@sema-agent/core 7.53.0 → 7.54.1

package/dist/core/cross-boundary-taint.js

@@ -0,0 +1,196 @@
+import { hasConversationContent } from "./session.js";
+export const CROSS_BOUNDARY_TAINT_BITS = Object.freeze(["targetExecutionArmed", "offTargetReadObserved"]);
+export const CROSS_BOUNDARY_POSTURES = Object.freeze(["single_user", "multi_tenant"]);
+const postureSeatIsTheSet = true;
+void postureSeatIsTheSet;
+export const BOUNDARY_LEGS = Object.freeze(["env", "outside_read", "outside_write"]);
+const LEG_SET = new Set(BOUNDARY_LEGS);
+const OBLIGATION_TABLE = {
+    env_to_target: { host_lane: "none", armed: "none", armed_observed: "mandate_if_governed" },
+    outside_read: { host_lane: "none", armed: "record", armed_observed: "none" },
+    outside_write: { host_lane: "none", armed: "mandate_if_governed", armed_observed: "mandate_if_governed" },
+};
+const ENV_LEG_ROWS = { target: ["env_to_target"], off_target: ["outside_read", "outside_write"] };
+const TREE_MEMBERS = [...CROSS_BOUNDARY_TAINT_BITS, "governed"];
+function assertTree(tree, at) {
+    if (typeof tree !== "object" || tree === null || Array.isArray(tree))
+        throw new TypeError(`${at}: a cross-boundary tree is a record of presence bits (got ${tree === null ? "null" : Array.isArray(tree) ? "an array" : typeof tree})`);
+    for (const member of TREE_MEMBERS) {
+        const v = tree[member];
+        if (v !== undefined && v !== true)
+            throw new TypeError(`${at}: tree member "${member}" is presence-coded (true or absent), got ${typeof v}`);
+    }
+}
+export function crossBoundaryObligation(legs, reachedEnvIsTarget, tree) {
+    if (!Array.isArray(legs))
+        throw new TypeError(`crossBoundaryObligation: legs is a list of ${BOUNDARY_LEGS.join(" | ")}`);
+    if (typeof reachedEnvIsTarget !== "boolean")
+        throw new TypeError("crossBoundaryObligation: reachedEnvIsTarget is a boolean");
+    assertTree(tree, "crossBoundaryObligation");
+    const column = tree.targetExecutionArmed !== true ? "host_lane" : tree.offTargetReadObserved === true ? "armed_observed" : "armed";
+    let mandate = false;
+    let record = false;
+    for (const leg of legs) {
+        if (!LEG_SET.has(leg))
+            throw new TypeError(`crossBoundaryObligation: ${JSON.stringify(leg)} is not a boundary leg (${BOUNDARY_LEGS.join(", ")})`);
+        const rows = leg === "env" ? ENV_LEG_ROWS[reachedEnvIsTarget ? "target" : "off_target"] : [leg];
+        for (const row of rows) {
+            const cell = OBLIGATION_TABLE[row][column];
+            if (cell === "record")
+                record = true;
+            else if (cell === "mandate_if_governed" && crossBoundaryTreeGoverned(tree))
+                mandate = true;
+        }
+    }
+    return Object.freeze({ mandate, record });
+}
+export function crossBoundaryTreeGoverned(tree) {
+    return tree.governed === true;
+}
+export function joinCrossBoundaryTree(a, b) {
+    assertTree(a, "joinCrossBoundaryTree");
+    assertTree(b, "joinCrossBoundaryTree");
+    const out = {};
+    if (a.targetExecutionArmed === true || b.targetExecutionArmed === true)
+        out.targetExecutionArmed = true;
+    if (a.offTargetReadObserved === true || b.offTargetReadObserved === true)
+        out.offTargetReadObserved = true;
+    if (a.governed === true || b.governed === true)
+        out.governed = true;
+    return Object.freeze(out);
+}
+export function crossBoundaryTreeCovers(covering, tree) {
+    assertTree(covering, "crossBoundaryTreeCovers");
+    assertTree(tree, "crossBoundaryTreeCovers");
+    return TREE_MEMBERS.every((m) => tree[m] !== true || covering[m] === true);
+}
+export const STRICTEST_CROSS_BOUNDARY_TREE = Object.freeze({ targetExecutionArmed: true, offTargetReadObserved: true, governed: true });
+export const CROSS_BOUNDARY_RECORD_TYPE = "engine:cross_boundary";
+export function crossBoundaryRecordData(tree) {
+    assertTree(tree, "crossBoundaryRecordData");
+    if (tree.targetExecutionArmed !== true)
+        throw new TypeError("crossBoundaryRecordData: only an armed tree is recorded");
+    return Object.freeze({ targetExecutionArmed: true, ...(tree.offTargetReadObserved === true ? { offTargetReadObserved: true } : {}), ...(tree.governed === true ? { governed: true } : {}) });
+}
+const RECORD_MEMBERS = TREE_MEMBERS;
+function ownedRecordTree(data) {
+    if (typeof data !== "object" || data === null || Array.isArray(data) || Object.getPrototypeOf(data) !== Object.prototype)
+        return { why: `its data is ${data === null ? "null" : Array.isArray(data) ? "an array" : typeof data === "object" ? "not a plain record" : typeof data}` };
+    const owned = new Map();
+    for (const key of Reflect.ownKeys(data)) {
+        if (typeof key !== "string" || !RECORD_MEMBERS.includes(key))
+            return { why: `its data carries ${typeof key === "string" ? JSON.stringify(key.slice(0, 40)) : "a symbol key"}, which is not a member` };
+        const d = Object.getOwnPropertyDescriptor(data, key);
+        if (d === undefined || !("value" in d))
+            return { why: `"${key}" is not a data member` };
+        owned.set(key, d.value);
+    }
+    if (owned.get("targetExecutionArmed") !== true)
+        return { why: `"targetExecutionArmed" is not true` };
+    for (const m of ["offTargetReadObserved", "governed"])
+        if (owned.get(m) !== undefined && owned.get(m) !== true)
+            return { why: `"${m}" is neither true nor absent` };
+    return { tree: Object.freeze({ targetExecutionArmed: true, ...(owned.get("offTargetReadObserved") === true ? { offTargetReadObserved: true } : {}), ...(owned.get("governed") === true ? { governed: true } : {}) }) };
+}
+function readBranchEntry(branch, i) {
+    let id;
+    try {
+        const e = branch[i];
+        if (typeof e !== "object" || e === null)
+            return { kind: "other", content: false };
+        const { type, customType } = e;
+        if (type !== "custom" || customType !== CROSS_BOUNDARY_RECORD_TYPE)
+            return { kind: "other", content: typeof type === "string" && hasConversationContent([{ type }]) };
+        const rawId = e.id;
+        id = typeof rawId === "string" ? rawId : undefined;
+        const read = ownedRecordTree(e.data);
+        return "why" in read ? { kind: "unreadable", ...(id !== undefined ? { id } : {}), why: read.why } : { kind: "record", ...(id !== undefined ? { id } : {}), tree: read.tree };
+    }
+    catch {
+        return { kind: "unreadable", ...(id !== undefined ? { id } : {}), why: "an entry on the branch could not be read" };
+    }
+}
+export function readCrossBoundaryRecord(branch) {
+    const strictest = (id, why) => Object.freeze({ kind: "malformed", ...(id !== undefined ? { entryId: id } : {}), tree: STRICTEST_CROSS_BOUNDARY_TREE, why: `the cross-boundary record on this branch cannot be read: ${why}` });
+    let isList;
+    let length;
+    try {
+        isList = Array.isArray(branch);
+        length = isList ? branch.length : undefined;
+    }
+    catch {
+        return strictest(undefined, "the branch could not be read");
+    }
+    if (!isList)
+        throw new TypeError("readCrossBoundaryRecord: the branch is a list of session entries");
+    if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0)
+        return strictest(undefined, "the branch could not be read");
+    let joined;
+    let newest;
+    let uncoveredContent = false;
+    for (let i = 0; i < length; i++) {
+        const entry = readBranchEntry(branch, i);
+        if (entry.kind === "other") {
+            uncoveredContent ||= entry.content;
+            continue;
+        }
+        if (entry.kind === "unreadable")
+            return strictest(entry.id, entry.why);
+        joined = joinCrossBoundaryTree(joined ?? {}, entry.tree);
+        newest = entry.id;
+        uncoveredContent = false;
+    }
+    return joined === undefined ? Object.freeze({ kind: "absent", uncoveredContent }) : Object.freeze({ kind: "recorded", ...(newest !== undefined ? { entryId: newest } : {}), tree: joined, uncoveredContent });
+}
+export function crossBoundaryPostureUndeclaredNotice(at) {
+    assertTree(at.tree, "crossBoundaryPostureUndeclaredNotice");
+    return {
+        code: "config.cross_boundary_posture_undeclared",
+        message: 'This run executes on an external-content target (the device lane) and no RunnerDeps.crossBoundaryPosture is configured — the engine reads the permissive "single_user" posture. ' +
+            'On a multi-tenant deployment declare "multi_tenant", so an org-side write from a tainted run is put to a person; on a single-user deployment declare "single_user" to silence this line.',
+        detail: { sessionId: at.sessionId, runId: at.runId, taint: CROSS_BOUNDARY_TAINT_BITS.filter((b) => at.tree[b] === true) },
+    };
+}
+export function crossBoundaryRecordUnwrittenNotice(at) {
+    return {
+        code: "config.cross_boundary_record_unwritten",
+        message: `The session's cross-boundary record could not be written at ${at.phase} (${at.cause.slice(0, 300)}) — ` +
+            (at.governed
+                ? "the tree is governed: the next leg on this session reads the content after its newest record as off-target, so its device calls are put to a person."
+                : "the tree is not governed: no judgment reads the record, so its failure refused nothing; the tree's growth, or the leg's end, writes next."),
+        detail: { sessionId: at.sessionId, runId: at.runId, phase: at.phase, governed: at.governed, cause: at.cause.slice(0, 300) },
+    };
+}
+const NO_LEGS = Object.freeze([]);
+export function boundaryFlowFace(entry) {
+    return entry?.boundaryFlow === "engine" ? { boundaryLegs: NO_LEGS } : {};
+}
+function ownedLegList(v) {
+    try {
+        if (!Array.isArray(v))
+            return undefined;
+        const length = v.length;
+        if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0)
+            return undefined;
+        const held = new Set();
+        for (let i = 0; i < length; i++) {
+            const leg = v[i];
+            if (!LEG_SET.has(leg))
+                return undefined;
+            held.add(leg);
+        }
+        return BOUNDARY_LEGS.filter((l) => held.has(l));
+    }
+    catch {
+        return undefined;
+    }
+}
+export function rosterBoundaryLegs(source, declared, effect) {
+    const list = declared === undefined || declared === "per_call" ? undefined : ownedLegList(declared);
+    if (declared !== undefined && declared !== "per_call" && list === undefined)
+        return undefined;
+    const reads = source === "builtin" || source === "synthetic" || source === "mcp" || source === "a2a";
+    if (!reads || declared === undefined)
+        return effect === "read" ? ["outside_read"] : ["outside_write"];
+    return declared === "per_call" ? "per_call" : list;
+}

package/dist/core/decision-receipt.d.ts

@@ -1,4 +1,5 @@
-import type { PermissionResult } from "./tool-policy.js";
+import { type AssertAllKeysHandled } from "./ask-origin.js";
+import type { DecisionMember, PermissionResult } from "./tool-policy.js";
 export declare const refusedOutOfContract: (message: string) => PermissionResult;
 /** Is `d` a refusal the engine itself minted (by object identity — a look-alike `deny` a caller built is not one)? The receipt's
  *  answer is one of two things (the engine's refusal or its detached copy), and this tells them apart. */
@@ -12,6 +13,48 @@ export declare const isEngineRefusal: (d: unknown) => boolean;
  *  two entry-list members) — one word per author, so "who said this needs no asking" is read off the decision. */
 declare const DECISION_REASONS: readonly ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill", "deployment_rule", "request_rule"];
 export type DecisionReason = (typeof DECISION_REASONS)[number];
+/** The arms of the decision union that declare member `M`. */
+type ArmOf<M extends DecisionMember> = PermissionResult extends infer U ? (U extends {
+    action: infer A;
+} ? (M extends keyof U ? A : never) : never) : never;
+/**
+ * Every member of the decision union with the ARMS that declare it — the one table the receipt's member list is read off
+ * (`DECISION_MEMBERS`), fenced to the union both ways: `satisfies` admits no member and no arm the union lacks, and
+ * {@link DecisionMemberArmsCoverTheUnion} no arm the union has and a row lacks. A present member on an arm outside its row is
+ * out of contract like a word outside a closed set ({@link screenContractValues}): an ask's mark on an allow or a deny is a
+ * decision that contradicts itself, and a consumer branching on the member would read the other arm's meaning.
+ */
+export declare const DECISION_MEMBER_ARMS: Readonly<{
+    readonly action: readonly ["allow", "ask", "deny"];
+    readonly updatedInput: readonly ["allow", "ask", "deny"];
+    readonly message: readonly ["allow", "ask", "deny"];
+    readonly decisionReason: readonly ["allow", "ask", "deny"];
+    readonly attestation: readonly ["allow", "ask", "deny"];
+    readonly requiresRealApproval: readonly ["ask"];
+    readonly denialLimitFallback: readonly ["ask"];
+    readonly classifierNoRuling: readonly ["ask"];
+    readonly allowRuleShadowed: readonly ["ask"];
+    readonly probeReason: readonly ["ask"];
+    readonly probeCause: readonly ["ask"];
+    readonly probeMandated: readonly ["ask"];
+    readonly crossBoundaryMandated: readonly ["ask"];
+    readonly mandated: readonly ["ask"];
+    readonly mandate: readonly ["ask"];
+    readonly probeReadRootCandidate: readonly ["ask"];
+    readonly matchedAskRule: readonly ["ask"];
+    readonly ruleEvidence: readonly ["ask"];
+    readonly segmentCoverage: readonly ["ask"];
+    readonly origin: readonly ["ask"];
+    readonly askClass: readonly ["ask"];
+    readonly classes: readonly ["ask"];
+    readonly guards: readonly ["ask"];
+    readonly ruleUnreadable: readonly ["ask"];
+    readonly authoredBy: readonly ["ask"];
+    readonly foldedAskClasses: readonly ["ask"];
+}>;
+export type DecisionMemberArmsCoverTheUnion = AssertAllKeysHandled<{
+    [M in DecisionMember]: Exclude<ArmOf<M>, (typeof DECISION_MEMBER_ARMS)[M][number]>;
+}[DecisionMember]>;
 export declare const RETIRED_WINDOW_MEMBER_DENY_MESSAGE: string;
 export declare const carriesRetiredWindow: (fallback: unknown) => boolean;
 /**

package/dist/core/decision-receipt.js

@@ -32,8 +32,17 @@ const CLOSED_MEMBERS = [
     { member: "classifierNoRuling", words: AUTO_MODE_FALLBACK_CAUSES, has: isAutoModeFallbackCause },
     { member: "requiresRealApproval", words: [true, false], has: (v) => v === true || v === false },
     { member: "probeMandated", words: [true], has: (v) => v === true },
+    { member: "crossBoundaryMandated", words: [true], has: (v) => v === true },
     { member: "mandated", words: [true], has: (v) => v === true },
 ];
+const EVERY_ARM = ["allow", "ask", "deny"];
+const ASK = ["ask"];
+export const DECISION_MEMBER_ARMS = Object.freeze({
+    action: EVERY_ARM, updatedInput: EVERY_ARM, message: EVERY_ARM, decisionReason: EVERY_ARM, attestation: EVERY_ARM,
+    requiresRealApproval: ASK, denialLimitFallback: ASK, classifierNoRuling: ASK, allowRuleShadowed: ASK, probeReason: ASK, probeCause: ASK,
+    probeMandated: ASK, crossBoundaryMandated: ASK, mandated: ASK, mandate: ASK, probeReadRootCandidate: ASK, matchedAskRule: ASK, ruleEvidence: ASK,
+    segmentCoverage: ASK, origin: ASK, askClass: ASK, classes: ASK, guards: ASK, ruleUnreadable: ASK, authoredBy: ASK, foldedAskClasses: ASK,
+});
 const RETIRED_WINDOW_MEMBER = "autoDenyAfterMs";
 export const RETIRED_WINDOW_MEMBER_DENY_MESSAGE = `a permission decision's "denialLimitFallback" carries "${RETIRED_WINDOW_MEMBER}" — the decision names the counts only; ` +
     `the auto-deny window is decided by the ask's route (a live approver arms it, every other route runs none) and cannot be ` +
@@ -91,6 +100,13 @@ export function screenContractValues(contract, opts) {
             continue;
         return unrecognized(member, v, words);
     }
+    const arm = contract.action;
+    for (const [member, arms] of Object.entries(DECISION_MEMBER_ARMS)) {
+        if (contract[member] === undefined || (arm === undefined ? EVERY_ARM.every((a) => arms.includes(a)) : arms.includes(arm)))
+            continue;
+        return refusedOutOfContract(`a permission decision carries "${member}" on ${arm === undefined ? "a result with no action (no opinion)" : `its "${arm}" arm`} — the member belongs to ` +
+            `the ${arms.join("/")} arm only; denied fail-closed rather than letting consumers branch on a member its arm does not hold`);
+    }
     if (carriesRetiredWindow(contract.denialLimitFallback))
         return refusedOutOfContract(RETIRED_WINDOW_MEMBER_DENY_MESSAGE);
     return undefined;

package/dist/core/effective-path-target.d.ts

@@ -262,6 +262,9 @@ export declare function argsAsTheToolReads(req: {
 export declare function argsReadBy(read: (args: unknown) => unknown, args: unknown): unknown;
 /** The value `args` was read from, when a reading moved it; otherwise `args` itself. */
 export declare function argsReadFrom(args: unknown): unknown;
+/** `copy` is a detached copy of `original` (the decision receipt's): the same bytes, so read from what `original` was read
+ *  from — the recorded step survives the copy instead of being lost to the copy's new identity. */
+export declare function carryArgsReadFrom(original: unknown, copy: unknown): void;
 /**
  * `req` with its arguments replaced by `args` AS THE TOOL READS THEM ({@link argsAsTheToolReads}) and — when `req` carries
  * a reading of its own target — a reading of the NEW args taken the same way (same environment, same root / cwd, same

package/dist/core/effective-path-target.js

@@ -167,6 +167,10 @@ const READ_FROM = new WeakMap();
 export function argsReadFrom(args) {
     return typeof args === "object" && args !== null && READ_FROM.has(args) ? READ_FROM.get(args) : args;
 }
+export function carryArgsReadFrom(original, copy) {
+    if (typeof original === "object" && original !== null && READ_FROM.has(original) && typeof copy === "object" && copy !== null)
+        READ_FROM.set(copy, READ_FROM.get(original));
+}
 export async function withArgsReading(req, args, signal) {
     const read = argsAsTheToolReads(req, args);
     const reading = callTargetReadingOf(req);

package/dist/core/engine-notice.d.ts

@@ -399,6 +399,16 @@ export interface EngineNotice {
      *    ({@link import("./secret-env.js").holdOwnCredentialValues}); `detail: { reason }` — the kind, never the value. Delivered
      *    to `RunnerDeps.onNotice` from the `new Runner` receipt; the intakes with no structured seat (a brain's construction,
      *    a request's route reading, a peer's dial, a directly built distiller seat) print its line on `console.warn`.
+     *  - `"config.cross_boundary_posture_undeclared"` — a run whose tree executes on a target device (armed) on a deployment that
+     *    configured no `RunnerDeps.crossBoundaryPosture`: the permissive `"single_user"` reading is in force. Once per run;
+     *    `detail: { sessionId, runId, taint }` — `taint` lists the tree's taint bits
+     *    ({@link import("./cross-boundary-taint.js").CROSS_BOUNDARY_TAINT_BITS}). Minted by
+     *    {@link import("./cross-boundary-taint.js").crossBoundaryPostureUndeclaredNotice}. Audience `operator`.
+     *  - `"config.cross_boundary_record_unwritten"` — a session's cross-boundary record the engine owed could not be written (the
+     *    store threw, or answered with no entry id) and refused nothing: on a tree that is not governed no judgment reads the record;
+     *    at a governed leg's prepare or settle the next leg reads the content after the newest record as off-target. Per failed write;
+     *    `detail: { sessionId, runId, phase, governed, cause }` (`phase`: `prepare` / `exit` / `suspend` / `settle`). Minted by
+     *    {@link import("./cross-boundary-taint.js").crossBoundaryRecordUnwrittenNotice}. Audience `operator`.
      *  - `"config.permission_mode_unavailable"` — the permission mode a task requested is not the mode the leg runs
      *    under: the deployment denies it (`by: "operator_deny"` — `RuntimeCaps.bypassPermissions` / `autoMode` is
      *    `false`), a requested `auto` has no classifier face (`by: "face_absent"` — neither the leg's deps nor its chain carry
@@ -477,7 +487,13 @@ export interface EngineNotice {
      *    frame's two count keys). They are NOT redelivered (a steer aimed at a finished run must not
      *    fire at the next one — unlike ENGINE notes, which pend per session); the loud half of the
      *    #257 contract's "accepted = enqueued, not consumed" sentence;
-     *    `detail: { <countKey>, cause, taskId?, sessionId?, runId? }` (the `code` and the `countKey` of each family are the
+     *    The words a person wrote on an approval card (a durable `policy_ask` allow's `feedback`) that did not reach the
+     *    model are counted in the SAME account under the steer code — one more row of that family, `detail.kind:
+     *    "approval_feedback"` (absent on every other row) — when the message carrying them never committed and the row did not come back
+     *    (a returned row does not carry them: its next decide is fresh); when the pause tried to carry them forward and the parked-steer
+     *    carrier refused, the row also names the store's refusal as `detail.carry` (`steering.invalid_content` | `steering.queue_full`) and
+     *    its sentence says so (`cause` stays `leg_end`: the leg ended with them owed — the closed set has no carrier words);
+     *    `detail: { <countKey>, cause, kind?, carry?, taskId?, sessionId?, runId? }` (the `code` and the `countKey` of each family are the
      *    table {@link USER_INPUT_UNDRAINED_FAMILIES}, keyed by the lane the input was queued on — `injectionLaneOf` — and the
      *    minter writes exactly those; `cause` on both rows, closed `USER_INPUT_UNDRAINED_CAUSES`: `"leg_end"` — this engine's arm, the
      *    leg ended with it still owed; `"crashed"` — minted by the SERVING LAYER, not this engine, before the
@@ -874,7 +890,8 @@ export interface EngineNotice {
      *    toolCallId, cause, parkLaneExisted, remedy? }` — `parkLaneExisted` says whether a park lane was armed and
      *    declined/failed (`true`) or none existed (`false`, the usual shape); `remedy` (the two causes that say nobody
      *    could be asked — `approver_unavailable` and `no_approver_wired`; never `mandate_unreconstructible`)
-     *    is the one sentence naming the caller-side change that would have let the call run, as the tool text carries it. Audience `"user"`: the refused
+     *    is the one sentence naming the caller-side change that would have let the call run, as the tool text carries it (for arguments
+     *    no approval can be bound to, the binding's own sentence: the remedy's approver half would not let them run). Audience `"user"`: the refused
      *    work is the session user's own; the operator hears it through the sink like every code.
      *
      *  - `"memory.consolidation_recommended"` (design/339 §2.2/§6.2) — the engine-minted per-scope
@@ -1015,6 +1032,16 @@ export interface OwedUserInputAccount {
             seq?: number;
         }>;
         carried: number;
+        /** The approving person's words (a `policy_ask` allow's `feedback`), counted APART from `frames`: owed, and how many the migration carried.
+         *  They are on no row of their own, and a returned row (the compensation reopened it) does not carry them either — its next decide is a
+         *  fresh one the host may re-supply them on — so, unlike the caller's own frames, they are not announced when the row came back (the row is
+         *  pending again and the person is asked again). `refusal`: the code the parked-steer carrier answered when the pause tried to carry them
+         *  (`steering.invalid_content` — over its bound; `steering.queue_full`), the store's own words; absent when no carry was refused. */
+        approval?: {
+            owed: number;
+            carried: number;
+            refusal?: ApprovalCarryRefusal;
+        };
     };
 }
 /**
@@ -1069,6 +1096,9 @@ export declare function settleOwedUserInput(account: OwedUserInputAccount, rowRe
  */
 export declare const USER_INPUT_UNDRAINED_CAUSES: readonly ["leg_end", "crashed"];
 export type UserInputUndrainedCause = (typeof USER_INPUT_UNDRAINED_CAUSES)[number];
+/** What the parked-steer carrier answered (the checkpoint store's own refusal codes, not a set of this notice) when a pause tried to carry an
+ *  approving person's words: refused as content / over its bound, or its queue was full. `detail.carry` of the approval row, absent otherwise. */
+export type ApprovalCarryRefusal = "steering.invalid_content" | "steering.queue_full";
 /**
  * The two families of the stranded-input account, keyed by the lane the input was queued on (`injectionLaneOf` maps a steer's
  * tier to it): the notice `code` the family is announced under, and the `detail` key that carries its count
@@ -1113,5 +1143,7 @@ export declare function parentLegIds(internals: {
 export declare function undrainedUserInputNotices(counts: {
     steer: number;
     followUp: number;
+    approvalFeedback?: number;
+    approvalCarry?: ApprovalCarryRefusal;
 }, taskId?: string, sessionId?: string, runId?: string, parent?: ParentLegIds): EngineNotice[];
 export {};

package/dist/core/engine-notice.js

@@ -44,7 +44,10 @@ export function settleOwedUserInput(account, rowReturned, ids, onNotice) {
     SETTLED_OWED_ACCOUNTS.add(account);
     try {
         const owed = owedUserInputCounts(account.held, account.migrated, { ...account.continuation, rowReturned });
-        for (const notice of undrainedUserInputNotices(owed, ids.taskId, ids.sessionId, ids.runId, ids.parent))
+        const approval = account.continuation.approval;
+        const approvalFeedback = approval === undefined || rowReturned ? 0 : Math.max(0, approval.owed - approval.carried);
+        const approvalCarry = approvalFeedback > 0 ? approval?.refusal : undefined;
+        for (const notice of undrainedUserInputNotices({ ...owed, ...(approvalFeedback > 0 ? { approvalFeedback } : {}), ...(approvalCarry !== undefined ? { approvalCarry } : {}) }, ids.taskId, ids.sessionId, ids.runId, ids.parent))
             deliverEngineNotice(onNotice, notice);
     }
     catch {
@@ -84,6 +87,19 @@ export function undrainedUserInputNotices(counts, taskId, sessionId, runId, pare
         if (toParent)
             copies.push({ code: STEER_UNDRAINED, message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
     }
+    const approvalFeedback = counts.approvalFeedback ?? 0;
+    if (approvalFeedback > 0) {
+        const why = counts.approvalCarry === "steering.invalid_content"
+            ? "the leg paused with them still owed and the parked-steer carrier refused them (longer than a parked steer may be)"
+            : counts.approvalCarry === "steering.queue_full"
+                ? "the leg paused with them still owed and the parked-steer carrier refused them (its queue was full)"
+                : "the leg ended before the message carrying them was committed";
+        const message = `${approvalFeedback} approval-card feedback(s) (the words a person wrote when approving a tool call) never reached the model — ${why}. They are NOT redelivered; re-send if still wanted.`;
+        const count = { [USER_INPUT_UNDRAINED_FAMILIES.steer.countKey]: approvalFeedback, cause, kind: "approval_feedback", ...(counts.approvalCarry !== undefined ? { carry: counts.approvalCarry } : {}) };
+        own.push({ code: STEER_UNDRAINED, message, detail: { ...count, ...tid, ...sid, ...rid } });
+        if (toParent)
+            copies.push({ code: STEER_UNDRAINED, message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
+    }
     if (counts.followUp > 0) {
         const message = `${counts.followUp} user follow-up(s) ${tail}`;
         const count = { [USER_INPUT_UNDRAINED_FAMILIES.followUp.countKey]: counts.followUp, cause };

package/dist/core/engine-storage-backend.d.ts

@@ -0,0 +1,73 @@
+/**
+ * The engine's storage seats as ONE backend contract.
+ *
+ * A backend is the thing a deployment constructs over one storage — a data root, a database — and whose
+ * members it wires into {@link import("./runner-deps.js").RunnerDeps}. Before this contract the shape of
+ * "a backend" was whatever the file family's aggregate class happened to carry, so a second backend had
+ * nothing to implement and a host composing several had nothing to type its engine half against. The
+ * shape now lives here, once: the bundled file backend implements it, and so does any other.
+ *
+ * Membership rule: a member is an engine seat whose durable store lives in the backend's storage and that
+ * every backend supplies, the bundled file backend included — `retention` is the one optional member,
+ * and a seat the file backend does not supply is not a member. Each member's NAME is its `RunnerDeps` seat and its TYPE is
+ * that seat's store type, so each member wires into its seat as it is (name the seats; a backend object may carry
+ * members that are not seats, so it is not spread). The member-to-seat correspondence is pinned in both directions
+ * by the test suite, together with the classification of the store-shaped seats that are not members. One reading per member:
+ *  - `fileHistoryStore` is the store only. The seat also accepts the word `"disabled"`; that word is the
+ *    deployment's wiring decision, not something a storage supplies.
+ *
+ * A host's own product stores do not belong here: a host that keeps more stores beside these composes
+ * an `EngineStorageBackend` with its own, rather than widening this contract.
+ */
+import type { SessionStore } from "./session.js";
+import type { CheckpointStore } from "./checkpoint-store.js";
+import type { ToolResultStore } from "./tool-result-store.js";
+import type { SessionPolicyStore } from "./session-policy-store.js";
+import type { WorkflowJournalStore } from "./workflow-journal-store.js";
+import type { UsageWindowStore } from "./usage-window-store.js";
+import type { BackgroundAgentStore } from "./background-agent-store.js";
+import type { MailboxStore } from "./mailbox-store.js";
+import type { FileHistoryStore } from "./file-history-store.js";
+import type { ManagedRetentionCapability } from "./retention.js";
+import type { RosterStore } from "../agents/roster-store.js";
+export interface EngineStorageBackend {
+    /** `RunnerDeps.sessionStore`. */
+    readonly sessionStore: SessionStore;
+    /** `RunnerDeps.checkpointStore`. */
+    readonly checkpointStore: CheckpointStore;
+    /** `RunnerDeps.toolResultStore`. */
+    readonly toolResultStore: ToolResultStore;
+    /** `RunnerDeps.sessionPolicyStore`. */
+    readonly sessionPolicyStore: SessionPolicyStore;
+    /** `RunnerDeps.workflowJournalStore`. */
+    readonly workflowJournalStore: WorkflowJournalStore;
+    /** `RunnerDeps.usageWindowStore`. */
+    readonly usageWindowStore: UsageWindowStore;
+    /** `RunnerDeps.backgroundAgentStore` — and the same instance wherever a deployment-composed Agent tool
+     *  takes its agent store (the seat's pairing rule). */
+    readonly backgroundAgentStore: BackgroundAgentStore;
+    /** `RunnerDeps.mailboxStore` (same single-instance pairing as `backgroundAgentStore`). */
+    readonly mailboxStore: MailboxStore;
+    /** `RunnerDeps.rosterStore`. */
+    readonly rosterStore: RosterStore;
+    /** `RunnerDeps.fileHistoryStore` — the store; the seat's `"disabled"` word is not a backend's to give. */
+    readonly fileHistoryStore: FileHistoryStore;
+    /**
+     * The backend-level managed-retention executor, when this backend has one.
+     *
+     * Retention execution belongs to the backend, not to each store: the capability's session deletion
+     * re-checks live references inside the deletion transaction, and those references are held by several
+     * stores at once (pending checkpoints, background-agent rows, workflow runs), so only a party that
+     * spans them can honor it. Absent ⇒ this backend executes no managed retention — the bundled file
+     * backend is one such backend.
+     *
+     * Not the same field as a store's `retention`: on a store that member is the declaration WORD
+     * ({@link import("./retention.js").RetentionDeclaring}, `"managed" | "none"`); here it is the
+     * executor OBJECT. A backend is not a store: handed to `assertRetentionCapability` as one, a backend
+     * that carries this member is refused as an unparseable declaration.
+     */
+    readonly retention?: ManagedRetentionCapability;
+    /** Release everything the backend holds (handles, locks) so a successor over the same storage can open
+     *  it. Call it at shutdown. */
+    dispose(): Promise<void>;
+}

package/dist/core/engine-storage-backend.js

@@ -0,0 +1 @@
+export {};

package/dist/core/file-history-store.d.ts

@@ -75,6 +75,10 @@ export declare function trackKeyOf(root: string, absPath: string): string;
  * before; pass it and a foreign-family record is refused by name instead of coerced.
  */
 export declare function resolveTrackKey(root: string, key: string, minted?: FileHistoryTrackKeyDescriptor): FileHistoryTrackKeyResolution;
+/** The file-history failure codes, spelled once: {@link FileHistoryError}'s `code` is derived from this tuple (each
+ *  word is documented there). A host that recognizes a code in failure text, or keeps a code in a store, reads this
+ *  value rather than keeping its own list. */
+export declare const FILE_HISTORY_ERROR_CODES: readonly ["track_failed", "snapshot_failed", "restore_failed", "adopt_failed", "not_found", "aborted", "unsupported_format", "conflict"];
 export interface FileHistoryError {
     /** `not_found` = no boundary for that (scope, entryId); `aborted` = the signal fired (or the
      *  fencing discarded a timed-out attempt); `conflict` = a non-destructive-target law refused
@@ -89,7 +93,7 @@ export interface FileHistoryError {
      *  work its shape drove; a fault in the PUBLISH step itself — the disk refusing a good graph —
      *  answers `adopt_failed`); `unsupported_format`
      *  = a foreign-epoch or wrong-version envelope; the rest name the verb that failed. */
-    code: "track_failed" | "snapshot_failed" | "restore_failed" | "adopt_failed" | "not_found" | "aborted" | "unsupported_format" | "conflict";
+    code: (typeof FILE_HISTORY_ERROR_CODES)[number];
     message: string;
 }
 export type FileHistoryResult = {
@@ -291,7 +295,7 @@ export interface FileHistoryStore {
      * discarding that baseline would be the fake-pristine hole DV-14 exists to weld shut.
      *
      * `verify` is the EVIDENCE arm (adversarial round 2). A caller whose write failed with a code the
-     * FileSystem contract defines as "nothing was written" (`already_exists`, `precondition_failed`)
+     * FileSystem contract defines as "nothing was written" (`already_exists`, `precondition_failed`, `target_unavailable`)
      * has proof and passes nothing. Every other failure — a plain write is not contractually atomic,
      * so ENOSPC, a dying transport or a thrown backend may have TRUNCATED the file before reporting —
      * must hand an `env` here: the store then re-reads the path ONCE and retracts only if the world

package/dist/core/file-history-store.js

@@ -66,6 +66,7 @@ export function resolveTrackKey(root, key, minted) {
         return { ok: false, reason: `unsafe recorded key escapes root: ${key}` };
     return { ok: true, abs: joinUnder(root, keyN) };
 }
+export const FILE_HISTORY_ERROR_CODES = Object.freeze(["track_failed", "snapshot_failed", "restore_failed", "adopt_failed", "not_found", "aborted", "unsupported_format", "conflict"]);
 export const FILE_HISTORY_DIFF_LINE_BUDGET = 2000;
 export function countRestoreLineDiff(current, target) {
     const isBinary = (b) => b !== undefined && b.includes(0);

package/dist/core/gate-fold.js

@@ -165,8 +165,16 @@ export async function runGateFold(pass) {
                 pass.deniedBy = "write_protection";
         }
     }
-    if (asksUnstated(pass.decision, permissionSeatAt(input, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput)?.seat, input.permissionMode?.())) {
-        pass.decision = { action: "ask", message: permissionSeatAt(input, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput)?.question ?? unstatedAskMessage(toolName), ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}) };
+    if (pass.decision.action !== "deny" && input.crossBoundaryCheck?.obligation({ toolName, args: pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, toolCallId }).mandate === true) {
+        const marks = { requiresRealApproval: true, crossBoundaryMandated: true };
+        if (pass.decision.action === "ask")
+            pass.decision = { ...pass.decision, ...marks };
+        else
+            [pass.decision, pass.tightenedBy] = [{ action: "ask", message: `tool "${toolName}" crosses the device boundary of a run that executes on a target device — a person must confirm it`, decisionReason: "safety", ...marks }, "safety"];
+    }
+    const unstatedRuns = pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput;
+    if (asksUnstated(pass.decision, pass.req, unstatedRuns, permissionSeatAt(input, unstatedRuns)?.seat, input.permissionMode?.())) {
+        pass.decision = { action: "ask", message: permissionSeatAt(input, unstatedRuns)?.question ?? unstatedAskMessage(toolName), ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}) };
         pass.tightenedBy = "unstated";
     }
     return await pass.afterFold(pass);