attest(out, req, { foldedClasses: [...folded] }) : out;
             }
-            const base = rewrite ?? ALLOW;
-            const allowed = stated !== undefined && base.decisionReason !== stated ? { ...base, decisionReason: stated } : base;
+            const allowed = rewrite ?? ALLOW;
             return records === undefined ? allowed : { ...allowed, attestation: records };
         },
     };
@@ -714,7 +732,7 @@ export function createCoarseCommandNamePolicy(opts) {
             if (allow && !allow.has(parsed.name)) {
                 return fallback(`command "${parsed.name}" is not in the allowlist`);
             }
-            return allow ? ALLOW_BY_RULE : ALLOW;
+            return ALLOW;
         },
     }, "sandbox_local");
 }
@@ -900,7 +918,7 @@ export function refusalOf(deny, judged) {
 export function foldHookAsk(verdict, hookAsk) {
     if (verdict.action === "deny")
         return verdict;
-    const mandate = hookAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {};
+    const mandate = { ...(hookAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}), ...(hookAsk.crossBoundaryMandated === true ? { crossBoundaryMandated: true } : {}) };
     if (verdict.action === "allow") {
         return { action: "ask", ...(hookAsk.message !== undefined ? { message: hookAsk.message } : {}), decisionReason: "hook", ...mandate, ...(hookAsk.updatedInput !== undefined ? { updatedInput: hookAsk.updatedInput } : {}) };
     }
@@ -915,6 +933,13 @@ export function ownArgs(v, root = "args") {
     const copy = tryCloneArgs(v);
     return copy.ok ? ownedCopy(copy.value, root) : { ...copy, reason: `unclonable value: ${copy.reason}` };
 }
+export function ownedReading(read) {
+    return (args) => {
+        const out = read(args);
+        const owned = ownArgs(out);
+        return owned.ok ? owned.value : out;
+    };
+}
 function ownedCopy(fresh, root) {
     const pending = [[fresh, root]];
     for (let next = pending.pop(); next !== undefined; next = pending.pop()) {
@@ -1071,12 +1096,12 @@ export function carriesBidiControls(value, limits) {
     }
 }
 export async function resolveAsk(req, onAsk, signal, onLateSettlement) {
-    const askedDigest = boundInputHashOf(req.args);
-    const { settlement, ...r } = await resolveAskArms(req, onAsk, signal, onLateSettlement);
+    const askedDigest = exactBoundInputHashOf(req.args);
+    const { settlement, bindingRefusal, ...r } = await resolveAskArms(req, onAsk, signal, onLateSettlement);
     if (settlement === undefined)
         return r;
-    const licensedDigest = r.action === "allow" && r.updatedInput !== undefined ? boundInputHashOf(r.updatedInput) : r.presentedInput !== undefined ? boundInputHashOf(r.presentedInput) : askedDigest;
-    return attest(r, req, { settlement, ...(req.origin !== undefined ? { origin: req.origin } : {}), ...(req.classes !== undefined ? { classes: req.classes } : {}), inputDigest: licensedDigest });
+    const licensedDigest = r.action === "allow" && r.updatedInput !== undefined ? exactBoundInputHashOf(r.updatedInput) : r.presentedInput !== undefined ? exactBoundInputHashOf(r.presentedInput) : askedDigest;
+    return attest(r, req, { settlement, ...(req.origin !== undefined ? { origin: req.origin } : {}), ...(req.classes !== undefined ? { classes: req.classes } : {}), ...(licensedDigest !== undefined ? { inputDigest: licensedDigest } : {}), ...(bindingRefusal !== undefined ? { bindingRefusal } : {}) });
 }
 function raceAskWaitAgainstSignal(wait, signal) {
     const settledWait = wait.then((value) => ({ tag: "value", value }), (error) => ({ tag: "threw", error }));
@@ -1192,10 +1217,9 @@ function readApproverOutcomeObject(ok, toolName, editLane) {
             `re-adjudication an approver's edit gets; denied fail-closed (approve or refuse what was shown, and route edits ` +
             `through the run's approver seat)`, settledByNobody("approver_contract"));
     }
-    const edit = ownArgs(suppliedEdit);
-    if (!edit.ok) {
-        return refused(`the approved edit for "${toolName}" is not safely clonable (${edit.reason}) — denied fail-closed`, settledByNobody("presentation_failed"));
-    }
+    const edit = bindableArgsOf(toolName, suppliedEdit);
+    if (!edit.ok)
+        return { kind: "refused", message: edit.refusal, settlement: settledByNobody("presentation_failed"), binding: true };
     return { kind: "allow", edit: { value: edit.value }, settlement: settledByDecider(decider, "allowed", attribution.approver), grant };
 }
 async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
@@ -1205,37 +1229,25 @@ async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
         return { action: "allow", decisionReason: "mode" };
     }
     if (onAsk === undefined || onAsk === "deny") {
+        const bound = bindableArgsOf(req.toolName, req.args);
         return {
             action: "deny",
-            message: headlessDenialMessage(req.toolName, req.message),
+            message: bound.ok ? headlessDenialMessage(req.toolName, req.message) : bound.refusal,
             decisionReason: "mode",
             settlement: settledByNobody("no_approver"),
+            ...(bound.ok ? {} : { bindingRefusal: bound.refusal }),
         };
     }
     if (signal?.aborted) {
         return { action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, decisionReason: "mode", settlement: settledByNobody("task_aborted") };
     }
-    const presented = ownArgs(req.args);
-    if (!presented.ok) {
-        return {
-            action: "deny",
-            message: `approval for "${req.toolName}" could not present the args safely (${presented.reason}) — denied fail-closed`,
-            decisionReason: "mode",
-            settlement: settledByNobody("presentation_failed"),
-        };
-    }
+    const presented = bindableArgsOf(req.toolName, req.args);
+    if (!presented.ok)
+        return { action: "deny", message: presented.refusal, decisionReason: "mode", settlement: settledByNobody("presentation_failed"), bindingRefusal: presented.refusal };
     const offered = ownReadRootCandidate(req.readRootCandidate);
     let ok;
     try {
-        const approverView = tryCloneArgs(presented.value);
-        if (!approverView.ok) {
-            return {
-                action: "deny",
-                message: `approval for "${req.toolName}" could not present the args safely (unclonable value: ${approverView.reason}) — denied fail-closed`,
-                decisionReason: "mode",
-                settlement: settledByNobody("presentation_failed"),
-            };
-        }
+        const approverView = { value: structuredClone(presented.value) };
         const bidi = carriesBidiControls(presented.value) || carriesBidiControls(req.preview);
         const { hasBidiControls: _carried, ...bare } = req;
         const wait = Promise.resolve(onAsk({
@@ -1289,7 +1301,7 @@ async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
     if (typeof ok === "object" && ok !== null) {
         const reading = readApproverOutcomeObject(ok, req.toolName, "readjudicated");
         if (reading.kind === "refused")
-            return { action: "deny", message: reading.message, decisionReason: "mode", settlement: reading.settlement };
+            return { action: "deny", message: reading.message, decisionReason: "mode", settlement: reading.settlement, ...(reading.binding === true ? { bindingRefusal: reading.message } : {}) };
         if (reading.kind === "allow" && reading.settlement.who.party === "policy" && req.requiresRealApproval === true) {
             return { ...unjudgedAllowRefused(req, "policy"), ...readRootGrantSeat(reading.grant, offered, false) };
         }

package/dist/core/tool-roster.d.ts

@@ -2,6 +2,7 @@ import { Type, type Static, type TSchema } from "typebox";
 import type { AgentTool } from "../internal/harness-types.js";
 import { type ReservedApprovalCard, type ToolApprovalCard, type ToolFamily, type ToolRosterPathTarget, type ToolMountTag, type ToolPathTarget, type ToolRenderHints, type ToolRuleFace } from "./tool-face.js";
 import type { ToolContentOrigin, ToolEffect } from "./tool-spec.js";
+import type { ToolMarkSource } from "./ask-origin.js";
 export declare const ROSTER_SOURCES: readonly ["builtin", "caller", "host", "mcp", "a2a", "external", "synthetic"];
 export type RosterSource = (typeof ROSTER_SOURCES)[number];
 export declare const ToolRosterRenderHints: Type.TObject<{
@@ -50,6 +51,9 @@ export declare const ToolRosterEntry: Type.TObject<{
     contentOrigin: Type.TUnion<[Type.TLiteral<"local">, Type.TLiteral<"execution">, Type.TLiteral<"external">]>;
     contentOriginProvenance: Type.TUnion<[Type.TLiteral<"declared">, Type.TLiteral<"server">, Type.TLiteral<"exempted">, Type.TLiteral<"default">]>;
     family: Type.TUnion<[Type.TLiteral<"shell">, Type.TLiteral<"file-read">, Type.TLiteral<"file-write">, Type.TLiteral<"search">, Type.TLiteral<"web">, Type.TLiteral<"delegate">, Type.TLiteral<"plan">, Type.TLiteral<"scaffold">, Type.TLiteral<"memory">, Type.TLiteral<"protocol">, Type.TLiteral<"other">]>;
+    /** The legs a call of this tool travels (`BOUNDARY_LEGS`), or `"per_call"` when its dispatch gives them per call: the engine's own
+     *  definitions and the protocol tools state them, every other row follows its `effect` (`rosterBoundaryLegs`). */
+    boundaryLegs: Type.TUnion<[Type.TLiteral<"per_call">, Type.TArray<Type.TUnion<[Type.TLiteral<"env">, Type.TLiteral<"outside_read">, Type.TLiteral<"outside_write">]>>]>;
     pathTarget: Type.TOptional<Type.TObject<{
         param: Type.TString;
         aliases: Type.TArray<Type.TString>;
@@ -124,6 +128,9 @@ export declare const ToolRoster: Type.TObject<{
         contentOrigin: Type.TUnion<[Type.TLiteral<"local">, Type.TLiteral<"execution">, Type.TLiteral<"external">]>;
         contentOriginProvenance: Type.TUnion<[Type.TLiteral<"declared">, Type.TLiteral<"server">, Type.TLiteral<"exempted">, Type.TLiteral<"default">]>;
         family: Type.TUnion<[Type.TLiteral<"shell">, Type.TLiteral<"file-read">, Type.TLiteral<"file-write">, Type.TLiteral<"search">, Type.TLiteral<"web">, Type.TLiteral<"delegate">, Type.TLiteral<"plan">, Type.TLiteral<"scaffold">, Type.TLiteral<"memory">, Type.TLiteral<"protocol">, Type.TLiteral<"other">]>;
+        /** The legs a call of this tool travels (`BOUNDARY_LEGS`), or `"per_call"` when its dispatch gives them per call: the engine's own
+         *  definitions and the protocol tools state them, every other row follows its `effect` (`rosterBoundaryLegs`). */
+        boundaryLegs: Type.TUnion<[Type.TLiteral<"per_call">, Type.TArray<Type.TUnion<[Type.TLiteral<"env">, Type.TLiteral<"outside_read">, Type.TLiteral<"outside_write">]>>]>;
         pathTarget: Type.TOptional<Type.TObject<{
             param: Type.TString;
             aliases: Type.TArray<Type.TString>;
@@ -206,6 +213,9 @@ export declare const ToolRosterDelta: Type.TObject<{
             contentOrigin: Type.TUnion<[Type.TLiteral<"local">, Type.TLiteral<"execution">, Type.TLiteral<"external">]>;
             contentOriginProvenance: Type.TUnion<[Type.TLiteral<"declared">, Type.TLiteral<"server">, Type.TLiteral<"exempted">, Type.TLiteral<"default">]>;
             family: Type.TUnion<[Type.TLiteral<"shell">, Type.TLiteral<"file-read">, Type.TLiteral<"file-write">, Type.TLiteral<"search">, Type.TLiteral<"web">, Type.TLiteral<"delegate">, Type.TLiteral<"plan">, Type.TLiteral<"scaffold">, Type.TLiteral<"memory">, Type.TLiteral<"protocol">, Type.TLiteral<"other">]>;
+            /** The legs a call of this tool travels (`BOUNDARY_LEGS`), or `"per_call"` when its dispatch gives them per call: the engine's own
+             *  definitions and the protocol tools state them, every other row follows its `effect` (`rosterBoundaryLegs`). */
+            boundaryLegs: Type.TUnion<[Type.TLiteral<"per_call">, Type.TArray<Type.TUnion<[Type.TLiteral<"env">, Type.TLiteral<"outside_read">, Type.TLiteral<"outside_write">]>>]>;
             pathTarget: Type.TOptional<Type.TObject<{
                 param: Type.TString;
                 aliases: Type.TArray<Type.TString>;
@@ -281,15 +291,10 @@ export declare function approvalCardMemberOf(call: {
  *  other aliases — the ONE order of a call's names: a reader that must pick one of them by position (a `member` seat)
  *  picks the spelling first, as the same call was judged before name resolution. */
 export declare function toolCallFaceOf(roster: ToolRoster | undefined, toolName: string): import("./tool-policy.js").ToolCallFace | undefined;
-/** design/388 B18 — the identity members a park row carries, read off a roster snapshot by name; an empty object when
- *  the name is not on the snapshot (the row then reads pre-identity and the resume takes the name-only path). */
-export declare function parkedToolIdentity(roster: ToolRoster | undefined, toolName: string): {
-    capabilityId?: string;
-    contractId?: string;
-    shapeDigest?: string;
-    implementationRevision?: string;
-    rosterDigest?: string;
-};
+/** design/388 B18 — the identity members a park row carries (the tool member of its approval object,
+ *  `approval-object.ts`), read off a roster snapshot by name; an empty object when the name is not on the snapshot
+ *  (the row then reads pre-identity and the resume binds the name alone). */
+export declare function parkedToolIdentity(roster: ToolRoster | undefined, toolName: string): Partial<ToolIdentity>;
 /** design/388 B6 × B18 — the FACE members a park row carries beside its identity: the display family, the declared
  *  path target and the names the parked call was judged under. `names` is copied from the face the gate stamped on the
  *  request (the model's spelling first — the row carries the judged fact, it is not re-derived); a request with no face
@@ -375,7 +380,7 @@ export type RosterBoundCode = "config.tool_name_too_long" | "config.tool_contrac
  * undefined when every member fits. Read by the declaration door (a `TaskSpec.tools` entry, refused before session
  * acquire) and by the row mint (every source — an MCP/A2A peer, a definition that reached the mint by a route the
  * door does not cover — refused before the row exists). A member over its bound is NEVER truncated onto the row: a
- * truncated identity is a different identity (`judgeParkedToolIdentity` compares it across a park; the card
+ * truncated identity is a different identity (`judgeApprovalObject` compares it across a park; the card
  * namespace door reads it), and the schema's own bounds would then describe a row the mint never made.
  */
 export declare function rosterMemberBoundProblem(m: RosterBoundMembers): {
@@ -427,6 +432,7 @@ export interface MountedToolFace {
     compactable?: true;
     budgetExempt?: true;
     modelGate?: string;
+    boundaryLegs?: unknown;
 }
 export declare const faceOf: (t: AgentTool) => MountedToolFace;
 /** The leg facts the snapshot reads beside the instances — the safety scan's folds and the per-task knobs. */
@@ -441,20 +447,32 @@ export interface RosterSnapshotFacts {
     /** `TaskSpec.memory.trustedTools` — the exemption channel for an undeclared content class. */
     trustedTools: ReadonlySet<string>;
 }
+/** The leg's per-name safety-axis tables the builder keeps aligned with its mounts beside the effect map (the safety scan mints
+ *  them; the protocol folds and the shell seat also write them). */
+export interface RosterAxisTables {
+    irreversibilityTier: Map<string, "never" | "maybe" | "always">;
+    irreversibleTools: Set<string>;
+    reversibilityProbes: Map<string, unknown>;
+    egressTools: Set<string>;
+    toolMarkSources: Map<string, Set<ToolMarkSource>>;
+}
 export declare class RosterBuilder {
     #private;
-    constructor(effects: Map<string, ToolEffect>);
+    /** `axes` — the leg's safety-axis tables beside the effect map (a builder for a single probe tool may go without). */
+    constructor(effects: Map<string, ToolEffect>, axes?: RosterAxisTables);
     /** The mount array as a READ face. The order is the wire order. */
     get tools(): readonly AgentTool[];
     get length(): number;
     metaOf(tool: AgentTool): RosterMountMeta | undefined;
     /** Mount one instance at the tail. An engine-lane instance that DECLARES an effect writes it into the leg's effect
      *  map — the later mount under a name is the one the harness dispatches to (`snapshot`'s yield rule), so its
-     *  declaration is the map's truth for that name; a pre-mount registration (the hand band, the plan pair, an
-     *  MCP axis) stands only for names no mounted instance declares. The `scenario` lane never writes the map: its
+     *  declaration is the map's truth for that name — an engine tool's effect reaches the map from its own declaration, here at its
+     *  mount (nothing writes it by name beforehand; a protocol axis fills a name no mounted instance declares, and the gate's
+     *  post-assembly sync a kept instance the map still lacks). The `scenario` lane never writes the map: its
      *  declarations were latched by the safety scan BEFORE any mount (on the kept instance of each name, on the
      *  synchronous doors+scan stretch — a microtask cannot flip them), so a scenario mount, kept or dropped, leaves
-     *  the map as the scan made it; an engine lane's mount under that name still displaces it. */
+     *  the map as the scan made it; an engine lane's mount under that name still displaces it, and the aliases the displaced
+     *  instance answered to move to the member they now resolve to (`#resettleAliases`). */
     mount(tool: AgentTool, meta: RosterMountMeta): void;
     /** An ENGINE-INJECTED instance the harness list carries outside the mount array (the ToolSearch lane): a roster
      *  row — the model can call it — never a mount-array element (the disclosure lane owns that list and appends the
@@ -497,6 +515,20 @@ export declare function rosterCardId(source: RosterSource, toolName: string, pee
 /** The card namespace a `TaskSpec.tools` entry will own once mounted — the same mint the row makes, so the prepare
  *  door and the roster row cannot disagree about which namespace a caller card must live under. */
 export declare function callerCardIdOf(tool: Pick<AgentTool, "name" | "parameters">): string;
+/** The protocol segment of a mounted protocol tool's name (`mcp__srv__write_file` ⇒ `write_file`): the name itself when no protocol owns it.
+ *  ONE reading, asked by the row's mint below and by the judge that holds an MCP face's cards to the namespace that row will own. */
+export declare function protocolToolOf(toolName: string): string;
+/** The refusal of a `boundaryLegs` declaration that is not one — the ONE sentence the roster's declaration door and the row mint both
+ *  throw (`config.tool_face_invalid`, the code a caller tool's bad face has). */
+export declare function boundaryLegsRefusal(toolName: unknown): Error & {
+    code: string;
+};
+/** The judge of a caller roster's `boundaryLegs` where the roster enters, every entry the caller handed, mounted or not: the config-door
+ *  phase over the snapshot's faces and a resume's screen before its claim over the entries it is handed (one function, so the row stays
+ *  pending). A declaration that is not one is refused. Not judged here — the snapshot reads it, and only by running the caller's code:
+ *  an entry or a list of another prototype (its prototype chain answers), a Proxy, an accessor (or a non-enumerable member the receipt
+ *  does not take) as the name, the declaration or a slot of the list. The row mint judges every other source. */
+export declare function assertToolBoundaryLegs(tools: unknown): void;
 /** One row (design/388 §2.5). Every axis is read off the instance or the leg facts; nothing off a name table. */
 export declare function mintRosterEntry(tool: AgentTool, meta: RosterMountMeta, facts: RosterSnapshotFacts): ToolRosterEntry;
 /**
@@ -533,20 +565,6 @@ export declare function ruleFacesFromRoster(roster: ToolRoster): (toolName: stri
 } | undefined;
 /** The delta between two snapshots (design/388 §2.5): the whole `next` roster plus the name summary. */
 export declare function diffToolRoster(prev: ToolRoster, next: ToolRoster): ToolRosterDelta;
-/**
- * The resume-side identity judgement (design/388 §2.5 boundary ②, B18/B19): a parked action carrying the
- * four identity members is redeemed only against a same-name row whose four members ALL match; a row
- * whose contract / shape / revision / source-peer moved is a replacement wearing the name, and the
- * resume refuses it (`resume.tool_contract_mismatch`, same family and disposition as
- * `resume.tool_unavailable`). A parked action minted BEFORE the identity members existed (all four absent)
- * follows the name-only path and is never widened by their absence.
- */
-export declare function judgeParkedToolIdentity(pending: {
-    capabilityId?: string;
-    contractId?: string;
-    shapeDigest?: string;
-    implementationRevision?: string;
-}, row: ToolRosterEntry | undefined): "match" | "mismatch" | "name_only" | "absent";
 /** The card-namespace check a CALLER declaration must pass at prepare (design/388 §2.2 ④): a `resultCards`
  *  entry must live under the tool's own `cardId`; naming an engine card (`builtin:*`, or a bare engine card
  *  type) is refused. Returns the offending entry, or undefined. */