@sema-agent/core 7.52.0 → 7.54.0

package/dist/agents/tool-filter.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { canonicalize, UNCANONICALIZABLE } from "../core/canonical-json.js";
+import { SPAWNER_SURFACE_LEG_KINDS } from "../core/tool-face.js";
 import { ruleSpellingOf } from "../core/permission-rule-syntax.js";
 import { TOOL_CATALOG_ENTRIES } from "../core/tool-catalog-entries.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../core/namespaced-rule-name.js";
@@ -118,7 +119,10 @@ export function listReaches(reach, tool) {
     }
     return false;
 }
-const PROTOCOL_ROWS = Object.freeze(TOOL_CATALOG_ENTRIES.flatMap((e) => (e.protocol !== undefined ? [Object.freeze({ name: e.name, legs: e.protocol, underCeiling: e.protocolUnderCeiling === true })] : [])));
+const PROTOCOL_ROWS = Object.freeze(TOOL_CATALOG_ENTRIES.flatMap((e) => (e.protocol !== undefined ? [Object.freeze({ name: e.name, legs: e.protocol })] : [])));
+export function protocolRowUnderCeiling(rowLegs) {
+    return rowLegs.some((l) => SPAWNER_SURFACE_LEG_KINDS.includes(l));
+}
 export function protocolToolNames(legs) {
     return [...new Set(PROTOCOL_ROWS.filter((r) => r.legs.some((l) => legs.includes(l))).map((r) => r.name))];
 }
@@ -147,7 +151,7 @@ export function compileToolSelector(layers, legs = []) {
     const kept = Object.freeze([...layers]);
     const compiled = kept.map((l) => (isToolSelectorLayer(l) ? { allow: readAllowedToolList(l.allow), deny: readDeniedToolList(l.deny) } : NO_TOOL_LAYER));
     const admittedBy = (ls, tool) => ls.every((l) => (l.allow === undefined || listReaches(l.allow, tool)) && !listReaches(l.deny, tool));
-    const protocol = new Map(PROTOCOL_ROWS.filter((r) => r.legs.some((l) => legs.includes(l))).map((r) => [r.name, r.underCeiling]));
+    const protocol = new Map(PROTOCOL_ROWS.filter((r) => r.legs.some((l) => legs.includes(l))).map((r) => [r.name, protocolRowUnderCeiling(r.legs)]));
     return Object.freeze({
         layers: kept,
         admits: (tool) => {
@@ -167,6 +171,12 @@ export function compileToolSelector(layers, legs = []) {
         },
     });
 }
+export function valveLeaves(spec, selector) {
+    return spec.excludeAllTools === true ? () => false : (tool) => selector.admits(tool);
+}
+export function valveLeavesPeer(spec, selector) {
+    return spec.excludeAllTools === true ? () => false : (prefix) => selector.admitsPeer(prefix);
+}
 export function deniedProtocolTools(layers, legs) {
     const denies = layers.map((l) => readDeniedToolList(isToolSelectorLayer(l) ? l.deny : undefined));
     const own = denies.slice(-1);
@@ -176,7 +186,7 @@ export function deniedProtocolTools(layers, legs) {
         const reached = (ds) => ds.some((d) => listReaches(d, { name: r.name }));
         if (reached(own))
             hits.set(`own:${r.name}`, { name: r.name, own: true });
-        if (!r.underCeiling && reached(inherited))
+        if (!protocolRowUnderCeiling(r.legs) && reached(inherited))
             hits.set(`inherited:${r.name}`, { name: r.name, own: false });
     }
     return [...hits.values()];

package/dist/brain/anthropic.d.ts

@@ -1,7 +1,7 @@
 import type { Brain } from "../core/types.js";
 import { type StreamEngineConfig } from "./stream-engine.js";
 export interface AnthropicBrainConfig extends StreamEngineConfig {
-    /** Base URL of the Anthropic(-compatible) API. Default `https://api.anthropic.com`. Overridden by model.baseUrl. */
+    /** Base URL of the Anthropic(-compatible) API. Default {@link ANTHROPIC_DEFAULT_BASE_URL}. Overridden by model.baseUrl. */
     baseUrl?: string;
     /** API key (`x-api-key`). Overridden by per-call options.apiKey / getApiKeyAndHeaders. */
     apiKey?: string;
@@ -35,6 +35,11 @@ export interface AnthropicBrainConfig extends StreamEngineConfig {
      */
     thinkingBudgetTokens?: number;
 }
+/** This lane's own default endpoint: where a request goes when neither the entry nor the config names a root,
+ *  and so the root a key on the config is paired with when the config declares none. Exported so that every place that
+ *  names the Anthropic API's own root — the {@link fable5Model} preset, a host's disclosure of where a default request
+ *  lands — reads this one spelling. */
+export declare const ANTHROPIC_DEFAULT_BASE_URL = "https://api.anthropic.com";
 /**
  * Create a Brain for the Anthropic Messages API (`/v1/messages`) with **prompt caching** and
  * **extended-thinking replay**. Translates the unified Context into an Anthropic request and the

package/dist/brain/anthropic.js

@@ -226,7 +226,7 @@ function closeToolUseBlock(acc, responseIds, closed) {
     acc.closedTc = { type: "toolCall", id: engineId, ...(wireId !== engineId ? { wireId } : {}), name: acc.toolName, arguments: args };
     return acc.closedTc;
 }
-const ANTHROPIC_LANE_DEFAULT = "https://api.anthropic.com";
+export const ANTHROPIC_DEFAULT_BASE_URL = "https://api.anthropic.com";
 const ANTHROPIC_KEY_HEADER = "x-api-key";
 export function createAnthropicBrain(given = {}) {
     const config = brainConfigSnapshot(given, "createAnthropicBrain config");
@@ -248,7 +248,7 @@ export function createAnthropicBrain(given = {}) {
             stallTimeouts: options?.stallTimeouts,
             buildRequest: (overrides) => {
                 const routed = { id: model.id, baseUrl: model.baseUrl };
-                const { root, origin: rootOrigin } = resolveRequestRootOf(routed.baseUrl, config.baseUrl, ANTHROPIC_LANE_DEFAULT);
+                const { root, origin: rootOrigin } = resolveRequestRootOf(routed.baseUrl, config.baseUrl, ANTHROPIC_DEFAULT_BASE_URL);
                 const modelHeaders = headerBagOnce(model.headers);
                 const optionsHeaders = headerBagOnce(options?.headers);
                 const routeCredential = resolveRouteCredential({
@@ -259,7 +259,7 @@ export function createAnthropicBrain(given = {}) {
                     configHeaders: config.headers,
                     keyHeader: ANTHROPIC_KEY_HEADER,
                 });
-                const routeAdmission = admitRouteRequest(routed, routeCredential, { baseUrl: config.baseUrl, laneDefault: ANTHROPIC_LANE_DEFAULT });
+                const routeAdmission = admitRouteRequest(routed, routeCredential, { baseUrl: config.baseUrl, laneDefault: ANTHROPIC_DEFAULT_BASE_URL });
                 const apiKey = routeCredential.apiKey;
                 const nonEmptyBlocks = context.systemBlocks?.filter((b) => b.text.length > 0);
                 const system = nonEmptyBlocks?.length
@@ -772,5 +772,5 @@ export function createAnthropicBrain(given = {}) {
             },
         });
     };
-    return { stream, adjudicateRoute: createBrainRouteJudge({ ...config, laneDefault: ANTHROPIC_LANE_DEFAULT, keyHeader: ANTHROPIC_KEY_HEADER }) };
+    return { stream, adjudicateRoute: createBrainRouteJudge({ ...config, laneDefault: ANTHROPIC_DEFAULT_BASE_URL, keyHeader: ANTHROPIC_KEY_HEADER }) };
 }

package/dist/brain/model-presets.js

@@ -1,4 +1,5 @@
 import { catalogText } from "../prompt-assembly/catalog/index.js";
+import { ANTHROPIC_DEFAULT_BASE_URL } from "./anthropic.js";
 export const FABLE_5_COMPAT = {
     thinkingMode: "adaptive",
     effortLevels: ["low", "medium", "high", "xhigh", "max"],
@@ -15,7 +16,7 @@ export function fable5Model(overrides = {}) {
         name: "Claude Fable 5",
         api: "anthropic-messages",
         provider: "anthropic",
-        baseUrl: "https://api.anthropic.com",
+        baseUrl: ANTHROPIC_DEFAULT_BASE_URL,
         reasoning: true,
         defaultThinking: "high",
         input: ["text", "image"],

package/dist/brain/route-adjudicator.d.ts

@@ -218,6 +218,12 @@ export declare function routeRefusalError(verdict: Extract<RouteAdjudication, {
  * nothing. A credential is bound to the origin it was first SENT to, never to one it was only judged for. The request's
  * halves (the entry's id and root, the brain's root and lane default) are read ONCE, here: both judgments and the binding
  * are of the request this build is sending, whatever the caller's objects say by the time it is committed.
+ *
+ * Exported from the package root for a HOST that sends a request itself (its own `fetch`, outside a first-party brain): it
+ * passes this same gate, so the binding does not depend on who sends first. Resolve the credential with
+ * {@link resolveRouteCredential} (a credential built by hand carries no identity: it is judged and binds nothing), call this
+ * before building, and run the admission it returns immediately before the request goes out; a refusal is the very error a
+ * first-party brain throws for the same request. {@link adjudicateModelRoute} stays the read: it judges and binds nothing.
  */
 export declare function admitRouteRequest(model: Pick<Model, "id" | "baseUrl">, credential: RouteCredential, config: RoutePairingConfig): () => void;
 /**

package/dist/brain/routing.d.ts

@@ -5,9 +5,31 @@ export interface RoutingBrainOptions {
     /** Brain used when no route matches. If omitted, an unmatched model yields an error. */
     fallback?: Brain;
 }
+/** The two `Model` fields a route can be named by — a catalog entry that carries only a provider word is as good a subject as a whole `Model`. */
+type RouteWords = {
+    readonly provider?: string | undefined;
+    readonly api?: string | undefined;
+};
+/**
+ * THE judge of which line serves a model: the model's route word (`provider`, or `api` when `by` says so) IF the route table
+ * has an OWN route under that word, else `undefined` — the fallback (the deployment's gateway) serves it. A word the model
+ * carries without a route, and a model with no string word at all, both answer `undefined`: a route that is not mounted is
+ * not a line, whatever the model says.
+ *
+ * `routes` is the route TABLE itself — the very object a host hands {@link createRoutingBrain}, which asks this function for
+ * every request — so the judge and the router answer from one reading of one table, whatever its shape. The question is
+ * `Object.hasOwn(routes, word)`: it evaluates no entry and lists no keys, so a non-enumerable own route is a route, a lazily
+ * keyed table is asked about the one name it is asked about, and a name the table only inherits (`constructor`, `__proto__`)
+ * is not a route. The judge never reads a route's value: a route mounted under the word IS the line, and when its value is not
+ * a brain the router fails that request on that line (an error terminal naming the route) rather than moving it to the
+ * fallback — so the line this answers is the line the request was sent to, either way. A table that cannot answer the question
+ * (it is not an object, or its trap throws) throws here, and the router fails the request with an error terminal.
+ */
+export declare function brainLaneOf(model: RouteWords, routes: Readonly<Record<string, unknown>>, by?: NonNullable<RoutingBrainOptions["by"]>): string | undefined;
 /**
  * Route to different brains by a Model field (default `model.provider`). Lets one Runner serve
- * multiple providers/gateways; compose with `createFailoverBrain` for per-route failover.
+ * multiple providers/gateways; compose with `createFailoverBrain` for per-route failover. Which route serves a
+ * model is {@link brainLaneOf}'s answer.
  *
  * @example
  * createRoutingBrain({
@@ -16,3 +38,4 @@ export interface RoutingBrainOptions {
  * }, { fallback: createOpenAIBrain({ baseUrl: VLLM }) });
  */
 export declare function createRoutingBrain(routes: Record<string, Brain>, opts?: RoutingBrainOptions): Brain;
+export {};

package/dist/brain/routing.js

@@ -1,42 +1,77 @@
 import { createAssistantMessageEventStream, } from "../internal/llm.js";
 import { ZERO_USAGE } from "./errors.js";
-function errorMessage(model, text) {
+function errorMessage(who, text) {
     return {
         role: "assistant",
         content: [{ type: "text", text: "" }],
-        api: model.api,
-        provider: model.provider,
-        model: model.id,
+        api: who.api,
+        provider: who.provider,
+        model: who.id,
         stopReason: "error",
         errorMessage: text,
         usage: ZERO_USAGE,
         timestamp: Date.now(),
     };
 }
+const BLANK_IDENTITY = { api: "", provider: "", id: "" };
+function spelled(word) {
+    return (typeof word === "object" && word !== null) || typeof word === "function" ? `[${typeof word}]` : String(word);
+}
+function routeKeyOf(model, by) {
+    return by === "api" ? model.api : model.provider;
+}
+function isBrain(value) {
+    return value !== null && typeof value === "object" && typeof value.stream === "function";
+}
+export function brainLaneOf(model, routes, by = "provider") {
+    const word = routeKeyOf(model, by);
+    return typeof word === "string" && Object.hasOwn(routes, word) ? word : undefined;
+}
 export function createRoutingBrain(routes, opts = {}) {
     const by = opts.by ?? "provider";
     const resolveTarget = (model) => {
-        const key = by === "api" ? model.api : model.provider;
-        const routed = Object.hasOwn(routes, key) ? routes[key] : undefined;
-        const matched = routed !== null && typeof routed === "object" && typeof routed.stream === "function"
-            ? routed
-            : undefined;
-        return matched ?? opts.fallback;
+        const lane = brainLaneOf(model, routes, by);
+        if (lane === undefined)
+            return { target: opts.fallback };
+        const routed = routes[lane];
+        return isBrain(routed) ? { target: routed } : { broken: `route ${by}="${lane}" is mounted but its value is not a brain` };
     };
     const stream = (model, context, options) => {
-        const key = by === "api" ? model.api : model.provider;
-        const target = resolveTarget(model);
-        if (!target) {
+        const reject = (text, named) => {
             const out = createAssistantMessageEventStream();
-            out.push({
-                type: "error",
-                reason: "error",
-                error: errorMessage(model, `createRoutingBrain: no brain for ${by}="${key}"`),
-            });
+            try {
+                const wordOf = (field) => (field === by && named !== undefined ? named.value : model[field]);
+                out.push({ type: "error", reason: "error", error: errorMessage({ api: wordOf("api"), provider: wordOf("provider"), id: wordOf("id") }, text) });
+            }
+            catch {
+                out.push({ type: "error", reason: "error", error: errorMessage(BLANK_IDENTITY, `${text} (the model's own words could not be read either)`) });
+            }
             return out;
+        };
+        let word;
+        try {
+            word = { value: routeKeyOf(model, by) };
         }
+        catch {
+            return reject(`createRoutingBrain: the model's ${by} could not be read`);
+        }
+        const named = word.value;
+        const asked = { api: named, provider: named };
+        let resolved;
+        try {
+            resolved = resolveTarget(asked);
+        }
+        catch {
+            return reject(`createRoutingBrain: the route table threw while ${by}="${spelled(named)}" was looked up`, word);
+        }
+        const target = "target" in resolved ? resolved.target : undefined;
+        if (!target)
+            return reject("broken" in resolved ? `createRoutingBrain: ${resolved.broken}` : `createRoutingBrain: no brain for ${by}="${spelled(named)}"`, word);
         return target.stream(model, context, options);
     };
-    const adjudicateRoute = (model, perModelAuth) => resolveTarget(model)?.adjudicateRoute?.(model, perModelAuth);
+    const adjudicateRoute = (model, perModelAuth) => {
+        const resolved = resolveTarget(model);
+        return "target" in resolved ? resolved.target?.adjudicateRoute?.(model, perModelAuth) : undefined;
+    };
     return { stream, adjudicateRoute };
 }

package/dist/brain/timeout.js

@@ -1,14 +1,15 @@
+import { describeRejectedValue } from "../core/tool-search-setting.js";
 export const MAX_TIMER_DELAY_MS = 2_147_483_647;
 export function resolveStallTimeoutMs(value, knob) {
     if (value === undefined)
         return undefined;
     if (!Number.isFinite(value) || value < 0) {
-        const e = new Error(`${knob} must be a non-negative finite number of milliseconds (got ${String(value)})`);
+        const e = new Error(`${knob} must be a non-negative finite number of milliseconds (got ${describeRejectedValue(value)})`);
         e.code = "config.stall_timeout_invalid";
         throw e;
     }
     if (value > MAX_TIMER_DELAY_MS) {
-        const e = new Error(`${knob} must not exceed ${MAX_TIMER_DELAY_MS}ms (~24.8 days) — a host timer truncates a larger delay and fires immediately, so this watchdog would abort every call instead of tolerating a long one (got ${String(value)}). Pass 0 to disable it.`);
+        const e = new Error(`${knob} must not exceed ${MAX_TIMER_DELAY_MS}ms (~24.8 days) — a host timer truncates a larger delay and fires immediately, so this watchdog would abort every call instead of tolerating a long one (got ${describeRejectedValue(value)}). Pass 0 to disable it.`);
         e.code = "config.stall_timeout_invalid";
         throw e;
     }
@@ -112,12 +113,12 @@ export function resolveBrainCallGuardrailMs(knob) {
     if (knob === false || knob === 0)
         return undefined;
     if (typeof knob !== "number" || !Number.isFinite(knob) || knob < 0) {
-        const e = new Error(`brainCallGuardrailMs must be a positive number of milliseconds, 0, or false (got ${String(knob)})`);
+        const e = new Error(`brainCallGuardrailMs must be a positive number of milliseconds, 0, or false (got ${describeRejectedValue(knob)})`);
         e.code = "config.brain_call_guardrail_invalid";
         throw e;
     }
     if (knob > MAX_TIMER_DELAY_MS) {
-        const e = new Error(`brainCallGuardrailMs must not exceed ${MAX_TIMER_DELAY_MS}ms (~24.8 days) — a host timer truncates a larger delay and fires immediately, so the backstop would abort every model call (got ${String(knob)}). Pass false or 0 to turn the backstop off.`);
+        const e = new Error(`brainCallGuardrailMs must not exceed ${MAX_TIMER_DELAY_MS}ms (~24.8 days) — a host timer truncates a larger delay and fires immediately, so the backstop would abort every model call (got ${describeRejectedValue(knob)}). Pass false or 0 to turn the backstop off.`);
         e.code = "config.brain_call_guardrail_invalid";
         throw e;
     }

package/dist/core/a2a.d.ts

@@ -69,8 +69,11 @@ export interface MaterializedA2a {
     /** One entry per DECLARED peer, in declaration order, ready or failed — the declaration as this materialization read it once. */
     statuses: A2aPeerStatus[];
     /** Re-read one peer's card (or every declared peer) and re-derive its tools. Unlike the MCP refresh
-     *  this dials nothing new — every A2A call is a fresh request anyway — so a peer that failed at
-     *  prepare time can genuinely recover here. */
+     *  this dials nothing new — every A2A call is a fresh request anyway — so a peer whose card or network
+     *  failed at prepare time can genuinely recover here. The DECLARATION is not re-read: a refresh works
+     *  from the copy this materialization took and judged — the members too (`headers`, `allowSkills`,
+     *  `toolAxes` are copied, not shared) — so a declaration refused then is refused again and a caller
+     *  rewriting its object afterwards, by replacing a member or by editing one in place, changes nothing. */
     refresh: (peer?: string) => Promise<A2aRefreshResult[]>;
     /**
      * Task teardown. There is no socket to close (every call is its own request), so what this owns is the

package/dist/core/a2a.js

@@ -5,8 +5,10 @@ import { assertEndpointBound, redirectPolicy, resolveProtocolHttpHeaders, underD
 import { describeHttpTransportFailure } from "./mcp-failure.js";
 import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolName } from "./protocol-naming.js";
 import { A2A_NAMESPACE } from "./protocol-table.js";
+import { judgeEntryToolAxes, refusedDeclarer, snapshotDeclaredEntry } from "./locked-config.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";
 import { thrownText } from "./thrown-value.js";
+import { boundaryFlowFace } from "./cross-boundary-taint.js";
 const A2A_REQUEST_TIMEOUT_MS = 30_000;
 const A2A_CARD_TIMEOUT_MS = 10_000;
 const A2A_CALL_TOTAL_TIMEOUT_MS = 10 * 60_000;
@@ -540,25 +542,40 @@ function buildSkillTool(spec, t, skill, lifecycle) {
         },
     };
 }
-async function materializePeer(declaredSpec, principal, lifecycle, signal) {
-    const spec = Object.freeze({ ...declaredSpec });
+function declaredPeerOf(declared, index) {
+    let snapshot;
+    try {
+        snapshot = snapshotDeclaredEntry(declared, "a2a");
+    }
+    catch (err) {
+        return { spec: { name: refusedDeclarer(err) ?? `(peer #${index + 1}, name unreadable)` }, refusal: err };
+    }
+    const judged = judgeEntryToolAxes(snapshot, "a2a");
+    return judged.ok ? { spec: judged.entry } : { spec: snapshot, refusal: judged.error };
+}
+async function materializePeer(peer, principal, lifecycle, signal) {
+    if ("refusal" in peer)
+        throw peer.refusal;
+    const { spec } = peer;
+    const declaredAxes = spec.toolAxes;
     const headers = resolveProtocolHttpHeaders(A2A_NAMESPACE.id, spec, principal);
     const discovery = { peer: spec.name, endpoint: spec.url, headers };
     const card = readCard(spec.name, await discoverCardBody(spec, discovery, signal), spec.url);
     assertEndpointBound(A2A_NAMESPACE.id, spec.name, card.endpoint, spec.cardUrl === undefined ? [spec.url] : [spec.url, spec.cardUrl], headers);
     const transport = { peer: spec.name, endpoint: card.endpoint, headers };
     const tools = [];
-    const axes = [];
+    const skillAxes = [];
     for (const skill of card.skills) {
         if (spec.allowSkills !== undefined && !spec.allowSkills.includes(skill.id))
             continue;
-        const tool = buildSkillTool(spec, transport, skill, lifecycle);
+        const declared = declaredAxes?.[skill.id];
+        const tool = { ...buildSkillTool(spec, transport, skill, lifecycle), ...boundaryFlowFace(declared) };
         tools.push(tool);
-        axes.push(a2aAxisFor(tool.name, spec.toolAxes?.[skill.id]));
+        skillAxes.push(a2aAxisFor(tool.name, declared));
     }
     return {
         tools,
-        axes,
+        axes: skillAxes,
         status: {
             name: spec.name,
             status: "ready",
@@ -576,8 +593,9 @@ function asPeerWarning(spec, err) {
     return warning;
 }
 export async function materializeA2aTools(specs, principal, signal) {
-    if (specs.length > 0) {
-        const collision = findNamespacePrefixCollision(A2A_NAMESPACE, specs.map((s) => s.name));
+    const peers = specs.map((spec, index) => declaredPeerOf(spec, index));
+    if (peers.length > 0) {
+        const collision = findNamespacePrefixCollision(A2A_NAMESPACE, peers.map((p) => p.spec.name));
         if (collision) {
             const [a, b] = collision.peers;
             const e = new Error(a === b
@@ -592,9 +610,9 @@ export async function materializeA2aTools(specs, principal, signal) {
     const toolAxes = [];
     const warnings = [];
     const statuses = [];
-    const settled = await Promise.allSettled(specs.map((spec) => materializePeer(spec, principal, lifecycle, signal)));
-    for (let i = 0; i < specs.length; i++) {
-        const spec = specs[i];
+    const settled = await Promise.allSettled(peers.map((peer) => materializePeer(peer, principal, lifecycle, signal)));
+    for (let i = 0; i < peers.length; i++) {
+        const spec = peers[i].spec;
         const outcome = settled[i];
         if (outcome.status === "fulfilled") {
             tools.push(...outcome.value.tools);
@@ -613,12 +631,13 @@ export async function materializeA2aTools(specs, principal, signal) {
         statuses,
         refresh: async (peer) => {
             const prefixOf = (name) => mintNamespacePrefix(A2A_NAMESPACE, name);
-            const targets = peer !== undefined ? specs.filter((s) => s.name === peer) : specs;
+            const targets = peer !== undefined ? peers.filter((p) => p.spec.name === peer) : peers;
             if (peer !== undefined && targets.length === 0) {
                 return [{ peer, prefix: prefixOf(peer), status: "failed", toolCount: 0, added: [], removed: [], error: "no peer of that name is declared for this task" }];
             }
             const results = [];
-            for (const spec of targets) {
+            for (const target of targets) {
+                const { spec } = target;
                 const prefix = prefixOf(spec.name);
                 if (lifecycle.disposed) {
                     results.push({ peer: spec.name, prefix, status: "disposed", toolCount: 0, added: [], removed: [] });
@@ -626,7 +645,7 @@ export async function materializeA2aTools(specs, principal, signal) {
                 }
                 const previous = statuses.find((s) => s.name === spec.name)?.toolNames ?? [];
                 try {
-                    const fresh = await materializePeer(spec, principal, lifecycle, signal);
+                    const fresh = await materializePeer(target, principal, lifecycle, signal);
                     const names = fresh.tools.map((t) => t.name);
                     results.push({
                         peer: spec.name,

package/dist/core/allow-entry.d.ts

@@ -163,7 +163,8 @@ export declare function uncoveredCommandSegment(rows: readonly AllowEntryRow[],
  * segment covered by a row — or, for a `grant` list, read-only by itself); deny: a row whose program run the call performs (the
  * wide tightening reading; a call that cannot be read against the row is refused too). PATH — the persisted path adjudication
  * (allow: the narrow reading, every view of the target inside what the row names; deny: any view reaching it). NAME / DOMAIN —
- * the one predicate of each (the name the call names, the host it fetches).
+ * the one predicate of each (the name the call names, the host it fetches); a keyed tool's call naming no value for its key is
+ * refused by a deny list's row of the key and granted by no allow row (the persisted walk's reading, `keyedValueAbsentReason`).
  */
 export declare function judgeAllowEntries<R extends AllowEntryRow>(rows: readonly R[], req: ToolCallRequest, behavior: "allow" | "deny", ctx: AllowEntryJudgeContext, posture?: AdmissionPosture): readonly R[] | undefined;
 /** The allow rows of a list, as the allow layer reads them in `mode`: the strip applied BEFORE the match (in `auto`). */
@@ -275,6 +276,7 @@ export declare const SHADOW_REASON: Readonly<{
     readonly denial_limit_fallback: "the auto-mode classifier refused too many calls in a row, so a person decides";
     readonly classifier_no_ruling: "the auto-mode classifier could not judge this call, so a person decides";
     readonly requires_user_interaction: "this tool's server declares that a call must be put to a person";
+    readonly cross_boundary: string;
     readonly operator_forced: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule";
     readonly shell_floor: string;
     readonly target_unresolved: string;

package/dist/core/allow-entry.js

@@ -4,7 +4,7 @@ import { parsePermissionRule, ruleSpellingOf } from "./permission-rule-syntax.js
 import { judgeRuleToolName, splitNamespacedName } from "./tool-name-aliases.js";
 import { catalogToolNames, isShellFaceToolName } from "./tool-registry.js";
 import { ALLOW_RULE_MEMBERS } from "./allow-rule-shadow.js";
-import { COMMAND_RULE_TOOL, adjudicatePersistedDomainRules, adjudicatePersistedNameRules, commandCoverageOf, domainRuleSubjectOf, laneToolNamesOf, nameRuleSubjectOf, parseRuleText, programRunReachOf, ruleToolGrammarOf } from "./permission-rule-model.js";
+import { COMMAND_RULE_TOOL, adjudicatePersistedDomainRules, adjudicatePersistedNameRules, commandCoverageOf, domainRuleSubjectOf, laneToolNamesOf, nameRuleSubjectOf, noticeRuleText, parseRuleText, programRunReachOf, ruleToolGrammarOf } from "./permission-rule-model.js";
 import { pathRuleLaneAnswer } from "./runner/permission-rule-lanes.js";
 import { callTargetReadingOf } from "./effective-path-target.js";
 import { splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
@@ -363,6 +363,7 @@ export const SHADOW_REASON = Object.freeze({
     denial_limit_fallback: "the auto-mode classifier refused too many calls in a row, so a person decides",
     classifier_no_ruling: "the auto-mode classifier could not judge this call, so a person decides",
     requires_user_interaction: "this tool's server declares that a call must be put to a person",
+    cross_boundary: mandateDisclosureOf("cross_boundary_taint"),
     operator_forced: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule",
     shell_floor: mandateDisclosureOf("operator_always"),
     target_unresolved: mandateDisclosureOf("target_unresolved"),
@@ -462,6 +463,6 @@ export function allowedToolsNotGrantedNotice(inert, sessionId) {
         message: `${inert.length} allowed-tools entr${inert.length === 1 ? "y grants" : "ies grant"} or refuse${inert.length === 1 ? "s" : ""} nothing — ${shown.join("; ")}${rest > 0 ? `; and ${rest} more` : ""}. ` +
             "A list holding `*` voids the list, `mcp__*` names no server, a rule the grammar refuses (`grammar`) or one on a tool with no such rule form (`content_unsupported`: an allow by path is an `Edit(…)` or `Read(…)` rule) grants nothing, and a tool name must be spelled as the tool is mounted; name the tools (or `mcp__<server>`) instead." +
             (refusing ? " Such an entry in a disallowed-tools list keeps its Skill from activating: a refusal that reads as nothing is not dropped." : ""),
-        detail: { ...(sessionId !== undefined ? { sessionId } : {}), entries: inert.map((e) => ({ ...e })) },
+        detail: { ...(sessionId !== undefined ? { sessionId } : {}), entries: inert.map((e) => ({ ...e, entry: noticeRuleText(e.entry) })) },
     };
 }

package/dist/core/approval-object.d.ts

@@ -0,0 +1,87 @@
+import type { PendingAction } from "./checkpoint-store.js";
+import type { CallTargetReading } from "./effective-path-target.js";
+import { type SkillGrantSource } from "./skill-grant.js";
+import type { ToolCallPathTarget, ToolFamily } from "./tool-face.js";
+import { type ToolRosterEntry } from "./tool-roster.js";
+type ParkedApproval = Extract<PendingAction, {
+    kind: "tool_approval";
+}>;
+/** The readings of a call's path slot a target is bound under ({@link CallTargetReading}'s two directions). */
+export declare const APPROVAL_TARGET_ROLES: readonly ["protective", "declared"];
+export type ApprovalTargetRole = (typeof APPROVAL_TARGET_ROLES)[number];
+/** The row's `targets` member: per role, the location the target RESOLVED to when the card was asked (the canonical
+ *  view of that reading), or `null` when the environment was asked and did not answer — an unresolved target binds
+ *  "unresolved", so a later resolution is a move. A role the environment was not asked about is absent; a row with no
+ *  such role carries none. */
+export type ApprovalTargets = {
+    readonly [R in ApprovalTargetRole]?: string | null;
+};
+/** The tool member as the row carries it: every member optional (a row is read, never trusted to be whole). */
+export interface ApprovalTool {
+    readonly capabilityId?: string;
+    readonly contractId?: string;
+    readonly shapeDigest?: string;
+    readonly implementationRevision?: string;
+    readonly family?: ToolFamily;
+    readonly pathTarget?: ToolCallPathTarget;
+}
+export interface ApprovalObject {
+    /** Absent on a row minted before the identity members (all four absent): such a row binds the tool's name alone. */
+    readonly tool?: ApprovalTool;
+    /** The row's member as stored — read, validated, by the judge. */
+    readonly targets?: unknown;
+    readonly grants?: string;
+}
+/** The view of one parked approval's object. */
+export declare function approvalObjectOf(row: ParkedApproval): ApprovalObject;
+/** The `targets` member of a reading: per role, the canonical view, or `null` for a view the environment was asked for
+ *  and did not answer; nothing when no role was read either way (or no reading was taken). The park mints it from the
+ *  gate's reading of the parked bytes; the execution station reads the bytes that will run the same way. */
+export declare function approvalTargetsOf(reading: CallTargetReading | undefined): {
+    targets?: ApprovalTargets;
+};
+/** Where a resume judges the object: before the claim (the decided bytes), before the session is touched (the live
+ *  tool), right before the execution (the tool as mounted then — a host's re-dial can replace it between the two — and the
+ *  bytes that will run, after every station that can rewrite them). */
+export type ApprovalStation = "claim" | "session" | "execution";
+export type ApprovalMember = "tool" | "targets" | "grants";
+/** THE table: the members each station judges. */
+export declare const APPROVAL_STATION_MEMBERS: {
+    readonly [S in ApprovalStation]: readonly ApprovalMember[];
+};
+/** What a station does with a mismatch: refuse with the row still pending (before the claim), reopen it for the
+ *  original tool, or veto the call (not run, approval spent). */
+export type ApprovalDisposition = "refuse_pending" | "reopen" | "veto";
+export interface ApprovalMismatch {
+    readonly member: ApprovalMember;
+    readonly disposition: ApprovalDisposition;
+    /** The machine word: the reopen codes, `resume.target_moved` on a moved face or target (the vetoed call's
+     *  `tool_end.errorCode`); absent on a grants veto. */
+    readonly code?: "resume.tool_unavailable" | "resume.tool_contract_mismatch" | "resume.target_moved" | "checkpoint.invalid_outcome";
+    readonly message: string;
+}
+/** What the station holds of the live call. */
+export interface LiveApprovalObject {
+    /** session / execution: the live roster row the leg would run the call as — `undefined` when the tool is not mounted. */
+    readonly tool?: ToolRosterEntry | undefined;
+    /** claim / execution: the bytes the station judges, the skills this resume serves and the Skill tool's wire name. */
+    readonly args?: unknown;
+    readonly skills?: readonly SkillGrantSource[];
+    readonly skillToolName?: string;
+    /** execution: the reading of the bytes that will run, taken at this station (`undefined`: none could be taken). */
+    readonly targetReading?: CallTargetReading | undefined;
+    /** execution: the bytes the decision rewrote the call to, as the tool reads them; absent when it rewrote nothing. When
+     *  the row's binding does not cover them ({@link licenseCovers}, the one judge of "are these the approved bytes") the
+     *  person approved bytes whose target the row never recorded, and the targets member is not judged. */
+    readonly decided?: unknown;
+}
+/**
+ * THE judge of a parked approval at one station: `"match"`, or the first member the table names for the station that
+ * the live call does not match, with its disposition. Absence is read per member: a tool member with no identity
+ * binds the name alone, and one with SOME identity members is a replacement (never a pre-identity row); a grants
+ * member is judged whenever the call would activate a skill (a row with no digest cannot cover one); a targets member
+ * is judged unless the decision rewrote the bytes to ones the row's binding does not cover, and one that is not a whole
+ * role → location record is damage.
+ */
+export declare function judgeApprovalObject(row: ParkedApproval, live: LiveApprovalObject, station: ApprovalStation): "match" | ApprovalMismatch;
+export {};