@sema-agent/core 7.53.0 → 7.54.0

package/dist/core/ask-origin.d.ts

@@ -113,8 +113,8 @@ export interface AskOriginFacts {
     /** Which of the gate's OWN post-fold stations minted the standing ask, if one did — again the gate's
      *  record of its own layer (a station replaces an `allow` wholesale, so at most one fires per pass),
      *  never a read-back of `decisionReason: "safety"` off a decision a policy could have composed. `unstated` is
-     *  the last station: the mode's answer for a call to a tool that states no permission of its own when no layer
-     *  stated the allow — its origin is `policy` (no tighten word), its class `unstated`. */
+     *  the last station: the mode's answer for a call to a tool that states no permission of its own when no answer
+     *  covers the fold's allow — its origin is `policy` (no tighten word), its class `unstated`. */
     readonly tightened: "shell_gate" | "safety" | "unstated" | undefined;
     /** The MANDATE mark inputs of this call — the tool SEAT's marks plus the gate's own per-call records
      *  ({@link MandateMarks}), read from the same two places the lane's own derivation reads them. The
@@ -191,19 +191,15 @@ export type RuleOffersAbsence = (typeof RULE_OFFERS_ABSENCES)[number];
  * the reason is that a RULE is already speaking, not that the question is beyond rules, and a surface
  * that auto-answers by posture is not crossing a mandate when it answers one.
  *
- * FOUR named readings of the one pass, because four callers need four different things and taking
- * the wrong one is how this boundary drifts:
+ * THREE named readings of the one pass, because three callers need three different things and taking
+ * the wrong one is how this boundary drifts. None is the ENFORCEMENT reading: whether an allow rule clears the ask is the
+ * class row's `ruleMayClear` ({@link classifyAsk} — every door below is a class there), read once by the gate's allow layer.
  *  · `word` — the DISCLOSED reason ({@link RuleOffersAbsence}), first door wins, in the display order the card has always
  *    used (governance, the outranked allow, the hook, the ask rule, the two ancestor doors, then the marks). Display
  *    only. A structural door the offer factory owns (no lane wired, a tool it does not speak for, a
  *    task that cannot hold a rule) is decided BEFORE this and is deliberately silent;
  *  · `mandated` — the FACT the ask carries as its own member. Read off the whole mandate set, so which
  *    door is DISPLAYED cannot change it: an ask that is both outranked and mandated is mandated;
- *  · `ruleMayClear` — the ENFORCEMENT reading the gate's clearing arms take. It is `mandated` plus the
- *    person's explicit `ask` rule, and deliberately NOT `word !== undefined`: `allowRuleShadowed`
- *    is an ACCOUNT of a refusal that already happened, display-only by contract, and reading it as a
- *    blocker would let a policy forwarding that metadata refuse a call nothing is blocking. A
- *    display word is never an authority;
  *  · `mandate` — WHICH table word the bit stands on, only when the MARKS family is its whole reason (no
  *    governance, hook or ancestor door, and no bit stamped without a word); absent, the bit's reason is
  *    not one word.
@@ -211,7 +207,6 @@ export type RuleOffersAbsence = (typeof RULE_OFFERS_ABSENCES)[number];
 export declare function ruleClearanceOf(ask: RuleClearanceFacts | undefined, marks: Omit<MandateMarks, "probeMandated">): {
     word?: Exclude<RuleOffersAbsence, "lane_cannot_speak">;
     mandated: boolean;
-    ruleMayClear: boolean;
     mandate?: PersistedRuleMandate;
 };
 /** The facts one ask carries about whether a rule could clear it — the members {@link ruleClearanceOf}
@@ -235,6 +230,8 @@ export interface RuleClearanceFacts {
     /** The engine-stamped probe mandate (the reversibility probe declared this call's demotion
      *  structural — for the built-in shell probe, a read outside the session's allowed directories). */
     probeMandated?: boolean;
+    /** The ask stands on the call's cross-boundary obligation (see {@link import("./tool-policy.js").PermissionResult}). */
+    crossBoundaryMandated?: boolean;
     /** An ancestor's approver answered "unavailable" for this call, or a durable mandate was floated here. */
     inheritedUnresolved?: boolean;
     /** The ask is being resolved at an ANCESTOR's frozen approver (the three inherited-lane mint sites
@@ -309,8 +306,11 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  *    re-authorizes the agent, so the question is a property of the TARGET, not of anyone's hesitation.
  *  - `target_unresolved` — the reading of a written target could not say where it leads on disk:
  *    `probe_unanswered`'s doctrine one layer over.
+ *  - `cross_boundary_taint` — the call's cross-boundary obligation is a person's confirmation (an org-side write from a tree
+ *    that executes on a device of a multi-tenant deployment, or a device-bound call after an off-target read): a fact of
+ *    the tree, not of the tool; read off the ask's own `crossBoundaryMandated` ({@link ruleClearanceOf}).
  */
-export declare const PERSISTED_RULE_MANDATES: readonly ["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved"];
+export declare const PERSISTED_RULE_MANDATES: readonly ["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved", "cross_boundary_taint"];
 export type PersistedRuleMandate = (typeof PERSISTED_RULE_MANDATES)[number];
 /** Membership test for {@link PersistedRuleMandate} — the screen a row reader applies to a stored word. */
 export declare function isPersistedRuleMandate(v: unknown): v is PersistedRuleMandate;
@@ -323,6 +323,7 @@ declare const MANDATE_DISCLOSURE: {
     readonly tool_marks: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)";
     readonly write_protection: "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule";
     readonly target_unresolved: "where this write leads on disk could not be determined (a link on the way could not be examined, or the environment could not resolve the target), so whether it lands on a guarded path is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can";
+    readonly cross_boundary_taint: "this run executes on a device outside the deployment's trust boundary and the deployment is multi-tenant, so an org-side write — or, after an off-target read, a call bound for the device — is confirmed by the deployment's approver for this call: no standing allow rule and no automatic lane answers for it, and an allow the configuration gives (a blanket seat or a policy's answer) is refused";
 };
 /** The fence over the disclosure table: `never` while every word has a row. */
 export type DisclosureTableCoversEveryMandate = AssertAllKeysHandled<Exclude<PersistedRuleMandate, keyof typeof MANDATE_DISCLOSURE>>;
@@ -331,10 +332,9 @@ export type DisclosureTableCoversEveryMandate = AssertAllKeysHandled<Exclude<Per
 export declare function mandateDisclosureOf(mandate: PersistedRuleMandate | undefined): string;
 /**
  * The mandate provenance of one call, judged from the SAME mark inputs the gate is driven with —
- * the single source for "could a persisted allow rule clear this ask?". Allow rules silence the
- * classifier's questions, never a mandated one, and this predicate is the mandated-family half of
- * that boundary (the real-approval/governance half rides the decision's own `requiresRealApproval`
- * bit, which the org layer stamps):
+ * the WORD a mandated ask discloses for its marks (the class derivation reads the same marks as classes,
+ * and the allow layer reads the classes). Allow rules silence the classifier's questions, never a
+ * mandated one; this is the mark family's word for that boundary:
  *  · `probeMandated` — this CALL's own reversibility probe declared its demotion STRUCTURAL
  *    (`"probe_mandate"`), judged FIRST because it is the only per-call member here: the three below
  *    are properties of the TOOL and are true of every call on the seat, so a mandate that is true of
@@ -355,10 +355,11 @@ export declare function mandateDisclosureOf(mandate: PersistedRuleMandate | unde
  * in {@link irreversibilityMandateOf} which {@link safetyAxisOf} shares: such a write is not an irreversible action, and
  * its park stays budgetable.
  *
- * Two consumers, one derivation: the gate's silencing arm (a matching rule is disclosed as outranked
- * instead of clearing the ask) and the runner's suggestion factory (a mandated ask offers no
- * "stop asking me this" option — a rule minted from it would never clear it). A drift between the
- * two would let a card offer a rule the lane then refuses to honor. The per-call member reaches both
+ * Two consumers, one derivation: the ask's stamped `mandated` / `mandate` members and the runner's suggestion factory (a
+ * mandated ask offers no "stop asking me this" option — a rule minted from it would never clear it). Every word here is also a
+ * class the allow layer reads, so an ask this derivation mandates is never cleared by a rule; the converse does not hold — a
+ * class with no word here (a caller policy's own guard on an ask without the real-approval bit) leaves the ask unmandated, and its
+ * card can offer a rule the allow layer then discloses as outranked. The per-call member reaches both
  * the same way every other per-call fact does: the gate stamps it on the surviving ask, the
  * synchronous sites read it off the decision they spread, and the park leg threads its own parameter.
  */
@@ -465,8 +466,10 @@ export type ToolMarkSource = "deployment" | "mcp_annotation" | "a2a_default";
  * `requires_user_interaction` is the SERVER's declaration on the called tool (`_meta["anthropic/requiresUserInteraction"] === true`): a
  * permission question, unlike `content_question` (the reserved question tool's content-routing signal) — it carries that class's arbitration
  * row cell by cell, because the reference implementation judges the declaration ahead of its allow-rule lookup and its bypass release.
+ * `cross_boundary` is an ask carrying `crossBoundaryMandated` (the gate's cross-boundary station mints it with the real-approval bit; the
+ * decision receipt adds the bit to a policy's or hook's own): no rule, classifier, sandbox or mode answers it.
  * `unstated` is the mode's answer for a call nobody stated: a tool whose permission seat is `passthrough` (it states no
- * permission of its own — a remote peer's tool) reached the end of the fold with an allow no layer stated.
+ * permission of its own — a remote peer's tool) reached the end of the fold with an allow no answer covers.
  * `classifier_no_ruling` is a classifier station's question to a person because the auto-mode classification did not rule
  * (`classifierNoRuling` — it could not run, or replied with no verdict): the denial-limit fallback's row (only a person
  * answers it; the classifier is never asked again).
@@ -480,7 +483,7 @@ export type ToolMarkSource = "deployment" | "mcp_annotation" | "a2a_default";
  * `rule_unreadable` is a rule that may govern the call and cannot be read for it: the organization's snapshot, a partition of
  * the person's store, or this call against a deny / ask row (the lexer's word, a content row, the read station's rows).
  */
-export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "dangerous_delete", "unverifiable_delete", "unverifiable_shell_text", "transcript_write", "org_rule", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "operator_forced", "shell_floor", "target_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
+export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "dangerous_delete", "unverifiable_delete", "unverifiable_shell_text", "transcript_write", "org_rule", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "cross_boundary", "operator_forced", "shell_floor", "target_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
 export type AskClass = (typeof ASK_CLASSES)[number];
 /** Membership test for {@link AskClass} — the word crosses the wire on `tool_end.gate.disposition`. */
 export declare function isAskClass(v: unknown): v is AskClass;
@@ -504,7 +507,8 @@ export interface ModeArbitrationRow {
  * The mode × class table. `bypassImmune` is the one new column (nothing said it before); the classifier and
  * sandbox columns are the fold of the two former per-word lane tables (only `probe` moved: the classifier may
  * now answer it — the read boundary's unestablishable spelling is fed to it as a deny-table row instead), and
- * `ruleMayClear` restates {@link ruleClearanceOf}'s conclusion per class (a real-approval bit is never rule-clearable).
+ * `ruleMayClear` is the allow layer's ONE reading: an allow member clears a standing ask exactly when the folded row says so
+ * (every class a real-approval bit, a governance verdict, a hook, a mark or an ask rule brings says no).
  * `probe`'s `classifierEligible` is the OPEN read face's reading: a narrowed (`roots`) face withholds the classifier from the class,
  * folded where the ask's row is ({@link foldArbitrationRow}).
  * `mode` is the permission mode's OWN question (`plan`'s two sentences, `decisionReason: "mode"`): the reference
@@ -610,6 +614,13 @@ export declare const MODE_ARBITRATION: {
         readonly ruleMayClear: false;
         readonly hookAskFloor: true;
     };
+    readonly cross_boundary: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
     readonly operator_forced: {
         readonly bypassImmune: true;
         readonly classifierEligible: true;
@@ -751,6 +762,9 @@ export interface AskClassification {
     readonly classes: ReadonlySet<AskClass>;
     readonly askClass: AskClass;
     readonly row: ModeArbitrationRow;
+    /** The tool face the classification was derived on ({@link AskClassFacts.askFace}); absent ⇒ the face-less reading, the `other`
+     *  face's. The mode point and the headless remedy read the face here and nowhere else ({@link bypassImmuneOf}). */
+    readonly askFace?: AskFace;
 }
 /** The two members an ask's classification puts on the approval request and the park row: the disclosed word and
  *  the whole set, the set as an array in {@link ASK_CLASSES} order (so `classes[0] === askClass`). */
@@ -859,14 +873,16 @@ export type Arbitration = {
  * The ONE mode read point. `dontAsk` refuses every ask — one value for every class — but a hook's that no member of the
  * set floors (`hookAskFloor`: a hook's ask beside a rule's or a safety check's ask is refused, as the reference's full
  * pipeline refuses it; a hook's ask alone is the reference's forced decision, which never reaches that conversion);
- * `bypassPermissions` refuses a write whose target's reading could not say where it leads where that class stays immune
- * (every face but the shell's: a person cannot be asked — the folded row says it, {@link foldArbitrationRow}), keeps every
- * immune class and releases the rest: the shell face releases that class ({@link RELEASED_ON_SHELL_FACE}), the reference
- * implementation's answer for a command whose written target could not be resolved;
+ * `bypassPermissions` refuses a write whose target's reading could not say where it leads on a face where THAT class stays
+ * immune (every face but the shell's: a person cannot be asked — the class's own reading on the face the classification records,
+ * {@link bypassImmuneOn}; another immune class beside it does not make it immune), keeps every immune class and releases the
+ * rest: the shell face releases that class ({@link RELEASED_ON_SHELL_FACE}), the reference implementation's answer for a
+ * command whose written target could not be resolved — so on that face an immune class beside it keeps the question;
  * `acceptEdits` answers an ORDINARY ask itself on a call the caller vouches is one of the mode's file commands
  * (`call.fileCommand`, `accepted`); `plan`, `default` and `auto` hand every ask on (plan's own questions were raised by
  * its write gate; the reference implementation refuses nothing at this point under plan — auto's classifier reads the
- * row at its own station). Reads the class SET and the folded row — never the disclosed word.
+ * row at its own station). Reads the class SET on the face the classification records ({@link bypassImmuneOf}) and the folded
+ * row's face-free `hookAskFloor` — never the row's `bypassImmune`, never the disclosed word.
  */
 export declare function arbitrateByMode(mode: PermissionMode, c: AskClassification, disclosure?: {
     origin?: AskOrigin;

package/dist/core/ask-origin.js

@@ -25,7 +25,7 @@ export function stampAskOrigin(decision, facts, classification) {
 }
 export const RULE_OFFERS_ABSENCES = Object.freeze(["mandated", "allow_outranked", "ask_rule_matched", "lane_cannot_speak"]);
 export function ruleClearanceOf(ask, marks) {
-    const marksWord = persistedRuleMandateOf({ ...marks, probeMandated: ask?.probeMandated === true });
+    const marksWord = ask?.crossBoundaryMandated === true ? "cross_boundary_taint" : persistedRuleMandateOf({ ...marks, probeMandated: ask?.probeMandated === true });
     const foldedDoor = (ask?.foldedAskClasses ?? []).some((c) => !MODE_ARBITRATION[c].ruleMayClear);
     const doorOutsideTable = ask?.requiresRealApproval === true || ask?.decisionReason === "hook" || ask?.decisionReason === "mode" || foldedDoor || ask?.authoredBy === "deployment" || ask?.inheritedUnresolved === true || ask?.ancestorResolved === true;
     const mandated = ask?.mandated === true || doorOutsideTable || marksWord !== undefined;
@@ -50,7 +50,7 @@ export function ruleClearanceOf(ask, marks) {
             return "mandated";
         return mandated ? "mandated" : undefined;
     })();
-    return { ...(word !== undefined ? { word } : {}), mandated, ruleMayClear: !mandated && ask?.matchedAskRule === undefined, ...(mandate !== undefined ? { mandate } : {}) };
+    return { ...(word !== undefined ? { word } : {}), mandated, ...(mandate !== undefined ? { mandate } : {}) };
 }
 export function askMandateMember(ask) {
     const { mandated, mandate } = ruleClearanceOf(ask, {});
@@ -58,8 +58,9 @@ export function askMandateMember(ask) {
     return mandated ? { mandated: true, ...(mandate !== undefined ? { mandate } : {}), ...authored } : authored;
 }
 export function ownedClearanceFacts(d) {
-    const { mandated, requiresRealApproval, decisionReason, matchedAskRule, probeMandated, authoredBy, foldedAskClasses } = d;
+    const { mandated, requiresRealApproval, decisionReason, matchedAskRule, probeMandated, crossBoundaryMandated, authoredBy, foldedAskClasses } = d;
     return {
+        ...(crossBoundaryMandated === true ? { crossBoundaryMandated } : {}),
         ...(mandated === true ? { mandated } : {}),
         ...(Array.isArray(foldedAskClasses) && foldedAskClasses.length > 0 ? { foldedAskClasses: [...foldedAskClasses] } : {}),
         ...(authoredBy === "deployment" ? { authoredBy } : {}),
@@ -106,7 +107,7 @@ export const ORIGIN_IMPLIES_REAL_APPROVAL = {
     safety_tighten: false,
     policy: false,
 };
-export const PERSISTED_RULE_MANDATES = Object.freeze(["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved"]);
+export const PERSISTED_RULE_MANDATES = Object.freeze(["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved", "cross_boundary_taint"]);
 const PERSISTED_RULE_MANDATE_SET = new Set(PERSISTED_RULE_MANDATES);
 export function isPersistedRuleMandate(v) {
     return PERSISTED_RULE_MANDATE_SET.has(v);
@@ -118,6 +119,7 @@ const MANDATE_DISCLOSURE = {
     tool_marks: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)",
     write_protection: "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule",
     target_unresolved: "where this write leads on disk could not be determined (a link on the way could not be examined, or the environment could not resolve the target), so whether it lands on a guarded path is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can",
+    cross_boundary_taint: "this run executes on a device outside the deployment's trust boundary and the deployment is multi-tenant, so an org-side write — or, after an off-target read, a call bound for the device — is confirmed by the deployment's approver for this call: no standing allow rule and no automatic lane answers for it, and an allow the configuration gives (a blanket seat or a policy's answer) is refused",
 };
 export function mandateDisclosureOf(mandate) {
     return mandate === undefined ? "an explicit ask rule matched this call (a person's or the deployment's ask-me-each-time outranks a standing allow rule)" : MANDATE_DISCLOSURE[mandate];
@@ -183,6 +185,7 @@ export const ASK_CLASSES = Object.freeze([
     "denial_limit_fallback",
     "classifier_no_ruling",
     "requires_user_interaction",
+    "cross_boundary",
     "operator_forced",
     "shell_floor",
     "target_unresolved",
@@ -215,6 +218,7 @@ export const MODE_ARBITRATION = {
     denial_limit_fallback: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     classifier_no_ruling: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     requires_user_interaction: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
+    cross_boundary: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     operator_forced: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
     shell_floor: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
     target_unresolved: { bypassImmune: true, classifierEligible: false, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: true },
@@ -236,8 +240,11 @@ const RELEASED_ON_SHELL_FACE = new Set(["target_unresolved"]);
 function bypassImmuneOn(c, face) {
     return MODE_ARBITRATION[c].bypassImmune && !(face === "shell" && RELEASED_ON_SHELL_FACE.has(c));
 }
+function bypassImmuneOf(c) {
+    return [...c.classes].some((k) => bypassImmuneOn(k, c.askFace));
+}
 const CLASSIFIER_WITHHELD_ON_ROOTS = new Set(["probe"]);
-export const RRA_EXPLAINERS = new Set(["dangerous_delete", "unverifiable_delete", "unverifiable_shell_text", "transcript_write", "org_rule", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
+export const RRA_EXPLAINERS = new Set(["dangerous_delete", "unverifiable_delete", "unverifiable_shell_text", "transcript_write", "org_rule", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction", "cross_boundary"]);
 const RELEASABLE_BY_FACE = Object.freeze({
     shell: Object.freeze(ASK_CLASSES.filter((c) => !bypassImmuneOn(c, "shell"))),
     other: Object.freeze(ASK_CLASSES.filter((c) => !bypassImmuneOn(c, "other"))),
@@ -280,6 +287,8 @@ export function decisionAskClassesOf(d) {
         out.add("operator_forced");
     if (d.probeMandated === true)
         out.add("probe");
+    if (d.crossBoundaryMandated === true)
+        out.add("cross_boundary");
     if (d.decisionReason === "hook")
         out.add("hook");
     if (d.decisionReason === "mode")
@@ -323,7 +332,7 @@ export function classifyAsk(d, facts) {
         classes.add("requires_user_interaction");
     if (marks.shellGated === true && marks.irreversibility === "always")
         classes.add("shell_floor");
-    const toolMarked = marks.shellGated !== true && (marks.egress === true || marks.irreversibility === "always" || marks.irreversibility === "maybe");
+    const toolMarked = marks.egress === true || (marks.shellGated !== true && (marks.irreversibility === "always" || marks.irreversibility === "maybe"));
     if (toolMarked) {
         const sources = facts.toolMarkSources;
         if (sources === undefined || sources.size === 0 || sources.has("deployment"))
@@ -352,7 +361,7 @@ export function classifyAsk(d, facts) {
     if (classes.size === 0)
         classes.add("ordinary");
     const askClass = ASK_CLASSES.find((c) => classes.has(c));
-    return { classes, askClass, row: foldArbitrationRow(classes, facts.readFace, facts.askFace) };
+    return { classes, askClass, row: foldArbitrationRow(classes, facts.readFace, facts.askFace), ...(facts.askFace !== undefined ? { askFace: facts.askFace } : {}) };
 }
 export function headlessDenialMessage(toolName, askMessage) {
     return `Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session (nobody can be asked to approve "${toolName}" in this run — headless auto-deny). The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative. What was requested: ${askMessage}`;
@@ -366,12 +375,12 @@ export function headlessApprovalRemedy(input) {
     const c = input.classification;
     if (input.mode === "acceptEdits" && input.unplacedOptions !== undefined && (c === undefined || (c.classes.size === 1 && c.classes.has("ordinary"))))
         return `${fileCommandOptionsSentence(input.unplacedOptions.program)} Spell the ${input.unplacedOptions.program} without option words for the mode to answer it, or ${approver}`;
-    if (c?.row.bypassImmune === true)
+    if (c !== undefined && bypassImmuneOf(c))
         return `no permission mode releases this ask (${c.askClass}): ${approver}, or change the call`;
     if (input.mode === "plan" && c?.classes.has("mode") === true)
         return `the plan permission mode asks before every write and every call to a tool the engine does not define that is not read-only — leave plan mode (\`setPermissionMode\` to another mode, or approve the plan) to run it, or ${approver}`;
     if (c !== undefined && c.classes.size === 1 && c.classes.has("unstated"))
-        return `no rule, policy or hook granted this tool, and it states no permission of its own — grant it with an allow rule (a permission rule \`allow\` for its name, or an allow-list entry), run with \`permissionMode: "bypassPermissions"\`, or ${approver}`;
+        return `no allow entry, stored allow rule or hook granted this tool, and it states no permission of its own — grant it with an allow entry for its name (\`RunnerDeps.allowedTools\` / \`TaskSpec.allowedTools\`), run with \`permissionMode: "bypassPermissions"\`, or ${approver}`;
     const onlyOrdinary = c === undefined || (c.classes.size === 1 && c.classes.has("ordinary"));
     if (input.coveredWrite && onlyOrdinary) {
         if (input.mode === "acceptEdits")
@@ -391,9 +400,9 @@ export function arbitrateByMode(mode, c, disclosure, call) {
         case "dontAsk":
             return has("hook") && !c.row.hookAskFloor ? { kind: "ask" } : { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
         case "bypassPermissions":
-            if (has("target_unresolved") && c.row.bypassImmune)
+            if (has("target_unresolved") && bypassImmuneOn("target_unresolved", c.askFace))
                 return { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
-            if (c.row.bypassImmune)
+            if (bypassImmuneOf(c))
                 return { kind: "ask" };
             const reason = [...MODE_RELEASE_REASON_SET].find((r) => has(r));
             return {

package/dist/core/ask-question.d.ts

@@ -154,7 +154,6 @@ export type QuestionOutcomeReading =
  * meant to withhold. Neither guess is safe, so neither is made.
  */
 export declare function classifyQuestionOutcome(outcome: OnQuestionOutcome): QuestionOutcomeReading;
-export declare function canonicalizeCapturedPlainData(node: unknown, seen?: WeakSet<object>): boolean;
 /**
  * Narrow an {@link OnQuestionOutcome} to its no-interaction arm — the ONLY value that licenses
  * re-routing a question to a later decider, so it is read strictly (the discriminant must be present

package/dist/core/ask-question.js

@@ -1,6 +1,6 @@
 import { Type } from "typebox";
 import { uuidv7 } from "../engine/session/uuid.js";
-import { boundInputHashOf } from "./canonical-json.js";
+import { boundInputHashOf, capturedJsonOf } from "./canonical-json.js";
 import { defineTool, errorResult } from "./tools.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";
 import { toolFace } from "./tool-catalog-entries.js";
@@ -25,73 +25,10 @@ export function classifyQuestionOutcome(outcome) {
         return { shape: "unavailable" };
     if (!carriesAnswers)
         return { shape: "contradictory" };
-    let captured;
-    try {
-        captured = structuredClone(answers);
-    }
-    catch {
+    const captured = capturedJsonOf(answers, "list");
+    if (!captured.ok)
         return { shape: "contradictory" };
-    }
-    if (!isCanonicalAnswerTree(captured))
-        return { shape: "contradictory" };
-    return { shape: "answered", answer: { answers: captured } };
-}
-function isCanonicalAnswerTree(answers) {
-    return canonicalizeCapturedPlainData(answers);
-}
-function isUnknownArray(v) {
-    return Array.isArray(v);
-}
-export function canonicalizeCapturedPlainData(node, seen = new WeakSet()) {
-    if (node === null)
-        return true;
-    switch (typeof node) {
-        case "string":
-        case "boolean":
-            return true;
-        case "number":
-            return Number.isFinite(node);
-        case "object":
-            break;
-        default:
-            return false;
-    }
-    const obj = node;
-    if (seen.has(obj))
-        return false;
-    seen.add(obj);
-    if (isUnknownArray(obj)) {
-        const arr = obj;
-        for (let i = 0; i < arr.length; i++) {
-            if (!Object.prototype.hasOwnProperty.call(arr, i))
-                return false;
-            if (arr[i] === undefined)
-                return false;
-            if (Object.is(arr[i], -0))
-                arr[i] = 0;
-            if (!canonicalizeCapturedPlainData(arr[i], seen))
-                return false;
-        }
-        if (Object.keys(arr).length !== arr.length)
-            return false;
-    }
-    else {
-        const proto = Object.getPrototypeOf(obj);
-        if (proto !== Object.prototype && proto !== null)
-            return false;
-        const rec = obj;
-        for (const key of Object.keys(rec)) {
-            if (rec[key] === undefined) {
-                delete rec[key];
-                continue;
-            }
-            if (Object.is(rec[key], -0))
-                rec[key] = 0;
-            if (!canonicalizeCapturedPlainData(rec[key], seen))
-                return false;
-        }
-    }
-    return true;
+    return { shape: "answered", answer: { answers: captured.value } };
 }
 export function isQuestionUnavailable(outcome) {
     return classifyQuestionOutcome(outcome).shape === "unavailable";

package/dist/core/ask-unresolvable-notice.d.ts

@@ -48,8 +48,9 @@ export interface AskUnresolvableFacts {
      *  did not take the call — it declined or failed; `false`: no park lane at all, the usual shape). */
     readonly parkLaneExisted: boolean;
     /** Present for the causes that say nobody could be asked ({@link askUnresolvableRemedySeat}): the caller-side change that
-     *  would have let the call run, as the gate minted it for the refusal's tool text (`headlessApprovalRemedy`, ask-origin.ts)
-     *  — carried verbatim, never re-composed here. */
+     *  would have let the call run, as the gate minted it for the refusal's tool text (`headlessApprovalRemedy`, ask-origin.ts;
+     *  for arguments no approval can be bound to, the binding's own sentence, which is that text — the remedy's approver half would
+     *  not let them run) — carried verbatim, never re-composed here. */
     readonly remedy?: string;
 }
 /**

package/dist/core/auto-compaction.d.ts

@@ -1,11 +1,12 @@
 import { type AgentMessage, type CompactionSettings, type Session, type ThinkingLevel } from "../internal/harness.js";
-import type { Message, Model, Tool } from "../internal/llm.js";
+import { type Message, type Model, type Tool } from "../internal/llm.js";
 import type { ContextWindowOverlay } from "./context-settings.js";
 import type { PostCompactContext, PreCompactContext, PreCompactResult } from "./hooks.js";
 import type { TraceEvent } from "./trace.js";
 import type { Brain } from "./types.js";
 import type { TaskEvent, TaskEventIdentity } from "./task-event.js";
 import type { CompactionEffect } from "./frame-settlement.js";
+import type { MintedAttachmentFrame } from "./user-attachment.js";
 /**
  * Default summarization focus, applied when a task does not provide `compaction.instructions`.
  * Addresses the common fidelity failure where summaries drop specific facts.
@@ -113,6 +114,20 @@ export interface CompactionPassStart {
     /** Engine clock, epoch ms, at the commit. */
     readonly startedAt: number;
 }
+/** What a landed compaction asks its restore for ({@link MaybeCompactOptions.workingFileAttachments}). */
+export interface CompactionRestoreAsk {
+    /** The files to re-read, most recent first — already without the ones the context the summary leaves still shows. */
+    readonly candidates: readonly string[];
+    readonly maxFiles: number;
+    /** What one file may deliver, in its own text (before the Read's line numbers — the unit `maxCharsPerFile` counts),
+     *  and all of them together, in the file contents the frames send (line numbers included — the unit of the
+     *  window's share); an image costs the engine estimate's fixed weight × `charsPerToken` in both. */
+    readonly perFileChars: number;
+    readonly totalChars: number;
+    readonly charsPerToken: number;
+    /** The reads the context the summary leaves still shows (canonical keys) — the restore dedups against them. */
+    readonly preserveKeys: readonly string[];
+}
 export interface MaybeCompactOptions {
     /** Disclosure channel for CONTAINED host-callback failures in this scope (the RB-463
      *  isolation primitive's bounded first-failure per site). Absent ⇒ failures are counted only. */
@@ -279,31 +294,26 @@ export interface MaybeCompactOptions {
      */
     forceUnderThreshold?: boolean;
     /**
-     * Working-file attachments (LONGRUN-2, CC-compact parity review 2026-06-12): after a successful
-     * summary, re-read up to `maxFiles` of the files the summarized region MODIFIED (from
-     * CompactionDetails.modifiedFiles) and append their current on-disk contents to the summary text.
-     * Why: LONGRUN-2 measured the model spending ≈2.3 extra read calls per compaction re-fetching
-     * files it had just lost — each one a full request round-trip at post-compaction context size.
-     * CC ships the same idea ("attachments", ≤5 files × ~5k tokens). Bounded: per-file char cap plus
-     * a total cap that self-scales to ~15% of the model window, so small windows never drown in
-     * attachments; the §25.2 freedTokens measurement naturally accounts for the added mass (the
-     * anti-thrash floor stays truthful). Reader failures skip the file (best-effort, never fails the
-     * compaction). Absent (default) = current behavior, paths-only.
-     * Pick order (design/71 P2-① resolved the LONGRUN-2b limitation): `maxFiles` picks the most
-     * RECENTLY touched files first (`CompactionDetails.modifiedFilesByRecency`, recency threaded
-     * through the engine fileOps accumulator); alphabetical `modifiedFiles` remains the fallback for
-     * details persisted before the field existed.
+     * The post-compaction restore: after a summary lands, re-read up to `maxFiles`
+     * of the files the conversation had read (or, without read tracking, modified) that the context the summary leaves
+     * no longer shows, and append each as an attachment frame — its own engine-note message after the compaction entry
+     * (summary, kept tail, restored files: the reference's post-compact order, cli296.js:249517 `hookResults`). Why: without it the model spends ≈2.3 extra read round-trips per
+     * compaction re-fetching what it just lost (LONGRUN-2). Bounded: a per-file cap in the file's own characters and a
+     * total, in the file contents the frames send (line numbers included), that self-scales to ~15% of the window; a
+     * file over either is a frame that names it and says it is too large, never part of its contents. The post measurement counts the frames, so the anti-thrash floor stays truthful. Absent ⇒ no restore.
+     * Pick order: most recently READ first (`recentlyReadFiles`), else most recently modified
+     * (`CompactionDetails.modifiedFilesByRecency`), else the alphabetical `modifiedFiles` of older details.
      */
     workingFileAttachments?: {
-        /** Read a task workspace file; null/throw = skip it. Wired by the Runner from the task's ExecutionEnv. */
-        readFile: (path: string) => Promise<string | null | {
-            withheld: {
-                pattern: string;
-            };
-        }>;
-        /** Max modified files to attach. Default 3. */
+        /** Re-read the candidates and mint their frames — the engine's one read of a file for the model, deduplicated against
+         *  the context the summary leaves (`preserveKeys` = the reads that context still shows). Side-effect free: each frame
+         *  carries the commit its delivery owes, run here once the frame is in the transcript. Wired by the Runner. */
+        restore: (ask: CompactionRestoreAsk) => Promise<ReadonlyArray<MintedAttachmentFrame>>;
+        /** A minted restore frame the transcript would not take (not delivered, nothing committed) — the operator's line. */
+        undelivered?: (label: string, reason: string) => void;
+        /** Max files to restore. Default 3. */
         maxFiles?: number;
-        /** Per-file char cap (≈4 chars/token). Default 16_000 (~4k tokens). */
+        /** Per-file cap in the file's own characters (≈4 chars/token). Default 16_000 (~4k tokens). */
         maxCharsPerFile?: number;
         /**
          * CC-parity selection set: the files the task has READ, most recent
@@ -325,9 +335,9 @@ export interface MaybeCompactOptions {
         instructionSourcePaths?: ReadonlyArray<string>;
         /**
          * `recentlyReadFiles` yields CANONICAL keys (resolveKey
-         * output — the same coordinate `ReadFileState` is keyed in), but `instructionSourcePaths` and the
-         * kept-tail scan inside `maybeCompact` (which reads raw tool-call arguments via
-         * `extractFileOpsFromMessage`) do NOT share that coordinate — a model-typed relative path and its
+         * output — the same coordinate `ReadFileState` is keyed in, and the one an attachment frame's recorded
+         * read carries), but `instructionSourcePaths` and the kept tail's Read tool calls (raw model-typed
+         * arguments) do NOT share that coordinate — a model-typed relative path and its
          * canonical form are different strings, so a plain `Set.has()` between them silently never matches
          * even for the identical file. Optional callback (present exactly when there's a containment root
          * to resolve against — i.e. hands enabled) that canonicalizes a raw path the SAME way the hands
@@ -352,29 +362,18 @@ export interface MaybeCompactOptions {
         isDedupStubResult?: (resultText: string) => boolean;
     };
     /**
-     * Fires ONCE per LANDED compaction (after `appendCompaction` committed the new baseline), with the
-     * files that were attached WHOLE (untruncated) into the summary. The Runner wires this to the read-state
-     * invalidation (`applyContextShrinkToReadFileState`): the summary just replaced the history the read-dedup
-     * stubs point at, so stale entries must drop and the re-attached content re-registers. Kept OUTSIDE
-     * `workingFileAttachments` deliberately — the invalidation is owed even when attachments are disabled
-     * (an empty array then). Best-effort: a throwing callback must not fail the landed compaction.
+     * Fires ONCE per LANDED compaction (after `appendCompaction` committed the new baseline and the restore frames were
+     * appended), immediately followed by the delivered restore frames' commits — the read state's clear and the restore's
+     * entries land together, after the baseline; a compaction that does not land touches neither. The Runner wires this to
+     * the read-state invalidation (`applyContextShrinkToReadFileState`): the summary just replaced the history the
+     * read-dedup stubs point at. Kept OUTSIDE `workingFileAttachments` deliberately — the invalidation is owed even when
+     * the restore is off. Best-effort: a throwing callback must not fail the landed compaction.
      *
-     * `preserveReadState`:
-     * canonical-coordinate paths (same shape as `normalizePath`'s output) whose read-state entry must
-     * survive the compaction's clear even though they are NOT in `attachedComplete` — every file
-     * `maybeCompact` deliberately skipped re-attaching, for EITHER exclusion reason (kept-tail-visible,
-     * or matches a declared instruction source). Without this the read-state clear (see
-     * `applyContextShrinkToReadFileState`) would wipe them anyway, defeating both the read-before-edit gate
-     * and the next read's dedup for exactly the files this optimization was supposed to leave untouched.
-     * (The instruction-source half of this was missing in an earlier revision: `instructionSources` and
-     * `seededFiles` are independent `ProjectMemoryLoad` fields — a path can be declared in the former
-     * without ever being seeded via the latter, so an instruction-excluded file the model explicitly Read
-     * has a live, non-seeded entry that needs the SAME preservation as a kept-tail one.)
+     * `preserveReadState`: canonical-coordinate paths whose entry survives the clear — every file the context the summary
+     * leaves still shows (a kept-tail read or attachment frame) or that a declared instruction source re-seeds; the restore
+     * deduplicates against the same set.
      */
-    onApplied?: (attachedComplete: ReadonlyArray<{
-        path: string;
-        content: string;
-    }>, preserveReadState?: ReadonlyArray<string>) => void;
+    onApplied?: (preserveReadState: ReadonlyArray<string>) => void;
     /**
      * #1036 — THE COMMIT-BEAT EFFECT SINK: what this compaction did to the transcript, reported
      * once, right after the `appendCompaction` that landed it. `summarizedEntryIds` = every entry id
@@ -444,7 +443,7 @@ export interface MaybeCompactOptions {
      * Inputs:
      *  - `messagesToSummarize`: the message range that would be summarized this boundary.
      *  - `previousSummary`: the prior compaction's summary (present on the UPDATE/iterative-merge path).
-     *  - `modifiedFiles`: files the summarized range modified, newest-first (same source the working-file
+     *  - `modifiedFiles`: files the summarized range modified, newest-first (same source the restore's
      *    attachments use), so a provider can decide whether the reused summary is still representative.
      */
     summaryProvider?: (input: {
@@ -621,7 +620,7 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
      *  consult → clamp dry run + 门A/门B gating (everything before the summary call). `summaryMs` = the
      *  summary LLM leg (`compact()`: serialization → clamp → completion, incl. any PTL retries) — ABSENT
      *  on a provider-reuse pass (no LLM call happened; its provider consult time sits in `prepareMs`).
-     *  `persistMs` = working-file attachments → session rewrite (`appendCompaction`) → post measurement →
+     *  `persistMs` = restore reads → session rewrite (`appendCompaction`) → restore frames → post measurement →
      *  observers. The phases tile the pass exactly: prepareMs + (summaryMs ?? 0) + persistMs ===
      *  durationMs. `ptlRetries` = reactive prompt-too-long retries burned inside this pass's summary
      *  call(s) (both split-turn legs accumulate into the one counter; 0 on provider reuse). Set only when
@@ -794,7 +793,7 @@ export declare function countSummarizedCrossSessionMessages(branch: ReadonlyArra
  *   5. (COMPACTION-LIVE-AUDIT D-1, evaluated BEFORE rule 3) a TRIM-FORCED landing with
  *      `freedTokens ≤ 0` → negative-yield: BACKOFF ON. The trim layer deceives the usage-anchored
  *      estimate down into the sawtooth trough (live: est 18807 on a ~55k session), the forced pass
- *      finds little compressible history, and summary + working-file attachments make the transcript
+ *      finds little compressible history, and summary + restore frames make the transcript
  *      LARGER (live: 18807→44609, 12679→35214). `freedTokens` is the structural pre/post delta
  *      (clamped ≥0, so ≤0 means "freed nothing") — orthogonal to rule 2/3's threshold test, which
  *      misses this shape because the bloated post (44609) can still sit UNDER the threshold (44800),