@sema-agent/core 7.53.0 → 7.54.0

package/dist/core/gate-lanes.js

@@ -1,6 +1,6 @@
 import { argsAsTheToolReads, withArgsReading } from "./effective-path-target.js";
-import { attest, attestationOf, decisionText, foldHookAsk, ownArgs, refusalOf, refuseOutOfContractDecision } from "./tool-policy.js";
-import { arbitrateByMode, classifyAsk, decisionAskClassesOf, fileCommandOptionsSentence, persistedRuleMandateOf, ruleClearanceOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
+import { attest, attestationOf, bindableArgsOf, decisionText, foldHookAsk, mergeAttestation, refusalOf, refuseOutOfContractDecision, withAttestation } from "./tool-policy.js";
+import { arbitrateByMode, classifyAsk, decisionAskClassesOf, fileCommandOptionsSentence, persistedRuleMandateOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
 import { classifierParseFailureDenyMessage, denialLimitFallbackMessage, rungDidNotRule, unarmedWindow } from "./auto-mode.js";
 import { classifierNoRulingArm, settleNoRulingAsk } from "./classifier-unavailable-arm.js";
 import { SETTLEMENT_NOBODY_JUDGED } from "./gate-outcome.js";
@@ -10,14 +10,14 @@ import { applyPersistedTightening, disclosedRuleSet } from "./persisted-rule-arm
 import { skillAllowDecision, skillRowRefusal } from "./skill-grant.js";
 import { allowRuleShadowOf } from "./allow-entry.js";
 import { CD_GIT_COMPOUND_SENTENCE, changesDirectoryBeforeGit, readOnlyShellVerdict } from "./read-only-shell.js";
-import { readShellCommand } from "./shell-lexer.js";
+import { readShellCommand } from "./shell-run-candidates.js";
 import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
 import { catalogRuleFaceOf } from "./tool-registry.js";
 import { callFaceSeat } from "./tool-roster.js";
 import { heldBy, wireOf } from "./tool-name-readings.js";
 import { asksUnstated, modeAcceptsFileCommand, permissionSeatAt, unstatedAskMessage } from "./mode-policy.js";
 import { ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, orgUnreadableClause } from "./permission-rule-org.js";
-import { exitGate, passAskFace, unownedArgsMessage } from "./runner/gate-exit.js";
+import { exitGate, passAskFace, untakenValueExit } from "./runner/gate-exit.js";
 import { readOrgRuleLane, readPersistedRuleLane } from "./rule-lane-reads.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, withGateTimeout } from "./gate-bounded-await.js";
@@ -34,9 +34,9 @@ const ruleStoreUnreadableOf = (lane) => lane?.unreadable === true && lane.reason
 export async function runGateLanes(pass) {
     const { input, toolName, toolCallId, callSignal, ledger, notifier, screening, adjudicate, resolveAsk, suspendAsk } = pass;
     const boundedAwaitDeadlineMs = createGateDeadline(input, notifier);
-    let orgRealApprovalRequired = false;
     let markedThisRound;
     let approvedWithArgs = false;
+    let editAskedOrigin;
     let carriedOwnAsk;
     const takeApprovedEdit = (read) => {
         carriedOwnAsk = read.outstanding ?? (pass.decision.action === "ask" ? pass.decision : undefined);
@@ -112,7 +112,6 @@ export async function runGateLanes(pass) {
         const answer = await readOrgRuleLane(input.orgRules, Object.freeze({ toolName, args, toolCallId, ...callFaceSeat(pass.req.face) }), input.abortSignal);
         if (answer.status === "unavailable") {
             orgEvidence = { revisionAbsent: "unavailable", ruleAbsent: "unavailable" };
-            orgRealApprovalRequired = true;
             await notifier.notifyAsync(() => input.orgRules?.onUnavailable?.({ toolName, toolCallId, message: answer.disclosures.join("; ") }), "toolGate.orgSnapshotUnavailable");
             const orgUnavailableMessage = `tool "${toolName}" needs approval: this deployment is org-governed and cannot currently adjudicate ` +
                 `against an organization policy snapshot — every allow tightens to a real approval until it can`;
@@ -142,7 +141,6 @@ export async function runGateLanes(pass) {
         if (decided.action === "deny")
             return { decision: decided, org: undefined };
         orgTightenCount += 1;
-        orgRealApprovalRequired = true;
         const orgRuleMessage = unreadable !== undefined
             ? `an organization policy rule (${rule}) may reach this call, ${orgUnreadableClause(unreadable)} — a person must decide`
             : `an organization policy rule (${rule}) requires approval for this call`;
@@ -223,19 +221,21 @@ export async function runGateLanes(pass) {
             pass.currentInput = pass.policyRewrite;
             pass.req = Object.freeze({ ...pass.req, args: pass.policyRewrite, ...(laneReq.targetReading !== undefined ? { targetReading: laneReq.targetReading } : {}) });
         }
-        const ruleMayClear = () => ruleClearanceOf(pass.decision.action === "ask" ? pass.decision : undefined, mandateMarksNow()).ruleMayClear;
-        const classMayClear = () => pass.decision.action === "ask" && classifyAsk(pass.decision, askOriginFacts(orgAnswer.org, laneAnswer)).row.ruleMayClear;
+        const originFacts = askOriginFacts(orgAnswer.org, laneAnswer);
+        if (pass.decision.action === "ask")
+            classifyStanding(pass.decision, originFacts);
+        const allowMayClear = () => pass.decision.action === "ask" && pass.askClassification?.row.ruleMayClear === true;
         let personalEvidence = { dotsAbsent: input.persistedRules === undefined ? "not_wired" : "not_adjudicated" };
         if (laneAnswer?.unreadable === true)
             personalEvidence = { dotsAbsent: "unavailable" };
         let laneCoverage;
         const questionTool = wireOf("lanes.allowLayerQuestionSkip", pass.req) === ASK_USER_QUESTION_TOOL_NAME;
-        const allowLayerMayClear = () => !orgRealApprovalRequired &&
+        const laneIsProvenance = orgAnswer.org === undefined &&
             pass.decision.action === "ask" &&
             pass.decision.requiresRealApproval !== true &&
             pass.decision.decisionReason !== "hook" &&
             !questionTool &&
-            !markedUnresolvable();
+            !originFacts.markedUnresolvable;
         const unionDotsOf = (rules) => {
             const seen = new Set();
             const union = [];
@@ -250,7 +250,7 @@ export async function runGateLanes(pass) {
             }
             return { dots: union };
         };
-        if (input.persistedRules && allowLayerMayClear()) {
+        if (input.persistedRules && laneIsProvenance) {
             const answer = laneAnswer ?? {};
             laneCoverage = answer.coverage;
             personalEvidence = answer.hit?.behavior === "ask" ? unionDotsOf(answer.hit.rules) : { dotsAbsent: answer.unreadable === true ? "unavailable" : "no_match" };
@@ -297,7 +297,7 @@ export async function runGateLanes(pass) {
                 const hit = match();
                 if (hit === undefined)
                     continue;
-                if (allowLayerMayClear() && ruleMayClear() && classMayClear()) {
+                if (allowMayClear()) {
                     pass.decision = hit.clear();
                     await hit.afterClear();
                     if (member !== "hook")
@@ -312,7 +312,6 @@ export async function runGateLanes(pass) {
             const { allowRuleShadowed: _claimed, ...standing } = pass.decision;
             pass.decision = shadows.length > 0 ? { ...standing, allowRuleShadowed: shadows } : standing;
         }
-        const originFacts = askOriginFacts(orgAnswer.org, laneAnswer);
         let noRulingMinted = false;
         const fallbackAskOf = (standingAsk, fallback, latestBlockedAction) => {
             const { classifierNoRuling: _why, ...standing } = standingAsk;
@@ -323,7 +322,7 @@ export async function runGateLanes(pass) {
             const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
             pass.decision = stampAskOrigin(stamped, originFacts, classifyStanding(stamped, originFacts));
         }
-        if (allowLayerMayClear() && pass.decision.action === "ask" && ruleMayClear() && classMayClear() && pass.probeBoundaryDeclined !== true && wireOf("lanes.readOnlyShellAllow", pass.req) === COMMAND_RULE_TOOL) {
+        if (allowMayClear() && pass.probeBoundaryDeclined !== true && wireOf("lanes.readOnlyShellAllow", pass.req) === COMMAND_RULE_TOOL) {
             const commandParam = catalogRuleFaceOf(COMMAND_RULE_TOOL)?.primaryParams[0] ?? "command";
             const args = pass.req.args;
             const command = typeof args === "object" && args !== null && !Array.isArray(args) ? args[commandParam] : undefined;
@@ -344,7 +343,7 @@ export async function runGateLanes(pass) {
             }
         }
         if (pass.toolCheckRaised !== true && pass.decision.action !== "deny") {
-            const read = await checkTool(pass.decision, pass.currentInput, orgAnswer.org, pass.policyRewrite, () => allowLayerMayClear() && ruleMayClear() && classMayClear());
+            const read = await checkTool(pass.decision, pass.currentInput, orgAnswer.org, pass.policyRewrite, allowMayClear);
             if (read?.kind === "denied")
                 refuseByExtension(read.deny);
             else if (read?.kind === "cleared")
@@ -542,20 +541,25 @@ export async function runGateLanes(pass) {
                 }
             }
             approvedWithArgs = pass.decision.action === "allow" && pass.decision.updatedInput !== undefined;
+            if (approvedWithArgs && askBeforeResolve.action === "ask")
+                editAskedOrigin = askBeforeResolve.origin;
         }
     }
     if (approvedWithArgs && pass.decision.action === "allow" && pass.decision.updatedInput !== undefined) {
         let editArgs = pass.decision.updatedInput;
         let editDenied;
         let editRewrittenSinceHuman = false;
+        let editAnswer = pass.decision;
         let unanswered;
         const refusedAtResolution = (d) => { editDenied = d; pass.deniedBy = "ask_resolution"; };
         for (let round = 0;; round++) {
-            const taken = ownArgs(editArgs);
+            const taken = bindableArgsOf(toolName, editArgs);
             if (!taken.ok) {
-                editDenied = { action: "deny", message: unownedArgsMessage(`the approved edit for "${toolName}"`, taken.reason) };
-                pass.deniedBy = "policy";
-                break;
+                const origin = attestationOf(editAnswer, { toolCallId, toolName })?.origin ?? editAskedOrigin;
+                if (origin === undefined)
+                    throw new Error(`the approved edit for "${toolName}" reached its refusal without an origin word — the origin stamp precedes every resolution`);
+                ledger.set({ settlement: { kind: "presentation_failed", who: { party: "none" }, when: Date.now() }, origin });
+                return await untakenValueExit(pass, { value: editArgs, message: taken.refusal, deniedBy: "ask_resolution" });
             }
             editArgs = argsAsTheToolReads(pass.req, taken.value);
             if (round >= 3) {
@@ -654,7 +658,8 @@ export async function runGateLanes(pass) {
                     editArgs = argsAsTheToolReads(pass.req, recheck.updatedInput);
                     editRewrittenSinceHuman = true;
                 }
-                if (editRewrittenSinceHuman && asksUnstated(recheck, permissionSeatAt(input, editArgs)?.seat, input.permissionMode?.())) {
+                const answeredRecheck = withAttestation(recheck, mergeAttestation(pass.req, attestationOf(editAnswer, pass.req), attestationOf(recheck, pass.req), "answer"));
+                if (asksUnstated(answeredRecheck, pass.req, editArgs, permissionSeatAt(input, editArgs)?.seat, input.permissionMode?.())) {
                     recheck = { action: "ask", message: permissionSeatAt(input, editArgs)?.question ?? unstatedAskMessage(toolName) };
                     pass.tightenedBy = "unstated";
                 }
@@ -690,6 +695,7 @@ export async function runGateLanes(pass) {
             if (editRead?.kind === "approved") {
                 carriedOwnAsk = editRead.outstanding ?? (editDecision.action === "ask" ? editDecision : undefined);
                 editArgs = editRead.allow.updatedInput;
+                editAnswer = editRead.allow;
                 editRewrittenSinceHuman = false;
                 continue;
             }
@@ -735,6 +741,9 @@ export async function runGateLanes(pass) {
                 break;
             }
             editArgs = rr.updatedInput;
+            editAnswer = rr;
+            if (editAskDecision.action === "ask")
+                editAskedOrigin = editAskDecision.origin;
             editRewrittenSinceHuman = false;
         }
         const rejudged = () => editDenied === undefined || editDenied === unanswered?.deny;

package/dist/core/gate-outcome.d.ts

@@ -31,13 +31,16 @@ import { type AutoModeClassifierRound, type AutoModeFallbackCause } from "./auto
  *    timer over the synchronous leg) elapsed with no answer.
  *  - `park_sla_expired` — a DURABLE park's SLA deadline passed and the host's sweep resolved it as a deny
  *    (FACET A). A store `expire`/`reap` produces no `tool_end` and therefore no settlement.
- *  - `no_approver` — headless: no approver (or no question face) is wired, or the deny posture string.
+ *  - `no_approver` — headless: no approver (or no question face) is wired, or the deny posture string (arguments no approval
+ *    can be bound to are refused there in the binding's own sentence, under this word).
  *  - `approver_unavailable` — the approver (or an ancestor's frozen approver) answered the ROUTING question
  *    "nobody reachable", and no park took the ask.
  *  - `approver_error` — the approver threw.
  *  - `approver_contract` — the approver answered outside its contract (a non-boolean verdict, an
  *    unreadable member, a timeout-settled allow, a refused attribution…).
- *  - `presentation_failed` — the args or the edit could not be safely presented/adopted (unclonable).
+ *  - `presentation_failed` — at a seat with an approver, the arguments could not be bound (`bindableArgsOf`: not a record of plain
+ *    JSON data nested at most 256 levels deep): the asked ones — nobody was asked — or a resolution's edit (the engine's resolver's
+ *    or, recorded by the gate, a host resolver's) — its yes is not used.
  *  - `blanket_allow_refused` — an allow NO PERSON JUDGED met a `requiresRealApproval` ask: a blanket
  *    `onAsk:"allow"`, or an approver's allow it reported as the deployment's policy (`settledBy: "policy"`).
  *  - `task_aborted` — the wait's abort signal ended it (the run's own end, or a turn-level interrupt).
@@ -218,7 +221,8 @@ export type SettlementRefusalTableCoversEveryKind = AssertAllKeysHandled<Exclude
  *    the ask on a durable queue instead), and the two sites that treat it as headless anyway say so at
  *    their own call, because they are the ones with no park route left.
  *  - `approver_error` / `approver_contract` / `presentation_failed` — the approver was there and the
- *    engine could not use it. A defect to report, not a deployment with nobody home.
+ *    engine could not use its answer, or could not put these arguments before it (or adopt its edit). Not a
+ *    deployment with nobody home: with no approver, such arguments are refused under `no_approver`.
  *  - `task_aborted` — the run ended; nothing is escalating anywhere.
  */
 export declare const SETTLEMENT_NOBODY_JUDGED: {

package/dist/core/governance-codes.d.ts

@@ -48,7 +48,8 @@ export declare function governanceRetryClass(code: string): GovernanceRetryClass
  * fixed the roster (`config.tool_mount_denied`), a
  * member over a roster row's wire bound (`config.tool_roster_bound` / `config.tool_name_too_long` /
  * `config.tool_contract_too_long`), a schema over the row's key bounds (`config.tool_schema_bound`), a
- * declared face or result card the schema / namespace cannot carry (`config.tool_face_invalid`), a name or
+ * declared face or result card the schema / namespace cannot carry (`config.tool_face_invalid` — also the code an MCP server entry's
+ * unreadable `toolFaces` is refused with at the task preparation door and at `materializeMcpTools`), a name or
  * alias outside the caller tool name contract — one no rule can name, or one carrying the protocol namespace separator
  * (`config.tool_name_invalid`), an egress tool declared other than
  * `write` (`config.egress_requires_write_effect` — also minted, same meaning, for a protocol tool's resolved
@@ -138,7 +139,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.read_deny_swapped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.path_view_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.credential_not_withheld", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "config.session_rules_earlier_grammar", "permission.allowed_tool_not_granted", "mods.registration_refused", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.credential_origin_mismatch", "route.response_model_mismatch", "route.tool_call_id_folded", "route.finish_reason_unknown", "route.stream_end_ignored", "route.extra_body_reserved_dropped", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "tool_result.media_refused", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable", "permission.entry_mode_clamped"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.read_deny_swapped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.path_view_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.credential_not_withheld", "config.cross_boundary_posture_undeclared", "config.cross_boundary_record_unwritten", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "config.session_rules_earlier_grammar", "permission.allowed_tool_not_granted", "mods.registration_refused", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.credential_origin_mismatch", "route.response_model_mismatch", "route.tool_call_id_folded", "route.finish_reason_unknown", "route.stream_end_ignored", "route.extra_body_reserved_dropped", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "tool_result.media_refused", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable", "permission.entry_mode_clamped"];
 /** A catalogued code (see {@link ENGINE_NOTICE_CODES}); {@link NOTICE_MINTER} says who mints it. NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */
@@ -219,6 +220,8 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "config.peer_admission_out_of_range": "operator";
     readonly "config.secret_env_scrubbed": "operator";
     readonly "config.credential_not_withheld": "operator";
+    readonly "config.cross_boundary_posture_undeclared": "operator";
+    readonly "config.cross_boundary_record_unwritten": "operator";
     readonly "peer.inbound_disposition": "user";
     readonly "peer.held_settled": "user";
     readonly "peer.idle_subscription": "user";
@@ -305,6 +308,8 @@ declare const NOTICE_MINTER_TABLE: {
     readonly "config.peer_lane_unmounted": "engine";
     readonly "config.secret_env_scrubbed": "engine";
     readonly "config.credential_not_withheld": "engine";
+    readonly "config.cross_boundary_posture_undeclared": "engine";
+    readonly "config.cross_boundary_record_unwritten": "engine";
     readonly "config.permission_mode_unavailable": "engine";
     readonly "permission.ask_released_by_mode": "engine";
     readonly "permission.read_deny_unapplied": "engine";

package/dist/core/governance-codes.js

@@ -146,6 +146,8 @@ export const ENGINE_NOTICE_CODES = Object.freeze([
     "config.peer_lane_unmounted",
     "config.secret_env_scrubbed",
     "config.credential_not_withheld",
+    "config.cross_boundary_posture_undeclared",
+    "config.cross_boundary_record_unwritten",
     "config.permission_mode_unavailable",
     "permission.ask_released_by_mode",
     "permission.read_deny_unapplied",
@@ -279,6 +281,8 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.peer_admission_out_of_range": "operator",
     "config.secret_env_scrubbed": "operator",
     "config.credential_not_withheld": "operator",
+    "config.cross_boundary_posture_undeclared": "operator",
+    "config.cross_boundary_record_unwritten": "operator",
     "peer.inbound_disposition": "user",
     "peer.held_settled": "user",
     "peer.idle_subscription": "user",
@@ -346,6 +350,8 @@ const NOTICE_MINTER_TABLE = {
     "config.peer_lane_unmounted": "engine",
     "config.secret_env_scrubbed": "engine",
     "config.credential_not_withheld": "engine",
+    "config.cross_boundary_posture_undeclared": "engine",
+    "config.cross_boundary_record_unwritten": "engine",
     "config.permission_mode_unavailable": "engine",
     "permission.ask_released_by_mode": "engine",
     "permission.read_deny_unapplied": "engine",

package/dist/core/hooks.d.ts

@@ -13,6 +13,7 @@ import type { WiringLegKind } from "./wiring-manifest.js";
 import type { PermissionSeatInputs } from "./mode-policy.js";
 import type { SkillGateSeats } from "./skill-grant.js";
 import type { AllowEntryGateSeats } from "./allow-entry.js";
+import type { CrossBoundaryGateSeat } from "./cross-boundary-taint.js";
 /**
  * The classic stations' faces and the two-phase tool gate. A deployment extends the engine through the mods bus
  * (`RunnerDeps.mods` / `TaskSpec.mods`, `src/core/mods/`): each sema station raises one `classic.*` event, and the
@@ -554,9 +555,10 @@ export interface ToolGateResult {
      *  as taken at the gate's entry, or what a hook, a policy or a person rewrote them to); re-validated by the loop. Present
      *  on every allow exit, whether or not anything rewrote (compare values to tell); absent on a block and a suspend. */
     updatedInput?: unknown;
-    /** The input this pass decided on (what a refusal refused, what an allowed call runs with) as a deep, FROZEN copy taken
-     *  at the exit — never the live args. Beside {@link gate} on both terminal exits; absent on the suspend exit. The deny
-     *  observer gets a detached, writable copy of it. */
+    /** The input this pass decided on (what a refusal refused, what an allowed call runs with) as a deep, FROZEN plain-data projection
+     *  taken at the exit — never the live args: on a refusal every member that is not data (a bigint, a Map, a Date, a class instance, a
+     *  function, an accessor, a symbol-keyed member) is a `[not recorded: …]` marker; an allow exit meets only the gate's own copy, so there
+     *  just a bigint, a cycle's closing member and containers past 256 levels are. Beside {@link gate} on both terminal exits; absent on the suspend exit. */
     finalInput?: unknown;
     /** A blocking refusal's structured details, when the refusing station minted any (the shell read station's
      *  `read_path_denied` / `readonly_out_of_root` cards): the loop attaches them to the error result it mints
@@ -611,9 +613,8 @@ export type ContentAskOutcome = {
  * happened" (no facility armed, or the closure took its sync-first decline) — that case hides nothing,
  * while this one does: the gate falls back to the synchronous approver chain either way (the
  * compensation contract — an uncommitted checkpoint is a safe fallback — is unchanged), but on a
- * headless deployment that fallback is the auto-deny whose text is "no approver is wired". True as far
- * as it goes, and the whole reason the call did not park lives somewhere else entirely (the host's
- * `onError` face). So the reason travels with the fall-through and the deny quotes it.
+ * headless deployment that fallback is the auto-deny whose text is "no approver is wired". True as far as it goes, and the whole
+ * reason the call did not park lives somewhere else entirely (the host's `onError` face). So the reason travels with the fall-through and the deny quotes it.
  */
 export interface ParkAttemptFailed {
     /** Why the park could not be minted — a sentence, already worded for a reader. */
@@ -720,7 +721,7 @@ export type PersistedRuleAnswer = PersistedRuleHit | PersistedRuleCoverage | Per
  *  signal; when the caller also supplies {@link ToolGateInput.callSignal}, the Runner's closures
  *  additionally bind their waits to that per-call signal (`AbortSignal.any` of the two), so a turn
  *  interrupt releases a pending ask instead of leaving it hanging on the run's lifetime alone. */
-export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, AllowEntryGateSeats {
+export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, AllowEntryGateSeats, CrossBoundaryGateSeat {
     /** RB-473 batch 2b — bounded disclosure for a HOST callback that throws inside this gate call's
      *  isolation scope (onHookError itself, the deny observer, the durable-park observer). The runner
      *  wires this to an `observer.notify_failed` trace event; absent = counted only (unchanged). */
@@ -1094,12 +1095,11 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
      * The deny exit nobody judged: the call's approval could not be RESOLVED (`cause` — the approver
      * answered `unavailable`, no approver is wired, or an inherited durable mandate has no park facility on
      * this leg) and no durable park took the call, so the fail-closed deny STANDS. Fired once per such call
-     * from the gate's single deny exit, after every park re-route has had its attempt, with the facts the
-     * `delegation.ask_unresolvable` notice is composed from (`ask-unresolvable-notice.ts`);
-     * `parkLaneExisted` = a park lane was armed for this run; `remedy` = the caller-side change that would have let the
-     * call run, present for the causes that say nobody could be asked (`approver_unavailable`, `no_approver_wired`).
-     * Observe-only: a throwing seat never alters the deny. Absent ⇒ the deny stands silently (a host driving the gate
-     * directly, no notice sink).
+     * from the gate's single deny exit, after every park re-route has had its attempt, with the facts the `delegation.ask_unresolvable`
+     * notice is composed from (`ask-unresolvable-notice.ts`); `parkLaneExisted` = a park lane was armed for this run; `remedy` = the
+     * caller-side change that would have let the call run, present for the causes that say nobody could be asked (`approver_unavailable`,
+     * `no_approver_wired`) — for arguments no approval can be bound to, the binding's own sentence (the remedy's approver half would not
+     * let them run). Observe-only: a throwing seat never alters the deny. Absent ⇒ the deny stands silently (no notice sink).
      */
     onAskUnresolvable?: (info: {
         toolName: string;
@@ -1311,7 +1311,7 @@ export declare function createPreToolUseScreening(input: Pick<ToolGateInput, "ev
  * structural rather than restated.
  *
  * The mapping mirrors the gate's own phase 1 decision for decision:
- *  - no opinion → `allow`, contributing nothing;
+ *  - no opinion, and an `allow` → `allow`, contributing nothing (a constraint only tightens: it clears no question);
  *  - `deny` → `deny` in the fold's own words;
  *  - `ask` → `ask`, stamped `decisionReason:"hook"` (and the mandate, when the answer set it) so every consumer that
  *    distinguishes a screening ask from a policy ask reads the same fact one level down;

package/dist/core/hooks.js

@@ -186,8 +186,7 @@ export function createPreToolUseConstraintPolicy(chain, env) {
                     ...(r.updatedInput !== undefined ? { updatedInput: r.updatedInput } : {}),
                 };
             }
-            const stated = r.action === "allow" ? { decisionReason: "hook" } : {};
-            return r.updatedInput !== undefined ? { action: "allow", updatedInput: r.updatedInput, ...stated } : { action: "allow", ...stated };
+            return r.updatedInput !== undefined ? { action: "allow", updatedInput: r.updatedInput } : { action: "allow" };
         },
     }, "hook");
     recordScreeningChain(minted, chain);

package/dist/core/locked-config.d.ts

@@ -109,7 +109,7 @@ export declare function resolveLockedKeys(config: LockedConfig | undefined): Rea
  * and a peer's `headers` and `allowSkills` are the copy's own, and a host that edits its own nested object after
  * the door (a header value, an `allowSkills.push`) reaches nothing the engine holds: the dial, a refresh and a
  * re-dial all work from this copy, on both surfaces. The axes are then judged on that copy by their own reader
- * ({@link judgeEntryToolAxes}).
+ * ({@link judgeEntryToolAxes}), and an MCP server's faces by theirs ({@link judgeEntryToolFaces}).
  *
  * There is no third outcome between "copied whole" and "refused": a value the copy cannot carry whole is a
  * declaration the engine cannot read — a Proxy at any level, an object whose prototype is neither
@@ -167,6 +167,33 @@ export declare function judgeEntryToolAxes<E extends McpServerSpec | A2aServerSp
         code: string;
     };
 };
+/**
+ * The `toolFaces` question for ONE snapshot entry of an MCP server — asked by the preparation door and by the materialization entrance exactly
+ * as {@link judgeEntryToolAxes} asks its own, so the engine reads a face declaration one way (`readToolFaces`) and the mount consumes the copy
+ * that way gave it, never the caller's object: a mistyped member, an axis word written as a face member, a member of the wrong kind or an empty
+ * tool name is a refusal here, not a protection dropped in silence or a throw at the listing. `ok: true` carries the entry with the reader's
+ * frozen copy in place of the declaration (an empty record declares nothing and leaves no key); `ok: false` carries the coded refusal
+ * (`config.tool_face_invalid`) naming the server, the tool and the member.
+ */
+export declare function judgeEntryToolFaces(copy: McpServerSpec): {
+    ok: true;
+    entry: McpServerSpec;
+} | {
+    ok: false;
+    error: Error & {
+        code: string;
+    };
+};
+/** Everything a snapshot MCP entry declares per tool, judged: its `toolAxes` ({@link judgeEntryToolAxes}), then its `toolFaces` ({@link judgeEntryToolFaces}). */
+export declare function judgeMcpEntryDeclarations(copy: McpServerSpec): {
+    ok: true;
+    entry: McpServerSpec;
+} | {
+    ok: false;
+    error: Error & {
+        code: string;
+    };
+};
 /**
  * The single preflight resolver: validate the lock declaration, refuse a spec that tries to occupy
  * a locked slot (`config.locked_key`, two-state — the whole prepare is rejected, nothing is

package/dist/core/locked-config.js

@@ -1,6 +1,7 @@
 import { types } from "node:util";
-import { DECLARATION_PATH_RULES, declarationFaultOf, declarerWord, readToolAxes, receiveDeclaration, toolAxesRefusal } from "./mcp-server-spec.js";
+import { DECLARATION_PATH_RULES, NO_DECLARATION_PATH_RULES, declarationFaultOf, declarerWord, readToolAxes, receiveDeclaration, toolAxesRefusal } from "./mcp-server-spec.js";
 import { isPlainRecord, receive } from "./mods/kernel/receive.js";
+import { readToolFaces } from "./tool-face-reader.js";
 import { CONFIG_RECEIPT_MODE } from "./own-property-receipt.js";
 import { isToolContentOrigin, TOOL_CONTENT_ORIGINS } from "./memory-engine/content-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
@@ -32,7 +33,7 @@ export function resolveLockedKeys(config) {
     return keys;
 }
 function declaredLockKeys(config) {
-    const received = receiveDeclaration(config);
+    const received = receiveDeclaration(config, NO_DECLARATION_PATH_RULES);
     if (!received.ok)
         throw lockDeclarationRefusal(memberPath(received.fault.path, "RunnerDeps.lockedConfig"), `cannot be read: ${received.fault.problem}`);
     const copy = received.value;
@@ -116,6 +117,32 @@ export function judgeEntryToolAxes(copy, at) {
     }
     return { ok: true, entry: Object.freeze((axes.toolAxes === undefined ? rest : { ...rest, toolAxes: axes.toolAxes })) };
 }
+function deepFrozen(value) {
+    if (typeof value === "object" && value !== null && !Object.isFrozen(value)) {
+        Object.freeze(value);
+        for (const member of Object.values(value))
+            deepFrozen(member);
+    }
+    return value;
+}
+function toolFacesRefusal(name, problem) {
+    return codedError("config.tool_face_invalid", `${declarerWord("mcp")} ${name} declares toolFaces the engine cannot read: ${inlineUntrusted(problem, 240)}. A per-tool face declaration is the deployment's own ` +
+        `narrowing (which argument names a tool's path, how a write is confined, which approval card and rule vocabulary the tool wears), so it is refused ` +
+        `rather than partly applied — a member dropped or a word defaulted would mount the tool without the protection its operator declared.`);
+}
+export function judgeEntryToolFaces(copy) {
+    const { toolFaces: declared, ...rest } = copy;
+    if (declared === undefined)
+        return { ok: true, entry: copy };
+    const faces = readToolFaces(declared);
+    if (!faces.ok)
+        return { ok: false, error: toolFacesRefusal(declarerNameOf(copy.name), faces.problem) };
+    return { ok: true, entry: Object.freeze((faces.faces === undefined ? rest : { ...rest, toolFaces: deepFrozen(faces.faces) })) };
+}
+export function judgeMcpEntryDeclarations(copy) {
+    const axes = judgeEntryToolAxes(copy, "mcp");
+    return axes.ok ? judgeEntryToolFaces(axes.entry) : axes;
+}
 function declaredEntriesOf(declared, at) {
     const field = at;
     const received = receive(declared, CONFIG_RECEIPT_MODE);
@@ -157,7 +184,7 @@ function snapshotAndValidateMcpEntries(declared) {
                 `than folded to a class, because folding it would let a deployment believe a declaration is in force while every ` +
                 `call keeps writing a one-way durable mark.`);
         }
-        const judged = judgeEntryToolAxes(copy, "mcp");
+        const judged = judgeMcpEntryDeclarations(copy);
         if (!judged.ok)
             throw judged.error;
         return judged.entry;

package/dist/core/lsp.d.ts

@@ -260,7 +260,7 @@ export interface LspServerManager {
      * ExecutionEnv (the SAME sandbox the agent runs in) — core passes it because a real in-env language
      * server must run inside that sandbox, and core already holds the per-task env at mount time. Supplying
      * it here means a manager can be **stateless** (it doesn't need a sessionId→env registry). It is
-     * optional/last for back-compat: a manager that resolves the env another way (e.g. a sessionId registry
+     * optional/last by contract: a manager that resolves the env another way (e.g. a sessionId registry
      * keyed off `executionEnvFactory`) may ignore it.
      */
     sessionFor(filePath: string, signal?: AbortSignal, env?: ExecutionEnv): Promise<LspSession | undefined>;