@sema-agent/core 7.53.0 → 7.54.1

package/dist/core/tool-face-reader.js

@@ -0,0 +1,94 @@
+import { dataKind, perToolEmptyName, perToolEntryRefusal, quotedName, receivePerToolDeclaration } from "./mcp-server-spec.js";
+import { isPlainRecord } from "./mods/kernel/receive.js";
+import { faceProblem } from "./runner/tool-face-overlay.js";
+import { inlineUntrusted } from "./untrusted-text.js";
+const TOOL_FACE_MEMBERS = { family: true, pathTarget: true, renderHints: true, ruleFace: true };
+const PATH_TARGET_KINDS = { param: "string", aliases: "list", access: "string", skillScopeEligible: "boolean", base: "string", absent: "string", patternParam: "string" };
+const PATH_TARGET_REQUIRED = ["param", "access"];
+const RENDER_HINT_KINDS = { userFacingName: "string", activity: "string", summaryParams: "list", resultCards: "list", approvalCard: "string" };
+const RULE_FACE_KINDS = { primaryParams: "list", params: "list" };
+function kindProblem(label, value, kind) {
+    if (value === undefined)
+        return undefined;
+    if (kind === "list")
+        return Array.isArray(value) && value.every((name) => typeof name === "string") ? undefined : `${label} is ${dataKind(value)}, not a list of strings`;
+    return typeof value === kind ? undefined : `${label} is ${dataKind(value)}, not a ${kind}`;
+}
+function membersOf(raw, label, names) {
+    if (!isPlainRecord(raw))
+        return `${label} is ${dataKind(raw)}, not an object`;
+    const unknown = Object.keys(raw).find((member) => !names.includes(member));
+    return unknown === undefined ? raw : `${label} has the unknown member ${quotedName(unknown)} (the members are ${names.join(", ")})`;
+}
+function ownMember(record, name) {
+    return Object.hasOwn(record, name) ? record[name] : undefined;
+}
+function readMembers(raw, label, kinds, required = []) {
+    const record = membersOf(raw, label, Object.keys(kinds));
+    if (typeof record === "string")
+        return record;
+    for (const member of required)
+        if (ownMember(record, member) === undefined)
+            return `${label}.${member} is missing`;
+    const entries = [];
+    for (const member of Object.keys(record)) {
+        const kind = kinds[member];
+        const value = record[member];
+        const problem = kindProblem(`${label}.${member}`, value, kind);
+        if (problem !== undefined)
+            return problem;
+        if (value === undefined || (kind === "boolean" && value === false))
+            continue;
+        entries.push([member, kind === "list" ? [...value] : value]);
+    }
+    return Object.fromEntries(entries);
+}
+function readOneToolFace(raw) {
+    const face = membersOf(raw, "the face", Object.keys(TOOL_FACE_MEMBERS));
+    if (typeof face === "string")
+        return face;
+    const records = { pathTarget: [PATH_TARGET_KINDS, PATH_TARGET_REQUIRED], renderHints: [RENDER_HINT_KINDS, []], ruleFace: [RULE_FACE_KINDS, []] };
+    const entries = [];
+    for (const member of Object.keys(face)) {
+        const value = face[member];
+        if (value === undefined)
+            continue;
+        if (member === "family") {
+            const problem = kindProblem("family", value, "string");
+            if (problem !== undefined)
+                return problem;
+            entries.push([member, value]);
+            continue;
+        }
+        const [kinds, required] = records[member];
+        const record = readMembers(value, member, kinds, required);
+        if (typeof record === "string")
+            return record;
+        entries.push([member, record]);
+    }
+    const typed = Object.fromEntries(entries);
+    return faceProblem(typed, undefined) ?? typed;
+}
+export function readToolFaces(declared) {
+    if (declared === undefined)
+        return { ok: true };
+    const received = receivePerToolDeclaration(declared, "toolFaces", "tool");
+    if (!received.ok)
+        return { ok: false, problem: received.problem };
+    const entries = [];
+    for (const [tool, raw] of Object.entries(received.perTool)) {
+        if (tool.length === 0)
+            return { ok: false, problem: perToolEmptyName("toolFaces", "tool") };
+        let face;
+        try {
+            face = readOneToolFace(raw);
+        }
+        catch {
+            face = "a member threw while it was read";
+        }
+        if (typeof face === "string")
+            return { ok: false, problem: perToolEntryRefusal("toolFaces", "tool", tool, inlineUntrusted(face, 240)) };
+        entries.push([tool, face]);
+    }
+    return entries.length > 0 ? { ok: true, faces: Object.fromEntries(entries) } : { ok: true };
+}

package/dist/core/tool-face.d.ts

@@ -198,6 +198,9 @@ export interface ToolRenderHints {
  */
 export interface ToolFaceDeclaration {
     family: ToolFamily;
+    /** The legs every call of the definition travels, or `"per_call"` when the code that dispatches it gives them per call. REQUIRED:
+     *  a definition that states none does not compile — no default, and no fail-closed reading as outside. */
+    boundaryLegs: import("./cross-boundary-taint.js").BoundaryLegsDeclaration;
     effect?: import("./tool-spec.js").ToolEffect;
     egress?: true;
     irreversibility?: "never" | "maybe" | "always";
@@ -232,6 +235,12 @@ export interface ToolFaceDeclaration {
  */
 export declare const TOOL_LEG_KINDS: readonly ["delegated", "teammate", "goal", "observer", "structured"];
 export type ToolLegKind = (typeof TOOL_LEG_KINDS)[number];
+/**
+ * The leg kinds that share their spawner's tool surface: a teammate is handed tools its spawner holds in its own right (the team's mailbox,
+ * scheduler and task list), so the layers above the leg decide its protocol rows and the leg's own lists do not. A protocol row that no kind
+ * of this table names is the leg's own channel — a finishing or hand-back tool its spawner never held — and no layer decides it.
+ */
+export declare const SPAWNER_SURFACE_LEG_KINDS: readonly ToolLegKind[];
 /**
  * One layer of a tool selector, as data: an allowed-tools list (absent = no allowlist on this layer) and a denied-tools list,
  * each a frozen copy of the entries a list was written with. A run's own layer is its `allowTools` and `excludeTools`; the
@@ -244,8 +253,9 @@ export interface ToolSelectorLayer {
 /**
  * The compiled tool selector of one run — the one answer to "is this tool available on this run", read at the roster valve
  * and on every later roster change (an MCP refresh or re-dial, the deferred-search lane), and handed down as the ceiling of
- * every run this one spawns (`layers`). A tool is admitted when it is a protocol tool of this run's leg kind, or when every
- * layer admits it: the layer's allowlist (if any) reaches it and its denylist does not.
+ * every run this one spawns (`layers`). A tool is admitted when it is the leg's own protocol channel, or when every layer
+ * admits it — the layer's allowlist (if any) reaches it and its denylist does not — or, for a protocol tool of a leg that shares
+ * its spawner's tool surface ({@link SPAWNER_SURFACE_LEG_KINDS}), when every layer ABOVE the leg's own admits it.
  */
 export interface ToolSelector {
     readonly layers: readonly ToolSelectorLayer[];
@@ -280,13 +290,12 @@ export interface ToolCatalogEntry {
     face: ToolFaceDeclaration;
     /** A `modelGate` class the default-bundle assembler stamps on this definition's default arm. */
     modelGate?: string;
-    /** The leg kinds whose legs rely on this tool as part of their protocol: on such a leg the tool's availability is not a
-     *  selector's to decide (an allowlist need not name it), and a denylist that reaches it there is a contradiction the run
-     *  refuses at prepare. */
+    /** The leg kinds whose legs rely on this tool as part of their protocol: the leg's OWN lists do not decide it (an allowlist need not
+     *  name it), and a denylist of the leg's own that reaches it is a contradiction the run refuses at prepare. Whether the layers ABOVE
+     *  the leg decide it follows the row's kinds ({@link SPAWNER_SURFACE_LEG_KINDS}): a row some kind of which shares its spawner's tool
+     *  surface is held exactly when the spawner may hold it; any other row is the leg's own channel, which no layer decides — an inherited
+     *  deny that reaches it is the same contradiction. */
     protocol?: readonly ToolLegKind[];
-    /** A protocol row the leg shares with the run that spawned it (the team task-list family a teammate shares with its leader): on its
-     *  leg the leg's OWN lists do not decide it, but the ceiling still does — the leg holds it exactly when its spawner may. */
-    protocolUnderCeiling?: true;
 }
 /**
  * The band-membership table over the mount tags: a host derives its hand band as the definitions listed under a

package/dist/core/tool-face.js

@@ -25,6 +25,7 @@ export const RENDER_HINT_MAX_CHARS = 64;
 export const RENDER_HINT_ACTIVITY_MAX_CHARS = 32;
 export const RENDER_HINT_MAX_LIST = 16;
 export const TOOL_LEG_KINDS = Object.freeze(["delegated", "teammate", "goal", "observer", "structured"]);
+export const SPAWNER_SURFACE_LEG_KINDS = Object.freeze(["teammate"]);
 export const MOUNT_TAG_IN_HANDS_BAND = {
     hands: true,
     backgroundTasks: true,

package/dist/core/tool-policy.d.ts

@@ -2,6 +2,7 @@ import { type AskOrigin, type AssertAllKeysHandled } from "./ask-origin.js";
 import { type ReadRootGrantScreen } from "./read-root-grant-screen.js";
 import { type Settlement } from "./gate-outcome.js";
 export { policyCannotAnswer, rowDemandsAPerson } from "./real-approval.js";
+import { type BindingFault } from "./canonical-json.js";
 import { type DecisionReason } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
 import { type RemovalGuardSeat } from "../tools/fs/removal-targets.js";
@@ -236,7 +237,8 @@ export interface EngineAttestation {
     readonly origin?: AskOrigin;
     /** The settled ask's class set (`ASK_CLASSES` order), when the minting station held one. */
     readonly classes?: readonly import("./ask-origin.js").AskClass[];
-    /** `boundInputHashOf` of the arguments the settlement licenses: an approver's edit, the snapshot shown, or the asked args. */
+    /** `exactBoundInputHashOf` of the arguments the settlement licenses (an approver's edit, the snapshot shown, or the asked
+     *  args); absent when they have none (outside the bindable domain) — such a record licenses no bytes. */
     readonly inputDigest?: string;
     /** The FORM of a classifier round that did not rule (a classifier deny's cause). */
     readonly classifierCause?: import("./gate-outcome.js").ClassifierDenyCause;
@@ -249,6 +251,9 @@ export interface EngineAttestation {
     /** Where a path deny row refused the call — the row, the view of the target it met, the face the call is on. The gate's
      *  exit mints the refusal's card from it; the judge that found the row is its only writer. */
     readonly pathDenial?: import("../tools/fs/safety.js").PathDenialEvidence;
+    /** A seat refused the call's arguments because no approval can be bound to them ({@link bindableArgsOf}): the refusal's
+     *  sentence, carried by the refusal itself — the gate's deny exit reads it (the remedy it gives) instead of judging again. */
+    readonly bindingRefusal?: string;
 }
 /** The members a station attests — everything but the call binding. */
 export type AttestationMembers = Omit<EngineAttestation, "toolCallId" | "toolName">;
@@ -422,6 +427,11 @@ export type PermissionResult = {
      *  in the one direction the stamp cannot reach (a caller composing its own ask) the claim is
      *  tightening-only: it can make an ask outlive a rule, never turn one into an allow. */
     probeMandated?: true;
+    /** This ask stands on the call's CROSS-BOUNDARY obligation — a person's confirmation
+     *  ({@link import("./cross-boundary-taint.js").crossBoundaryObligation}); the station mints it beside `requiresRealApproval`, the
+     *  decision receipt adds that bit to a policy's or hook's own. Its one carrier: the class (`cross_boundary`), the rule-silence word (`cross_boundary_taint`) and the
+     *  real-approval bit are all read off this member. Tightening-only: a policy self-declaring it opts its own ask out of automatic answering. */
+    crossBoundaryMandated?: true;
     /** This ask is MANDATED — no persisted allow rule and no STANDING ANSWER (a release remembered from an
      *  earlier call, at any scope, a session included) may retire it; only an answer produced for THIS call
      *  clears it — a person, a hook, a deployment's blanket `onAsk: "allow"` seat, or the live deciders the
@@ -592,6 +602,37 @@ export interface AskRuleEvidence {
 }
 /** The human/model-readable text of a decision. */
 export declare function decisionText(d: PermissionResult): string | undefined;
+/** Does a license (a record's `inputDigest`) cover the bytes that `runs`? The ONE judge — the gate's ledger keeps a settlement for
+ *  the bytes it licensed by it, and the unstated question asks whether an answer was given for these bytes by it. A license for
+ *  bytes covers what the tool reads them as ({@link argsReadFrom}: the one recorded step a reading took to `runs`). Compared by
+ *  the EXACT digest only: bytes outside the bindable domain have none and are covered by no license. */
+export declare function licenseCovers(licensed: string | undefined, runs: unknown): boolean;
+/**
+ * THE judge of whether an approval can be bound to arguments, and the arguments it binds — asked wherever an approval is about to
+ * be asked or adopted, and nowhere else: the ask resolver (its no-approver arm too) and the approval policy before anyone is asked,
+ * the resolver where it adopts a person's edit, the gate's approved-edit loop (an edit any resolver hands back), and — through the
+ * same judge and sentence — the durable decide's capture of one before the claim ({@link capturedJsonOf}). Bindable = a record of
+ * plain JSON data nested at most 256 levels deep ({@link bindableValueOf}, exactly the values with an exact digest — the SAME reading every
+ * license and mint takes), judged on the value as given with nothing of the caller's run (a getter is never called: a value read
+ * through one has no fixed bytes). Ok ⇒ the judge's frozen copy, engine-owned (`args` itself when owned already); else the ONE
+ * sentence ({@link bindingRefusalOf}).
+ */
+export declare function bindableArgsOf<T>(toolName: string, args: T): {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    refusal: string;
+};
+/** THE sentence refusing arguments no approval can be bound to, naming what the judge met and where (`args` is what it was given). */
+export declare function bindingRefusalOf(toolName: string, args: unknown, fault: BindingFault): string;
+/** Was the call ANSWERED for the bytes that run — does `d` carry an engine record ({@link attestationOf}) of a settled wait
+ *  whose license covers `runs`? A person's or the deployment approver's yes over these arguments is; a layer's allow is not,
+ *  whatever it says about itself, and neither is a yes given for other bytes (a later layer that rewrote them voids it here). */
+export declare function answeredFor(d: PermissionResult, call: {
+    toolCallId: string;
+    toolName: string;
+}, runs: unknown): boolean;
 /**
  * Gates tool calls before they execute (the production safety layer for "processing/changing data").
  *
@@ -878,9 +919,10 @@ export declare function constraintChainEntryOfSuppliedLayer(layer: ConstraintCha
  * different frozen deny data now digest differently.
  */
 export declare function constraintChainDigest(chain: readonly ConstraintChainEntry[]): string;
-/** Every member of the decision union — a member the union gains and this list lacks is a type error at `satisfies`.
- *  The receipt walks it: a contract member not held as an own enumerable data property is refused if a descriptor on the
- *  prototype chain holds one (an `undefined` data value spells absence). Not re-exported from `src/index.ts`. */
+/** Every member of the decision union, read off the member × arm table ({@link DECISION_MEMBER_ARMS}: a member the union gains
+ *  and the table lacks is a type error there). The receipt walks it: a contract member not held as an own enumerable data
+ *  property is refused if a descriptor on the prototype chain holds one (an `undefined` data value spells absence), and a
+ *  present one must sit on an arm its row holds. Not re-exported from `src/index.ts`. */
 export type DecisionMember = PermissionResult extends infer U ? (U extends unknown ? keyof U : never) : never;
 export declare const DECISION_MEMBERS: readonly DecisionMember[];
 /**
@@ -949,8 +991,10 @@ export type NamedToolPolicy = ToolPolicy & {
  *  which simply opts out of the audit). */
 export declare function toolPolicyNameSets(p: ToolPolicy | undefined): readonly ToolPolicyNameSets[];
 /**
- * Name-based allow/deny. `deny` always wins. If `allow` is provided, only those tools are permitted
- * (everything else denied). Without `allow`, everything not in `deny` is permitted. Each entry is read by the rule
+ * Name-based allow/deny. `deny` always wins. If `allow` is provided, only those tools may run (everything else denied) — a
+ * NARROWING: a tool the list names gets no objection, never consent, so a `passthrough`-seat tool it names still meets the
+ * mode's unstated question; consent is an allow entry (`RunnerDeps.allowedTools` / `TaskSpec.allowedTools`). Without
+ * `allow`, everything not in `deny` gets no objection. Each entry is read by the rule
  * syntax (`ruleSpellingOf`): a name, or `Tool()` / `Tool(*)` — the bare `Tool`, as every list reader reads them, once however
  * many spellings write it; any other spelling is not a tool name (`onInvalidName`), and neither is the wildcard `*` (`*`,
  * `*()`, `*(*)`) in `deny`: it names no tool, and the entry would be kept and never match. In `allow` it is one entry no tool
@@ -975,13 +1019,6 @@ export declare function createAllowDenyPolicy(opts: {
         list: "allow" | "deny";
         message: string;
     }) => void;
-    /**
-     * What an `allow` list HIT means. `"grant"` (default): the deployment named this tool as permitted — a statement
-     * (`decisionReason: "rule"`) that satisfies the fold's unstated rule for a passthrough-seat tool. `"narrowing"`: the
-     * list only bounds WHICH tools a lane may see (an agent definition's `allowTools`); a hit is scope, not consent, and
-     * answers a bare allow — the mode's unstated question still goes to a person. The deny list is unaffected.
-     */
-    scope?: "grant" | "narrowing";
 }): NamedToolPolicy;
 /**
  * What `createApprovalPolicy`'s `approve` may resolve to: a boolean, or the `AskOutcome` OBJECT minus the
@@ -1030,7 +1067,8 @@ export declare function createApprovalPolicy(opts: {
     approve: (req: ToolCallRequest, signal?: AbortSignal) => ApprovalSeatOutcome | Promise<ApprovalSeatOutcome>;
     /** Always-denied tools. */
     deny?: string[];
-    /** Always-allowed tools (only meaningful with `denyByDefault`). */
+    /** The exceptions to `denyByDefault` (only meaningful with it): tools that get no objection without an approval. A narrowing,
+     *  not consent — a `passthrough`-seat tool named here still meets the mode's unstated question; consent is an allow entry. */
     autoAllow?: string[];
     /** When true, deny anything not in `requireApproval` or `autoAllow`. Default false. */
     denyByDefault?: boolean;
@@ -1050,12 +1088,11 @@ export declare function createApprovalPolicy(opts: {
  * short-circuit — scanning continues, because a later policy may still `deny` (which outranks ask).
  * With no deny, the first `ask` wins; with neither, `allow`.
  *
- * **An allow is STATED or not.** A layer that names the call (an allow rule, a list entry, an approver's yes, a mode's
- * release) says WHY on its allow (`decisionReason`); a bare allow is "no objection" — an empty table, a list the call is
- * not on, a layer that does not know the tool. The combined allow carries the FIRST stated reason in layer order, and a
- * statement binds the arguments its layer judged: a layer that rewrites the arguments voids every statement before it (its
- * own allow, if it states one, speaks for the new arguments). For a tool whose permission seat is `passthrough` an
- * unstated allow is not a permission — the gate puts the mode's question to it; for every other tool the two forms run alike.
+ * **A layer's allow is no objection, never consent.** What a combined allow carries beyond that is the engine RECORDS its
+ * layers' stations minted (an approver's yes inside a layer, an ancestor classifier's attribution), accumulated per member
+ * group; a yes binds the bytes it was given (its license), so a layer that rewrites the arguments afterwards leaves a yes that
+ * no longer covers what runs. For a tool whose permission seat is `passthrough` the gate puts the mode's question to a
+ * combined allow unless an answer covers the bytes that run ({@link answeredFor}) — the allow layer answers it there.
  *
  * **Idempotency requirement:** because the fold continues past an `ask` to look for a later `deny`, a
  * policy's `check()` can be invoked even after an earlier policy returned `ask`. `check()` MUST be
@@ -1847,8 +1884,8 @@ export declare function refusalOf<D extends PermissionResult>(deny: D, judged: u
 /**
  * A PreToolUse hook's `ask` folded over a verdict by `deny > ask > allow` — the ONE law for the gate's first screening and for
  * an approved edit's re-screen. A deny stands. Over an allow, the hook's own ask, RECONSTRUCTED rather than spread (its message,
- * its real-approval demand, its rewrite) under the hook provenance the engine stamps. Over an ask, that ask keeps every member,
- * takes the hook provenance and the hook's real-approval demand, and its message carries the hook's beside its own — a person
+ * its real-approval demand and cross-boundary member, its rewrite) under the hook provenance the engine stamps. Over an ask, that ask keeps every member,
+ * takes the hook provenance and the hook's real-approval demand and cross-boundary member, and its message carries the hook's beside its own — a person
  * clearing one ask that stands for two gates sees both reasons.
  */
 export declare function foldHookAsk(verdict: Exclude<PermissionResult, {
@@ -1986,10 +2023,14 @@ export type ResolverArmResult = (Extract<ResolvedAsk, {
     action: "allow";
 }> & {
     settlement?: Settlement;
-}) | (Extract<ResolvedAsk, {
+    bindingRefusal?: undefined;
+})
+/** `bindingRefusal`: the arm refused arguments no approval can be bound to — the record carries the sentence. */
+ | (Extract<ResolvedAsk, {
     action: "deny";
 }> & {
     settlement: Settlement;
+    bindingRefusal?: string;
 });
 /**
  * The DIRECTIONAL format controls, as a closed set (see {@link AskRequest.hasBidiControls}):

package/dist/core/tool-policy.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
-import { withArgsReading } from "./effective-path-target.js";
+import { argsReadFrom, carryArgsReadFrom, withArgsReading } from "./effective-path-target.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { decisionAskClassesOf, headlessDenialMessage } from "./ask-origin.js";
 import { ownReadRootCandidate, readRootGrantSeat } from "./read-root-grant-screen.js";
@@ -12,12 +12,12 @@ import { join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { protectivePathTargetOf, shellFaceToolNames } from "./tool-registry.js";
 import { heldBy } from "./tool-name-readings.js";
-import { boundInputHashOf } from "./canonical-json.js";
+import { bindableValueOf, boundInputHashOf, describeBindingFault, exactBoundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
 import { describeRejectedValue } from "./tool-search-setting.js";
 import { egressText, egressThrownText } from "./untrusted-egress.js";
 import { assertNoRetiredKeys, assertNoRetiredToolPolicyKeys, RETIRED_DECISION_MEMBERS, RETIRED_TOOL_POLICY_KEYS } from "./retired-keys.js";
-import { isEngineRefusal, nestedRecordsOf, receiveContract, receiveNestedRecords, refusedOutOfContract, screenContractValues } from "./decision-receipt.js";
+import { DECISION_MEMBER_ARMS, isEngineRefusal, nestedRecordsOf, receiveContract, receiveNestedRecords, refusedOutOfContract, screenContractValues } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "./permission-rules.js";
 import { ruleSpellingOf } from "./permission-rule-syntax.js";
@@ -45,6 +45,7 @@ const ATTESTATION_GROUP_OF = {
     unresolvableCause: "unresolvableCause",
     foldedClasses: "foldedClasses",
     pathDenial: "pathDenial",
+    bindingRefusal: "bindingRefusal",
 };
 const ATTESTATION_MEMBERS = Object.keys(ATTESTATION_GROUP_OF);
 const groupLead = (g) => ATTESTATION_MEMBERS.find((k) => ATTESTATION_GROUP_OF[k] === g);
@@ -146,6 +147,28 @@ export const ASK_EVIDENCE_ABSENCE_VALUES = ["not_wired", "not_adjudicated", "una
 export function decisionText(d) {
     return d.message;
 }
+export function licenseCovers(licensed, runs) {
+    return licensed !== undefined && (licensed === exactBoundInputHashOf(runs) || licensed === exactBoundInputHashOf(argsReadFrom(runs)));
+}
+export function bindableArgsOf(toolName, args) {
+    const bound = bindableValueOf(args);
+    if (!bound.ok)
+        return { ok: false, refusal: bindingRefusalOf(toolName, args, bound.fault) };
+    if (typeof args === "object" && args !== null && OWNED_ARGS.has(args))
+        return { ok: true, value: args };
+    if (typeof bound.value === "object" && bound.value !== null)
+        OWNED_ARGS.add(bound.value);
+    return { ok: true, value: bound.value };
+}
+export function bindingRefusalOf(toolName, args, fault) {
+    return (`no approval can be bound to the arguments of "${toolName}": they hold ${inlineUntrusted(describeBindingFault(args, fault), 300)} — an approval binds arguments that are ` +
+        `a record of plain JSON data (records, dense lists, strings, finite numbers, booleans, null; no getter, hidden member, Proxy, ` +
+        `function, symbol, bigint or object of another kind; no cycle or shared object) nested at most 256 levels deep; denied fail-closed`);
+}
+export function answeredFor(d, call, runs) {
+    const record = attestationOf(d, call);
+    return record?.settlement !== undefined && licenseCovers(record.inputDigest, runs);
+}
 const TOOL_POLICY_CARRIED_MEMBERS = ["projection", "pathRules", "writeGuardRows", "nameSets"];
 export function carriedMembersOf(p) {
     assertNoRetiredKeys(p, RETIRED_TOOL_POLICY_KEYS, "ToolPolicy");
@@ -259,12 +282,7 @@ export function constraintChainDigest(chain) {
     return `cpv1:${createHash("sha256").update(stableJson(chain)).digest("hex")}`;
 }
 const ALLOW = Object.freeze({ action: "allow" });
-const ALLOW_BY_RULE = Object.freeze({ action: "allow", decisionReason: "rule" });
-export const DECISION_MEMBERS = Object.keys({
-    action: 0, updatedInput: 0, message: 0, decisionReason: 0, requiresRealApproval: 0, denialLimitFallback: 0, classifierNoRuling: 0, allowRuleShadowed: 0, probeReason: 0,
-    probeCause: 0, probeMandated: 0, mandated: 0, mandate: 0, probeReadRootCandidate: 0, matchedAskRule: 0, ruleEvidence: 0, segmentCoverage: 0,
-    origin: 0, askClass: 0, classes: 0, guards: 0, ruleUnreadable: 0, authoredBy: 0, foldedAskClasses: 0, attestation: 0,
-});
+export const DECISION_MEMBERS = Object.keys(DECISION_MEMBER_ARMS);
 const HOOK_RESULT_MEMBERS = [...DECISION_MEMBERS, "additionalContext"];
 const HOOK_SEAM_UNREAD = new Set(["decisionReason"]);
 const HOOK_SEAM_OPTIONAL = new Set(["action"]);
@@ -315,7 +333,10 @@ export function refuseOutOfContractDecision(d, opts) {
         return refusedOutOfContract(`a permission decision's members could not be detached from the layer that returned them (${ownedRewrite.reason}) — ` +
             `the engine keeps its own copy of what it read; denied fail-closed`);
     }
-    const receipt = Object.freeze(attestation !== undefined ? { ...detached.value, attestation } : detached.value);
+    carryArgsReadFrom(contract.updatedInput, rewrite);
+    const held = detached.value;
+    const value = held.crossBoundaryMandated === true && held.requiresRealApproval !== true ? { ...held, requiresRealApproval: true } : held;
+    const receipt = Object.freeze(attestation !== undefined ? { ...value, attestation } : value);
     for (const v of Object.values(receipt))
         if (Array.isArray(v))
             Object.freeze(v);
@@ -355,6 +376,7 @@ export function toolPolicyNameSets(p) {
     return Array.isArray(sets) ? sets : [];
 }
 export function createAllowDenyPolicy(opts) {
+    assertNoRetiredKeys(opts, RETIRED_ALLOW_DENY_POLICY_OPTIONS, "createAllowDenyPolicy");
     const invalid = [];
     const screen = (entries, list) => {
         if (entries === undefined)
@@ -444,10 +466,13 @@ export function createAllowDenyPolicy(opts) {
             if (allow && !nameListHolds(allow, req) && !namespacedCoveringHit(allowCovering, req)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in the allowlist` };
             }
-            return allow && opts.scope !== "narrowing" ? ALLOW_BY_RULE : ALLOW;
+            return ALLOW;
         },
     };
 }
+const RETIRED_ALLOW_DENY_POLICY_OPTIONS = Object.freeze({
+    scope: "an allow list is only ever a narrowing now (a tool it does not name is denied; a tool it names gets no objection, not consent) — drop the option, and put the consent in the allow layer: `RunnerDeps.allowedTools` for the deployment's, `TaskSpec.allowedTools` for a request's",
+});
 export function createApprovalPolicy(opts) {
     if (opts.approvalTimeoutMs !== undefined && !Number.isFinite(opts.approvalTimeoutMs)) {
         throw new Error(`createApprovalPolicy: approvalTimeoutMs must be a finite number of ms (got ${opts.approvalTimeoutMs}) — omit it to wait indefinitely`);
@@ -481,17 +506,17 @@ export function createApprovalPolicy(opts) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
             if (nameListHolds(need, req) || namespacedCoveringHit(needCovering, req)) {
-                const attestOver = (inputDigest) => (d, settlement) => ({ ...d, attestation: mintAttestation(req, { settlement, origin: "policy", inputDigest }) });
+                const attestOver = (inputDigest) => (d, settlement, bindingRefusal) => ({ ...d, attestation: mintAttestation(req, { settlement, origin: "policy", ...(inputDigest !== undefined ? { inputDigest } : {}), ...(bindingRefusal !== undefined ? { bindingRefusal } : {}) }) });
                 const unasked = unaskedSeatAnswer(req, signal, { aborted: `approval aborted for "${req.toolName}" (run or turn interrupted)`, unreachable: `approval for "${req.toolName}" was not requested: nobody can be asked about this call` }, "policy");
                 if (unasked !== undefined)
                     return unasked;
-                const shown = tryCloneArgs(req.args);
-                if (!shown.ok) {
-                    return attestOver(boundInputHashOf(req.args))({ action: "deny", message: `approval for "${req.toolName}" could not present the args safely (unclonable value: ${shown.reason}) — denied fail-closed` }, settledByNobody("presentation_failed"));
-                }
-                const askedDigest = boundInputHashOf(shown.value);
+                const bound = bindableArgsOf(req.toolName, req.args);
+                if (!bound.ok)
+                    return attestOver(undefined)({ action: "deny", message: bound.refusal }, settledByNobody("presentation_failed"), bound.refusal);
+                const shown = { value: structuredClone(bound.value) };
+                const askedDigest = exactBoundInputHashOf(shown.value);
                 const attest = attestOver(askedDigest);
-                const heldWhileWaiting = () => boundInputHashOf(req.args) === askedDigest;
+                const heldWhileWaiting = () => licenseCovers(askedDigest, req.args);
                 const changedWhilePending = () => attest({
                     action: "deny",
                     message: `the arguments of "${req.toolName}" changed while its approval was pending — denied fail-closed ` +
@@ -544,7 +569,7 @@ export function createApprovalPolicy(opts) {
                 return attest({ action: "deny", message: `approval denied for "${req.toolName}"` }, settledByDecider("person", "refused", undefined));
             }
             if (nameListHolds(auto, req) || namespacedCoveringHit(autoCovering, req))
-                return ALLOW_BY_RULE;
+                return ALLOW;
             if (opts.denyByDefault) {
                 return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
             }
@@ -587,7 +612,6 @@ export function combinePolicies(...policies) {
             let asked;
             let current = Object.freeze({ ...req });
             let rewrite;
-            let stated;
             let records;
             let ruleAskText;
             let probeMandateSeen = false;
@@ -614,10 +638,6 @@ export function combinePolicies(...policies) {
                 if (d.updatedInput !== undefined) {
                     current = Object.freeze(await withArgsReading(current, d.updatedInput, signal));
                     rewrite = d;
-                    stated = d.action === "allow" ? d.decisionReason : undefined;
-                }
-                else if (d.action === "allow" && stated === undefined && d.decisionReason !== undefined) {
-                    stated = d.decisionReason;
                 }
                 if (d.action === "allow" && d.attestation !== undefined)
                     records = mergeAttestation(req, records, d.attestation);
@@ -662,8 +682,7 @@ export function combinePolicies(...policies) {
                 const out = merged !== undefined ? { ...withClasses, updatedInput: merged } : withClasses;
                 return folded.size > 0 ? attest(out, req, { foldedClasses: [...folded] }) : out;
             }
-            const base = rewrite ?? ALLOW;
-            const allowed = stated !== undefined && base.decisionReason !== stated ? { ...base, decisionReason: stated } : base;
+            const allowed = rewrite ?? ALLOW;
             return records === undefined ? allowed : { ...allowed, attestation: records };
         },
     };
@@ -713,7 +732,7 @@ export function createCoarseCommandNamePolicy(opts) {
             if (allow && !allow.has(parsed.name)) {
                 return fallback(`command "${parsed.name}" is not in the allowlist`);
             }
-            return allow ? ALLOW_BY_RULE : ALLOW;
+            return ALLOW;
         },
     }, "sandbox_local");
 }
@@ -899,7 +918,7 @@ export function refusalOf(deny, judged) {
 export function foldHookAsk(verdict, hookAsk) {
     if (verdict.action === "deny")
         return verdict;
-    const mandate = hookAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {};
+    const mandate = { ...(hookAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}), ...(hookAsk.crossBoundaryMandated === true ? { crossBoundaryMandated: true } : {}) };
     if (verdict.action === "allow") {
         return { action: "ask", ...(hookAsk.message !== undefined ? { message: hookAsk.message } : {}), decisionReason: "hook", ...mandate, ...(hookAsk.updatedInput !== undefined ? { updatedInput: hookAsk.updatedInput } : {}) };
     }
@@ -1077,12 +1096,12 @@ export function carriesBidiControls(value, limits) {
     }
 }
 export async function resolveAsk(req, onAsk, signal, onLateSettlement) {
-    const askedDigest = boundInputHashOf(req.args);
-    const { settlement, ...r } = await resolveAskArms(req, onAsk, signal, onLateSettlement);
+    const askedDigest = exactBoundInputHashOf(req.args);
+    const { settlement, bindingRefusal, ...r } = await resolveAskArms(req, onAsk, signal, onLateSettlement);
     if (settlement === undefined)
         return r;
-    const licensedDigest = r.action === "allow" && r.updatedInput !== undefined ? boundInputHashOf(r.updatedInput) : r.presentedInput !== undefined ? boundInputHashOf(r.presentedInput) : askedDigest;
-    return attest(r, req, { settlement, ...(req.origin !== undefined ? { origin: req.origin } : {}), ...(req.classes !== undefined ? { classes: req.classes } : {}), inputDigest: licensedDigest });
+    const licensedDigest = r.action === "allow" && r.updatedInput !== undefined ? exactBoundInputHashOf(r.updatedInput) : r.presentedInput !== undefined ? exactBoundInputHashOf(r.presentedInput) : askedDigest;
+    return attest(r, req, { settlement, ...(req.origin !== undefined ? { origin: req.origin } : {}), ...(req.classes !== undefined ? { classes: req.classes } : {}), ...(licensedDigest !== undefined ? { inputDigest: licensedDigest } : {}), ...(bindingRefusal !== undefined ? { bindingRefusal } : {}) });
 }
 function raceAskWaitAgainstSignal(wait, signal) {
     const settledWait = wait.then((value) => ({ tag: "value", value }), (error) => ({ tag: "threw", error }));
@@ -1198,10 +1217,9 @@ function readApproverOutcomeObject(ok, toolName, editLane) {
             `re-adjudication an approver's edit gets; denied fail-closed (approve or refuse what was shown, and route edits ` +
             `through the run's approver seat)`, settledByNobody("approver_contract"));
     }
-    const edit = ownArgs(suppliedEdit);
-    if (!edit.ok) {
-        return refused(`the approved edit for "${toolName}" is not safely clonable (${edit.reason}) — denied fail-closed`, settledByNobody("presentation_failed"));
-    }
+    const edit = bindableArgsOf(toolName, suppliedEdit);
+    if (!edit.ok)
+        return { kind: "refused", message: edit.refusal, settlement: settledByNobody("presentation_failed"), binding: true };
     return { kind: "allow", edit: { value: edit.value }, settlement: settledByDecider(decider, "allowed", attribution.approver), grant };
 }
 async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
@@ -1211,37 +1229,25 @@ async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
         return { action: "allow", decisionReason: "mode" };
     }
     if (onAsk === undefined || onAsk === "deny") {
+        const bound = bindableArgsOf(req.toolName, req.args);
         return {
             action: "deny",
-            message: headlessDenialMessage(req.toolName, req.message),
+            message: bound.ok ? headlessDenialMessage(req.toolName, req.message) : bound.refusal,
             decisionReason: "mode",
             settlement: settledByNobody("no_approver"),
+            ...(bound.ok ? {} : { bindingRefusal: bound.refusal }),
         };
     }
     if (signal?.aborted) {
         return { action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, decisionReason: "mode", settlement: settledByNobody("task_aborted") };
     }
-    const presented = ownArgs(req.args);
-    if (!presented.ok) {
-        return {
-            action: "deny",
-            message: `approval for "${req.toolName}" could not present the args safely (${presented.reason}) — denied fail-closed`,
-            decisionReason: "mode",
-            settlement: settledByNobody("presentation_failed"),
-        };
-    }
+    const presented = bindableArgsOf(req.toolName, req.args);
+    if (!presented.ok)
+        return { action: "deny", message: presented.refusal, decisionReason: "mode", settlement: settledByNobody("presentation_failed"), bindingRefusal: presented.refusal };
     const offered = ownReadRootCandidate(req.readRootCandidate);
     let ok;
     try {
-        const approverView = tryCloneArgs(presented.value);
-        if (!approverView.ok) {
-            return {
-                action: "deny",
-                message: `approval for "${req.toolName}" could not present the args safely (unclonable value: ${approverView.reason}) — denied fail-closed`,
-                decisionReason: "mode",
-                settlement: settledByNobody("presentation_failed"),
-            };
-        }
+        const approverView = { value: structuredClone(presented.value) };
         const bidi = carriesBidiControls(presented.value) || carriesBidiControls(req.preview);
         const { hasBidiControls: _carried, ...bare } = req;
         const wait = Promise.resolve(onAsk({
@@ -1295,7 +1301,7 @@ async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
     if (typeof ok === "object" && ok !== null) {
         const reading = readApproverOutcomeObject(ok, req.toolName, "readjudicated");
         if (reading.kind === "refused")
-            return { action: "deny", message: reading.message, decisionReason: "mode", settlement: reading.settlement };
+            return { action: "deny", message: reading.message, decisionReason: "mode", settlement: reading.settlement, ...(reading.binding === true ? { bindingRefusal: reading.message } : {}) };
         if (reading.kind === "allow" && reading.settlement.who.party === "policy" && req.requiresRealApproval === true) {
             return { ...unjudgedAllowRefused(req, "policy"), ...readRootGrantSeat(reading.grant, offered, false) };
         }