@sema-agent/core 7.53.0 → 7.54.1

package/dist/core/runner/resume-policy-outcome.d.ts

@@ -1,8 +1,8 @@
 /**
  * The resume ladder's APPROVAL-LANE capture and binding rung (E4), verbatim from
  * `Runner.resumeStream`: on a human / irreversible_ask row every deployment-supplied field of the
- * `policy_ask` decide is read exactly once into a plain twin (answer canonicalized, updatedInput cloned to the
- * JSON domain, the decision word, the refused keys, the host's decision facts and attribution, the deny note),
+ * `policy_ask` decide is read exactly once into a plain twin (answer and updatedInput by the one capture, in their
+ * JSON form, the decision word, the refused keys, the host's decision facts and attribution, the deny note),
  * then the decision-action binding (boundCallId, boundInputHash by version), the env_failed replay guard and
  * the content-ask answer binding. Synchronous; every refusal throws pre-CAS.
  */

package/dist/core/runner/resume-policy-outcome.js

@@ -1,7 +1,11 @@
-import { canonicalizeCapturedPlainData, classifyQuestionOutcome, isLiveQuestionFace } from "../ask-question.js";
+import { classifyQuestionOutcome, isLiveQuestionFace } from "../ask-question.js";
+import { capturedJsonOf } from "../canonical-json.js";
+import { bindingRefusalOf } from "../tool-policy.js";
 import { CHECKPOINT_FEATURES, CheckpointError, checkpointVersionOf, winnerFromOutcome } from "../checkpoint-store.js";
-import { sanitizeUntrustedText } from "../untrusted-text.js";
+import { isGateKind, resumeGateMatches } from "../pause-registry.js";
+import { sanitizeUntrustedText, sentinelTagRefusal } from "../untrusted-text.js";
 import { assertOutcomeText, captureHostDecision, describeSuppliedValue, pendingContentAskCallId, refuseSuppliedKeys, sameWinner, SUPPLIED_RECORD_KEY } from "./decide-continuation.js";
+import { refuseUnfitFeedback } from "./approval-feedback.js";
 const REFUSED_DECIDE_KEYS = [
     SUPPLIED_RECORD_KEY,
     ["settledBy", 'a retired key — the host supplies decision FACTS as hostDecision{decidedBy: "person" | "sla_timeout" | "policy", approver?} and core mints the settlement word from them'],
@@ -12,7 +16,8 @@ export function resumePolicyOutcome(input) {
     let suppliedAnswer;
     let redeemedAnswer;
     let plainPolicyOutcome;
-    if (cp.gate.kind === "human" || cp.gate.kind === "irreversible_ask") {
+    const storedGateKind = cp.gate.kind;
+    if (isGateKind(storedGateKind) && resumeGateMatches(storedGateKind, "policy_ask")) {
         const decide = outcome;
         suppliedAnswer = decide.answer;
         if (suppliedAnswer !== undefined) {
@@ -25,17 +30,11 @@ export function resumePolicyOutcome(input) {
         }
         const updatedInputRaw = decide.updatedInput;
         let updatedInput;
-        try {
-            updatedInput = updatedInputRaw === undefined ? undefined : structuredClone(updatedInputRaw);
-        }
-        catch {
-            throw new CheckpointError("checkpoint.invalid_outcome", "resume carried an `updatedInput` that could not be captured as plain data — refusing pre-CAS; the checkpoint stays pending");
-        }
-        if (Object.is(updatedInput, -0))
-            updatedInput = 0;
-        if (updatedInput !== undefined && !canonicalizeCapturedPlainData(updatedInput)) {
-            throw new CheckpointError("checkpoint.invalid_outcome", "resume carried an `updatedInput` outside the plain-JSON value domain (a Map/Set/Date/buffer, a sparse or expando-carrying array, a non-finite number, or a cycle) — " +
-                "such a value reads differently on the two sides of the durable store; refusing pre-CAS, the checkpoint stays pending");
+        if (updatedInputRaw !== undefined) {
+            const captured = capturedJsonOf(updatedInputRaw);
+            if (!captured.ok)
+                throw new CheckpointError("checkpoint.invalid_outcome", bindingRefusalOf(cp.pendingAction.kind === "tool_approval" ? cp.pendingAction.toolName : "the parked call", updatedInputRaw, captured.fault));
+            updatedInput = captured.value;
         }
         const decision = decide.decision;
         if (decision !== "allow" && decision !== "deny") {
@@ -45,6 +44,8 @@ export function resumePolicyOutcome(input) {
         const hostDecision = captureHostDecision(cp, decide.hostDecision, "policy_ask", { word: decision, allows: decision === "allow" });
         const reason = decide.reason;
         assertOutcomeText(reason, "reason");
+        const feedback = decide.feedback;
+        assertOutcomeText(feedback, "feedback");
         plainPolicyOutcome = {
             gate: "policy_ask",
             boundCallId: decide.boundCallId,
@@ -52,11 +53,13 @@ export function resumePolicyOutcome(input) {
             decision,
             ...(updatedInput !== undefined ? { updatedInput } : {}),
             ...(reason !== undefined ? { reason } : {}),
+            ...(feedback !== undefined ? { feedback } : {}),
             ...(redeemedAnswer !== undefined ? { answer: redeemedAnswer } : {}),
             hostDecision,
         };
+        refuseUnfitFeedback(plainPolicyOutcome);
         if (plainPolicyOutcome.decision === "deny" && plainPolicyOutcome.reason && sanitizeUntrustedText(plainPolicyOutcome.reason) !== plainPolicyOutcome.reason) {
-            throw new CheckpointError("checkpoint.invalid_outcome", "resume deny/reject reason must not contain a </system-reminder> tag");
+            throw new CheckpointError("checkpoint.invalid_outcome", sentinelTagRefusal("resume deny/reject reason"));
         }
     }
     if (plainPolicyOutcome !== undefined) {

package/dist/core/runner/resume-preflight.js

@@ -1,6 +1,6 @@
 import { CheckpointError } from "../checkpoint-store.js";
 import { MAX_TIMER_MS } from "../mods/kernel/index.js";
-import { hasDestroy } from "../remote-env.js";
+import { frozenHandleCopy, hasDestroy } from "../remote-env.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { describeSuppliedValue } from "./decide-continuation.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
@@ -63,7 +63,7 @@ export async function resumePreflight(input) {
             sessionId: cp.sessionId,
             ...(cp.state.placementRootSessionId !== undefined ? { placementRootSessionId: cp.state.placementRootSessionId } : {}),
             ...(cp.principal ? { principal: cp.principal } : {}),
-            ...(cp.state.workspaceHandle !== undefined ? { workspaceHandle: structuredClone(cp.state.workspaceHandle) } : {}),
+            ...(cp.state.workspaceHandle !== undefined ? { workspaceHandle: frozenHandleCopy(cp.state.workspaceHandle) } : {}),
             gateKind: cp.gate.kind,
         };
         const refusalTail = "; the checkpoint stays pending and the same token is redeemable once the obstacle clears";

package/dist/core/runner/resume-review-outcome.js

@@ -1,6 +1,6 @@
 import { CheckpointError } from "../checkpoint-store.js";
 import { isGateKind, PAUSE_REGISTRY, resumeGateMatches } from "../pause-registry.js";
-import { sanitizeUntrustedText } from "../untrusted-text.js";
+import { sanitizeUntrustedText, sentinelTagRefusal } from "../untrusted-text.js";
 import { assertOutcomeText, captureHostDecision, describeSuppliedValue, refuseSuppliedKeys, SUPPLIED_RECORD_KEY } from "./decide-continuation.js";
 export function resumeReviewOutcome(input) {
     const { cp, outcome, outcomeGate, wakeMessage } = input;
@@ -49,13 +49,13 @@ export function resumeReviewOutcome(input) {
     if (plainReviewOutcome !== undefined) {
         const reason = plainReviewOutcome.reason;
         if (plainReviewOutcome.decision === "reject" && reason && sanitizeUntrustedText(reason) !== reason) {
-            throw new CheckpointError("checkpoint.invalid_outcome", "resume deny/reject reason must not contain a </system-reminder> tag");
+            throw new CheckpointError("checkpoint.invalid_outcome", sentinelTagRefusal("resume deny/reject reason"));
         }
         const capturedPlan = plainReviewOutcome.gate === "plan_review" ? plainReviewOutcome.editedPlan : undefined;
         if (plainReviewOutcome.decision === "edit" &&
             capturedPlan &&
             sanitizeUntrustedText(capturedPlan) !== capturedPlan) {
-            throw new CheckpointError("checkpoint.invalid_outcome", "resume editedPlan must not contain a </system-reminder> tag");
+            throw new CheckpointError("checkpoint.invalid_outcome", sentinelTagRefusal("resume editedPlan"));
         }
         if (cp.reopenReason === "env_failed") {
             const winner = cp.resolvedOutcome;

package/dist/core/runner/run-leg.js

@@ -12,15 +12,16 @@ import { readToolCallArguments, uuidv7 } from "../../internal/harness.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { applyPersistedTightening, disclosedRuleSet } from "../persisted-rule-arms.js";
 import { argsReadBy, stampArgsReading } from "../effective-path-target.js";
-import { parkedSkillApprovalRefusal, skillRowRefusal } from "../skill-grant.js";
+import { skillRowRefusal } from "../skill-grant.js";
+import { judgeApprovalObject } from "../approval-object.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { computeCostMicroUsd } from "../pricing.js";
 import { mintSystemReminder } from "../reminder-mint.js";
 import { hasDestroy } from "../remote-env.js";
-import { advertisedWritableRootsSeat, attestationOf, exemptRootsSeat, humanRefusalSentence, ownedReading, policyCannotAnswer, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, attestationOf, exemptRootsSeat, humanRefusalSentence, licenseCovers, ownedReading, policyCannotAnswer, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
 import { failedJudgmentDeny } from "./policy-throw.js";
 import { pathDenialCardOf } from "../../tools/fs/safety.js";
-import { callFaceSeat, judgeParkedToolIdentity, parkedRowLiveFace, rosterEntryNamed } from "../tool-roster.js";
+import { callFaceSeat, parkedRowLiveFace, rosterEntryNamed } from "../tool-roster.js";
 import { deliverEngineNotice } from "../types.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
 import { errorCodeOf } from "./terminal-account.js";
@@ -28,6 +29,7 @@ import { DEFAULT_PRECALL_OUTPUT_TOKENS, platformLimitTerminal } from "./clock-an
 import { legContextOverlayOption } from "./compaction-call-options.js";
 import { mintOutputStyleReminder, owedPostureText } from "./compaction-restate.js";
 import { deepJsonEqual, resumeContinuation } from "./decide-continuation.js";
+import { approvalWordsOf, owedApprovalWords, withApprovalWords } from "./approval-feedback.js";
 import { chainCannotJudge } from "./call-hook-stations.js";
 import { settleExecutionRecord } from "./execution-record.js";
 import { holdPrompt } from "./prompt-block.js";
@@ -64,6 +66,10 @@ export async function runLeg(input) {
         }
         if (resume) {
             const walltimeExhaustedResume = effectiveTimeoutMs !== undefined && effectiveTimeoutMs <= 0;
+            const approvalWords = approvalWordsOf(resume.outcome);
+            const approvalFrames = owedApprovalWords(approvalWords, uuidv7());
+            let approvalCommitted = false;
+            prepared.undeliveredContinuationRef.current.parkedSteers.push(...approvalFrames);
             const resumeWindowRetryAfterMs = !walltimeExhaustedResume && prepared.usageGovernance !== undefined ? await prepared.usageGovernance.check(Date.now()) : undefined;
             if (resumeWindowRetryAfterMs !== undefined) {
                 const owesNothing = resume.outcome.gate === "resource_limit" &&
@@ -236,13 +242,15 @@ export async function runLeg(input) {
                         ...ident(),
                     });
                 }
+                if (approvalWords !== undefined)
+                    continuation = withApprovalWords(continuation, engineSegments, approvalWords);
                 const pending = resume.cp.pendingAction;
                 const rejectionHalt = pending.kind === "tool_approval" && resume.outcome.gate === "policy_ask"
                     ? maybeHumanRejectionHalt({ gate: resume.outcome.gateOutcome, isDelegatedChild: prepared.hookIdentity.isDelegatedChild, toolName: pending.toolName, toolCallId: pending.toolCallId })
                     : undefined;
                 if (rejectionHalt !== undefined && pending.kind === "tool_approval")
                     prepared.batchHaltRef.current = { rejectedToolCallId: pending.toolCallId };
-                prepared.undeliveredContinuationRef.current = { parkedSteers: resumeFrames.map(({ entry }) => entry).filter((e) => !withheldSteerIds.has(e.inputId)), orphanTasks };
+                prepared.undeliveredContinuationRef.current = { parkedSteers: [...resumeFrames.map(({ entry }) => entry).filter((e) => !withheldSteerIds.has(e.inputId)), ...approvalFrames], orphanTasks };
                 if (!prepared.abortController.signal.aborted) {
                     if (resume !== undefined)
                         resume.decisionDelivered = true;
@@ -264,11 +272,22 @@ export async function runLeg(input) {
                         const preview = redactThenCut(prepared.outputStyleFrame, 220);
                         prepared.frameReceipts.pending.push({ source: "output_style", text: continuation, commit: () => void (queue.push({ type: "steering_injected", source: "output_style", preview, ...ident() }), (rs.attach.attachmentsInjected += 1)) });
                     }
+                    if (approvalFrames.length > 0) {
+                        prepared.frameReceipts.pending.push({
+                            source: "approval_feedback",
+                            text: continuation,
+                            commit: () => {
+                                approvalCommitted = true;
+                                const seat = prepared.undeliveredContinuationRef.current;
+                                seat.parkedSteers = seat.parkedSteers.filter((f) => !approvalFrames.includes(f));
+                            },
+                        });
+                    }
                     final = await withBrainSinks(() => prepared.harness.prompt(continuation, {
                         engineSegments,
                         settleUnansweredToolCalls: rejectionHalt !== undefined ? { halt: rejectionHalt } : {},
                         onDelivered: () => {
-                            prepared.undeliveredContinuationRef.current = { parkedSteers: [], orphanTasks: [] };
+                            prepared.undeliveredContinuationRef.current = { parkedSteers: approvalCommitted ? [] : [...approvalFrames], orphanTasks: [] };
                             for (const e of appliedEvents)
                                 queue.push(e);
                         },
@@ -531,19 +550,6 @@ async function applyResumeDecision(runner, prepared, resume, emit, emitCommitted
         return;
     if (pendingAction.kind !== "tool_approval")
         return;
-    if (resume.outcome.gate === "policy_ask" &&
-        resume.outcome.decision === "allow" &&
-        !prepared.tools.some((t) => t.name === pendingAction.toolName)) {
-        const e = new Error(`the approved tool "${pendingAction.toolName}" is no longer available on resume — refusing to continue as if it ran; the checkpoint is reopened for a retry with the tool present`);
-        e.code = "resume.tool_unavailable";
-        throw e;
-    }
-    const liveRoster = prepared.toolRosterDeltas.current;
-    if (pendingAction.kind === "tool_approval" && liveRoster !== undefined && judgeParkedToolIdentity(pendingAction, rosterEntryNamed(liveRoster, pendingAction.toolName)) === "mismatch") {
-        const e = new Error(`the approved tool "${pendingAction.toolName}" on this leg is not the tool the approval was minted against (its contract / shape / revision differ) — refusing to execute a replacement wearing the name; the checkpoint is reopened for a retry with the original tool present`);
-        e.code = "resume.tool_contract_mismatch";
-        throw e;
-    }
     await resolvePendingCall(runner, prepared, resume, emit, emitCommitted, onResolvedToolSuccess, onExecuteStart);
 }
 async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted, onResolvedToolSuccess, onExecuteStart) {
@@ -551,12 +557,17 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     const { outcome } = resume;
     if (pendingAction.kind !== "tool_approval" || outcome.gate !== "policy_ask")
         return;
+    const mounted = () => { const tool = prepared.tools.find((x) => x.name === pendingAction.toolName); const roster = prepared.toolRosterDeltas.current; return tool === undefined || roster === undefined ? {} : { tool, entry: rosterEntryNamed(roster, pendingAction.toolName) }; };
+    const reopen = (miss) => { throw Object.assign(new Error(miss.message), { code: miss.code }); };
+    const liveTool = mounted().tool;
+    const atSession = outcome.decision === "allow" ? judgeApprovalObject(pendingAction, { tool: mounted().entry }, "session") : "match";
+    if (atSession !== "match" && atSession.disposition === "reopen")
+        reopen(atSession);
     const decidedGate = outcome.gateOutcome;
     if (decidedGate === undefined) {
         throw new CheckpointError("checkpoint.invalid_outcome", "pending action reached the resolver with no settlement record on its decision (gateOutcome) — refusing to execute or settle a decision that carries no record");
     }
     const humanRewrite = wireOf("resume.questionArgsShown", pendingAction) === ASK_USER_QUESTION_TOOL_NAME ? undefined : outcome.updatedInput;
-    const liveTool = prepared.tools.find((x) => x.name === pendingAction.toolName);
     const reading = liveTool === undefined ? undefined : ownedReading((a) => readToolCallArguments(liveTool, { type: "toolCall", id: pendingAction.toolCallId, name: pendingAction.toolName, arguments: {} }, a));
     const beltFace = () => { const f = parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction); if (f !== undefined && reading !== undefined)
         stampArgsReading(f, reading); return f; };
@@ -568,7 +579,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     } };
     const decided = outcome.decision === "allow" ? tryRead(humanRewrite !== undefined ? humanRewrite : pendingAction.args) : { args: humanRewrite !== undefined ? humanRewrite : pendingAction.args };
     const resolvedArgs = decided.args;
-    const pendingLabel = (() => { const l = prepared.tools.find((t) => t.name === pendingAction.toolName)?.label; return l !== undefined && l !== pendingAction.toolName ? { label: l } : {}; })();
+    const pendingLabel = (() => { const l = liveTool?.label; return l !== undefined && l !== pendingAction.toolName ? { label: l } : {}; })();
     const spelledName = pendingAction.names?.[0] ?? pendingAction.toolName;
     const occurrences = prepared.toolOccurrences;
     const callStart = { toolCallId: pendingAction.toolCallId, spelledName, wireName: pendingAction.toolName, ...pendingLabel, args: resolvedArgs };
@@ -591,6 +602,11 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         await settleEnd(true, { content: text, ...(marks !== undefined ? { details: marks } : {}) }, undefined, true);
         emitCommitted(await prepared.session.appendMessage(resultRow(text, true)), "toolResult", pendingAction.toolCallId);
     };
+    const vetoApproval = async (miss) => {
+        const text = formatHookFeedback(miss.message, prepared.reminderMark);
+        await settleEnd(true, { content: text, ...(miss.code !== undefined ? { details: { code: miss.code } } : {}) }, "policy");
+        emitCommitted(await prepared.session.appendMessage(resultRow(text, true)), "toolResult", pendingAction.toolCallId);
+    };
     if (outcome.decision === "deny") {
         const settlementKind = outcome.gateOutcome?.settlement?.kind;
         const reason = settlementKind === "policy_refused"
@@ -612,6 +628,8 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     if (outcome.decision !== "allow") {
         throw new CheckpointError("checkpoint.invalid_outcome", `pending action reached the resolver with decision "${String(outcome.decision)}" — only "allow" executes and only "deny" injects a denial; refusing to execute`);
     }
+    if (atSession !== "match")
+        return vetoApproval(atSession);
     if (decided.unread !== undefined)
         return settleUnreadable(decided.unread.error, humanRewrite !== undefined ? "the arguments the decision edited it to" : "its arguments");
     const screened = await prepared.approvedCallScreen?.({ toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, args: structuredClone(resolvedArgs), decidedBy: outcome.hostDecision.decidedBy });
@@ -625,7 +643,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     if (rescreened?.unread !== undefined)
         return settleUnreadable(rescreened.unread.error, "the arguments a PreToolUse hook rewrote it to");
     const executedArgs = rescreened !== undefined ? rescreened.args : resolvedArgs;
-    const unseen = !deepJsonEqual(executedArgs, pendingAction.args);
+    const unseen = !licenseCovers(pendingAction.boundInputHash, executedArgs);
     let beltReading;
     const beltReq = () => ({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(beltFace()), budget: beltBudget, ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}), ...(prepared.handsRoot !== undefined ? { root: prepared.handsRoot } : {}), ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs), ...exemptRootsSeat(prepared.exemptRoots), ...(beltReading !== undefined ? { targetReading: beltReading } : {}) });
     const unjudgeable = unseen ? chainCannotJudge(resume.cp.state.inheritedGate) : undefined;
@@ -783,18 +801,24 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             reading.verdict.admit?.();
         }
     }
-    const grantRefusal = parkedSkillApprovalRefusal(pendingAction, executedArgs, prepared.skillSpecs, SKILL_TOOL_NAME, "execution");
-    if (grantRefusal !== undefined) {
-        const grantDenial = formatHookFeedback(grantRefusal, prepared.reminderMark);
-        await settleEnd(true, { content: grantDenial }, "policy");
-        emitCommitted(await prepared.session.appendMessage(resultRow(grantDenial, true)), "toolResult", pendingAction.toolCallId);
-        return;
-    }
-    const tool = prepared.tools.find((t) => t.name === pendingAction.toolName);
-    if (!tool) {
-        const e = new Error(`the approved tool "${pendingAction.toolName}" is no longer available on resume`);
-        e.code = "resume.tool_unavailable";
-        throw e;
+    let tool;
+    for (;;) {
+        const { targetReading: _belts, ...unread } = beltReq();
+        const targetReading = (await prepared.stampCallTarget?.(unread, prepared.abortController.signal))?.targetReading;
+        const atExecution = judgeApprovalObject(pendingAction, { tool: mounted().entry, args: executedArgs, skills: prepared.skillSpecs, skillToolName: SKILL_TOOL_NAME, ...(humanRewrite !== undefined ? { decided: resolvedArgs } : {}), targetReading }, "execution");
+        if (atExecution !== "match")
+            return atExecution.disposition === "reopen" ? reopen(atExecution) : vetoApproval(atExecution);
+        tool = mounted().tool;
+        const waited = prepared.crossBoundary?.storeWaits() ?? 0;
+        const crossBoundaryRefusal = await prepared.crossBoundary?.check?.exit({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId }, outcome.hostDecision.decidedBy);
+        if (crossBoundaryRefusal !== undefined) {
+            const text = formatHookFeedback(crossBoundaryRefusal.message, prepared.reminderMark);
+            await settleEnd(true, { content: text }, "policy");
+            emitCommitted(await prepared.session.appendMessage(resultRow(text, true)), "toolResult", pendingAction.toolCallId);
+            return;
+        }
+        if ((prepared.crossBoundary?.storeWaits() ?? 0) === waited)
+            break;
     }
     const args = executedArgs;
     screened?.admit();

package/dist/core/runner/run-settle-and-teardown.js

@@ -282,6 +282,8 @@ export async function runSettleAndTeardown(input) {
         const writeDateAnchor = owedDateAnchor(prepared.session, prepared.dateChange, rs.attach.dateState);
         if (writeDateAnchor !== undefined)
             await settleTeardownLeg(writeDateAnchor, "date anchor (settle leg)", (e) => runner.deps.onError?.(e, { phase: "degraded", sessionId: prepared.sessionId }));
+        if (prepared.crossBoundary !== undefined)
+            await prepared.crossBoundary.settle();
         const ownedEnvDying = prepared.ownedEnv !== undefined &&
             hasDestroy(prepared.ownedEnv) &&
             isIsolated(prepared.ownedEnv) &&

package/dist/core/runner/run-terminal-adoption.js

@@ -10,6 +10,7 @@ import { compactionHookOptions, recordCompactionReuse, seamCCompactionOptions }
 import { compactionRestateOptions } from "./compaction-restate.js";
 import { MAX_CONSECUTIVE_COMPACTION_FAILURES } from "./compaction-knobs.js";
 import { emitSettled, reconciledEnd } from "./tool-end-body.js";
+import { isApprovalWordsFrame } from "./approval-feedback.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
 export async function runTerminalAdoption(input) {
     const { spec, queue, prepared, rs, stats, ident, emitCommitted, startedToolCallIds, toolLabels, timeout, compactionBrain, compactionBreaker, windowSafetyOptions, undrainedUserAtEnd, userInputLostAtEnd, final, abortedLive, userInterruptedLive, callerStop, runner, sessions, next } = input;
@@ -78,21 +79,28 @@ export async function runTerminalAdoption(input) {
     }
     let migratedParked = { steer: 0, followUp: 0 };
     let carriedContinuation = 0;
+    let carriedApproval = 0;
+    let approvalRefusal;
     if (committedPause !== undefined && runner.deps.checkpointStore !== undefined) {
         const parkToken = committedPause.cause.token;
         const parkScope = committedPause.scope;
         const store = runner.deps.checkpointStore;
         const carried = [];
         const owed = [
-            ...prepared.undeliveredContinuationRef.current.parkedSteers.map(({ seq: _seq, ...input }) => ({ input })),
+            ...prepared.undeliveredContinuationRef.current.parkedSteers.map((frame) => {
+                const { seq: _seq, ...input } = frame;
+                return { input, ...(isApprovalWordsFrame(frame) ? { approval: true } : {}) };
+            }),
             ...prepared.harness.readParkableUserInputs().map((record) => ({ input: record, live: record })),
         ];
-        for (const { input, live } of owed) {
+        for (const { input, live, approval } of owed) {
             try {
                 if (!(await store.setPendingSteer(parkToken, parkScope, input)))
                     break;
                 if (live !== undefined)
                     carried.push(live);
+                else if (approval)
+                    carriedApproval += 1;
                 else
                     carriedContinuation += 1;
             }
@@ -102,14 +110,17 @@ export async function runTerminalAdoption(input) {
                     sessionId: prepared.sessionId,
                 });
                 const parkCode = errorCodeOf(parkErr);
-                if (parkCode === "steering.invalid_content" || parkCode === "steering.queue_full")
+                if (parkCode === "steering.invalid_content" || parkCode === "steering.queue_full") {
+                    if (approval)
+                        approvalRefusal = parkCode;
                     continue;
+                }
                 break;
             }
         }
         migratedParked = prepared.harness.dropParkedUserInputs(carried);
     }
-    const owedUserInput = { held: undrainedUserAtEnd.current, migrated: migratedParked, continuation: { frames: prepared.undeliveredContinuationRef.current.parkedSteers, carried: carriedContinuation } };
+    const owedUserInput = { held: undrainedUserAtEnd.current, migrated: migratedParked, continuation: { frames: prepared.undeliveredContinuationRef.current.parkedSteers.filter((f) => !isApprovalWordsFrame(f)), carried: carriedContinuation, approval: { owed: prepared.undeliveredContinuationRef.current.parkedSteers.filter(isApprovalWordsFrame).length, carried: carriedApproval, ...(approvalRefusal !== undefined ? { refusal: approvalRefusal } : {}) } } };
     if (rs.attach.attachState?.postCompactPending === true && (rs.attach.attachmentsCfg?.backgroundTasks ?? eventDefaultOn("background_tasks")) === true) {
         emitTrace(rs.telemetry.tracer, () => ({ kind: "compaction.announce_dropped", version: 1, taskId: rs.telemetry.taskId, ts: Date.now() }));
     }

package/dist/core/runner/session-file-state-replay.d.ts

@@ -41,10 +41,13 @@ export type TranscriptFileRecord = {
     content: string;
     /** The recording message's own timestamp — the most honest "last read at" available. */
     at: number;
+    /** A Read result's call id — the transmission that carried the text (a Write's or an Edit's post-condition: none). */ transmittedByToolCallId?: string;
 } | {
     path: string;
-    /** The entry the delivery committed. */
-    observation: UserAttachmentObservation["entry"];
+    /** The entry the delivery committed, stamped with the frame that carried it (a trim that drops the frame retires it). */
+    observation: UserAttachmentObservation["entry"] & {
+        transmittedByToolCallId: string;
+    };
     at: number;
 };
 /**

package/dist/core/runner/session-file-state-replay.js

@@ -3,6 +3,7 @@ import { isAbsoluteForFamily, pathFamilyOf } from "../../tools/fs/safety.js";
 import { applyRecordedEdit } from "../../tools/fs/fs-shared.js";
 import { normalizeFileText } from "../../tools/fs/encoding.js";
 import { isOffloadedDetailReplacement } from "../tool-result-store.js";
+import { attachmentTransmissionId } from "../user-attachment.js";
 const READ_TOOL = "Read";
 const WRITE_TOOL = "Write";
 const EDIT_TOOL = "Edit";
@@ -69,7 +70,7 @@ export function wholeFileRecordsFromTranscript(messages) {
         if (attachment?.observation !== undefined) {
             const { key, entry } = attachment.observation;
             if (isAbsoluteForFamily(pathFamilyOf({ root: key }), key))
-                byPath.set(key, { path: key, observation: entry, at: m.timestamp });
+                byPath.set(key, { path: key, observation: { ...entry, transmittedByToolCallId: attachmentTransmissionId(attachment) }, at: m.timestamp });
             continue;
         }
         if (m.role !== "toolResult" || m.isError)
@@ -112,7 +113,7 @@ export function wholeFileRecordsFromTranscript(messages) {
             continue;
         if (isOffloadedDetailReplacement(content))
             continue;
-        byPath.set(filePath, { path: filePath, content, at: m.timestamp });
+        byPath.set(filePath, { path: filePath, content, at: m.timestamp, ...(isRead ? { transmittedByToolCallId: m.toolCallId } : {}) });
     }
     return [...byPath.values()];
 }

package/dist/core/runner/stream-steer-verb.js

@@ -6,7 +6,7 @@ import { classicEventBase, failedHandlerClause, screenUserPrompt } from "../mods
 import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
 import { injectionLaneOf, isSystemInjectionPriority, steerPriorityOf, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
 import { deliverEngineNotice } from "../types.js";
-import { inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
+import { inlineUntrusted, sanitizeUntrustedText, sentinelTagRefusal } from "../untrusted-text.js";
 import { announceAcceptance, armAcceptance, nextHumanInputSeq } from "./steer-admission.js";
 import { steerReplayRefusal } from "../steer-replay.js";
 export function streamSteerVerb(input) {
@@ -18,7 +18,7 @@ export function streamSteerVerb(input) {
         }
         const trusted = options?.trusted ? true : false;
         if (trusted && sanitizeUntrustedText(text) !== text) {
-            throw steeringError("trusted steering text must not contain a </system-reminder> tag", "steering.invalid_content");
+            throw steeringError(sentinelTagRefusal("trusted steering text"), "steering.invalid_content");
         }
         const inputId = options?.inputId;
         if (inputId !== undefined) {

package/dist/core/runner/tool-face-overlay.d.ts

@@ -4,13 +4,15 @@
  * tool name like `allowTools` / `toolAxes`). Validated against the MATERIALIZED schema at every listing
  * (the first mount and every RefreshMcpTools): `pathTarget.param` must be a top-level property; an
  * `approvalCard` must find the keys the card needs; a `ruleFace` may only name scalar keys; `family`
- * must be a member of the closed set. A failing overlay does NOT mount — the tool mounts BARE (no
+ * must be a member of the closed set; every `resultCards` entry must live under the tool's own card namespace.
+ * A failing overlay does NOT mount — the tool mounts BARE (no
  * face) and the leg announces `config.tool_face_invalid` once per tool; a `toolFaces` key naming a
  * tool the listing does not carry announces `config.tool_face_undeclared` once per name. Never a
  * silent partial application: an overlay is one declaration, applied whole or not at all.
  *
  * Prepare-path machinery (layer 1): pure over the tool objects and the server specs; the notice sink
- * is a parameter.
+ * is a parameter. The declaration itself is read once, by `readToolFaces` (`core/tool-face-reader.ts`), at the preparation door and at the
+ * materialization entrance; the specs this file consumes carry that reader's copy, never the caller's object.
  */
 import type { AgentTool } from "../../internal/harness-types.js";
 import type { McpServerSpec } from "../mcp-server-spec.js";
@@ -20,10 +22,24 @@ import { type EngineNotice } from "../engine-notice.js";
  *  card's full schema; this is the pre-filter the overlay is validated against). */
 export declare const APPROVAL_CARD_REQUIRED_KEYS: Readonly<Record<ToolApprovalCard, readonly string[]>>;
 export type McpToolFace = NonNullable<McpServerSpec["toolFaces"]>[string];
-/** Why an overlay is refused — a closed reason list, each a distinct declaration mistake. */
-export declare function toolFaceProblem(face: McpToolFace, schema: AgentTool["parameters"], tool?: {
+/** The tool a face rides on, as far as the judge needs to know it: its name (a reserved approval card belongs to the engine's own tool of that
+ *  name) and, when the caller holds the tool's card namespace, the `cardId` its `resultCards` must live under (`<cardId>/<card>`). */
+export interface FaceTool {
     readonly toolName: string;
-}): string | undefined;
+    readonly cardId?: string;
+}
+/** Why an overlay is refused — a closed reason list, each a distinct declaration mistake. */
+export declare function toolFaceProblem(face: McpToolFace, schema: AgentTool["parameters"], tool?: FaceTool): string | undefined;
+/**
+ * The one judge of a face. With the tool's materialized `schema` it is {@link toolFaceProblem}: the declaration against the
+ * schema it rides on. With no schema it is the same judge over the DECLARATION ALONE (`readToolFaces`, `core/tool-face-reader.ts`): every
+ * check that needs the schema's keys (a path target's `param` / `patternParam`, an approval card's required keys, the names a summary or a
+ * rule face lists) waits for the listing; the closed words, the bounds and the cross-member rules do not need it and are the same
+ * checks, in the same order, with the same sentences. A face this judges is a well-typed one (the reader types it first). A tool that
+ * holds its card namespace (`tool.cardId`) has its `resultCards` held to it here too, so a caller's face and a server's face are
+ * judged by this one function, not by a rule beside it.
+ */
+export declare function faceProblem(face: McpToolFace, schema: AgentTool["parameters"] | undefined, tool?: FaceTool): string | undefined;
 export interface ApplyToolFacesInput {
     /** The materialized tools of ONE server (namespaced names). */
     tools: readonly AgentTool[];
@@ -38,5 +54,7 @@ export interface ApplyToolFacesInput {
  *  untyped carry `defineTool` uses, so the roster reads it off the instance). A face that does NOT fit the materialized
  *  schema is a bad declaration: the tool is NOT mounted on this leg (announced once, `config.tool_face_invalid`) —
  *  mounting it bare would silently drop the write protection the operator declared for it (an MCP name has no catalog
- *  floor), and a schema refresh that invalidates only a display hint must fail loud, never open. */
+ *  floor), and a schema refresh that invalidates only a display hint must fail loud, never open. The faces it reads are the
+ *  server entry's own: the reader's copy of the declaration (`readToolFaces`), put there by the preparation door or the
+ *  materialization entrance, never a caller's object. */
 export declare function applyMcpToolFaces(input: ApplyToolFacesInput): AgentTool[];

package/dist/core/runner/tool-face-overlay.js

@@ -1,7 +1,8 @@
 import { MCP_NAMESPACE } from "../protocol-table.js";
 import { mintNamespacePrefix } from "../protocol-naming.js";
 import { RESERVED_APPROVAL_CARDS, TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_PATH_ABSENCES, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_CHARS, RENDER_HINT_MAX_LIST, TOOL_KEY_MAX_CHARS, } from "../tool-face.js";
-import { engineCardOf, inputKeysOf } from "../tool-roster.js";
+import { engineCardOf, inputKeysOf, offendingResultCard, protocolToolOf, rosterCardId } from "../tool-roster.js";
+import { engineCardTypes } from "../tool-registry.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 export const APPROVAL_CARD_REQUIRED_KEYS = Object.freeze({
     "file-edit": ["file_path"],
@@ -14,17 +15,20 @@ export const APPROVAL_CARD_REQUIRED_KEYS = Object.freeze({
     generic: [],
 });
 export function toolFaceProblem(face, schema, tool) {
-    const { keys, scalar } = inputKeysOf(schema);
-    const top = new Set(keys.map((k) => k.name));
+    return faceProblem(face, schema, tool);
+}
+export function faceProblem(face, schema, tool) {
+    const bound = schema === undefined ? undefined : inputKeysOf(schema);
+    const top = bound === undefined ? undefined : new Set(bound.keys.map((k) => k.name));
     if (face.family !== undefined && !TOOL_FAMILIES.includes(face.family))
         return `family ${JSON.stringify(face.family)} is outside the closed set`;
     const overlong = (label, values) => {
         const k = values.find((v) => v.length > TOOL_KEY_MAX_CHARS);
         return k === undefined ? undefined : `${label} ${JSON.stringify(k.slice(0, 40) + "…")} is ${k.length} characters; a roster key is at most ${TOOL_KEY_MAX_CHARS}`;
     };
-    const vocabulary = new Set(scalar);
+    const vocabulary = new Set(bound?.scalar);
     if (face.pathTarget !== undefined) {
-        if (typeof face.pathTarget.param !== "string" || !top.has(face.pathTarget.param))
+        if (top !== undefined && (typeof face.pathTarget.param !== "string" || !top.has(face.pathTarget.param)))
             return `pathTarget.param ${JSON.stringify(face.pathTarget.param)} is not a top-level property of the tool's schema`;
         if (!TOOL_PATH_ACCESSES.includes(face.pathTarget.access))
             return `pathTarget.access ${JSON.stringify(face.pathTarget.access)} is outside the closed set`;
@@ -40,7 +44,7 @@ export function toolFaceProblem(face, schema, tool) {
             return `pathTarget.absent "base" needs pathTarget.access "read" — it says the call is about the whole base directory when the slot is empty, which is a search SCOPE; a write with no path names no file, and the containment fences judge a write on its own target`;
         const patternParam = face.pathTarget.patternParam;
         if (patternParam !== undefined) {
-            if (typeof patternParam !== "string" || !top.has(patternParam))
+            if (top !== undefined && (typeof patternParam !== "string" || !top.has(patternParam)))
                 return `pathTarget.patternParam ${JSON.stringify(patternParam)} is not a top-level property of the tool's schema`;
             if (absent !== "base")
                 return `pathTarget.patternParam ${JSON.stringify(patternParam)} is declared but pathTarget.absent is ${JSON.stringify(absent ?? "none")} — the pattern base is only ever read for an absent slot, so this declaration would be inert`;
@@ -62,7 +66,7 @@ export function toolFaceProblem(face, schema, tool) {
                 return `renderHints.approvalCard ${JSON.stringify(card)} is outside the closed set`;
             if (RESERVED_APPROVAL_CARDS.includes(card) && (tool === undefined || engineCardOf(tool) !== card))
                 return `renderHints.approvalCard ${JSON.stringify(card)} is reserved for the engine's own tool that owns it; a declared tool takes another card or none`;
-            const missing = APPROVAL_CARD_REQUIRED_KEYS[card].filter((k) => !top.has(k));
+            const missing = top === undefined ? [] : APPROVAL_CARD_REQUIRED_KEYS[card].filter((k) => !top.has(k));
             if (missing.length > 0)
                 return `renderHints.approvalCard ${JSON.stringify(card)} needs ${missing.join(", ")} on the tool's schema`;
         }
@@ -77,16 +81,21 @@ export function toolFaceProblem(face, schema, tool) {
         const long = overlong("renderHints.summaryParams", hints.summaryParams ?? []) ?? overlong("renderHints.resultCards", hints.resultCards ?? []);
         if (long !== undefined)
             return long;
-        const stray = (hints.summaryParams ?? []).find((p) => !top.has(p));
+        const foreignCard = tool?.cardId === undefined ? undefined : offendingResultCard(hints, tool.cardId, engineCardTypes());
+        if (foreignCard !== undefined)
+            return `renderHints.resultCards names ${JSON.stringify(foreignCard.slice(0, 80))}, outside the tool's own card namespace "${tool.cardId}/<card>" (engine cards and other contracts' namespaces are reserved)`;
+        const stray = top === undefined ? undefined : (hints.summaryParams ?? []).find((p) => !top.has(p));
         if (stray !== undefined)
             return `renderHints.summaryParams names ${JSON.stringify(stray)}, which is not a top-level property`;
     }
-    for (const p of face.ruleFace?.params ?? [])
-        if (!vocabulary.has(p))
-            return `ruleFace.params names ${JSON.stringify(p)}, which is neither a scalar top-level property nor the declared path target`;
-    for (const p of face.ruleFace?.primaryParams ?? [])
-        if (!vocabulary.has(p))
-            return `ruleFace.primaryParams names ${JSON.stringify(p)}, which is neither a top-level property nor the declared path target`;
+    if (top !== undefined) {
+        for (const p of face.ruleFace?.params ?? [])
+            if (!vocabulary.has(p))
+                return `ruleFace.params names ${JSON.stringify(p)}, which is neither a scalar top-level property nor the declared path target`;
+        for (const p of face.ruleFace?.primaryParams ?? [])
+            if (!vocabulary.has(p))
+                return `ruleFace.primaryParams names ${JSON.stringify(p)}, which is neither a top-level property nor the declared path target`;
+    }
     const long = overlong("ruleFace.params", face.ruleFace?.params ?? []) ?? overlong("ruleFace.primaryParams", face.ruleFace?.primaryParams ?? []);
     if (long !== undefined)
         return long;
@@ -121,7 +130,7 @@ export function applyMcpToolFaces(input) {
         if (raw === undefined || face === undefined)
             return t;
         const hit = { raw, face };
-        const problem = toolFaceProblem(hit.face, t.parameters, { toolName: t.name });
+        const problem = toolFaceProblem(hit.face, t.parameters, { toolName: t.name, cardId: rosterCardId("mcp", t.name, input.server.name, protocolToolOf(t.name), "") });
         if (problem !== undefined) {
             const key = `invalid:${t.name}`;
             if (!input.announced.has(key)) {