@sema-agent/core 7.54.1 → 7.55.0

package/dist/core/runner/conversation-segment.js

@@ -0,0 +1,42 @@
+export function conversationSegmentOf(branch) {
+    for (let i = branch.length - 1; i >= 0; i--)
+        if (branch[i].type === "compaction")
+            return branch[i].id;
+    return null;
+}
+export const DATE_ANCHOR_CUSTOM_TYPE = "engine:date-anchor";
+const ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+function normalizeDateAnchor(v) {
+    if (typeof v !== "object" || v === null)
+        return undefined;
+    const { prefixDate, announcedDate, segment } = v;
+    if (typeof prefixDate !== "string" || !ISO_DATE.test(prefixDate) || typeof announcedDate !== "string" || !ISO_DATE.test(announcedDate))
+        return undefined;
+    if (segment !== null && (typeof segment !== "string" || segment.length > 200))
+        return undefined;
+    return { prefixDate, announcedDate, segment };
+}
+export async function readDateAnchor(session) {
+    let branch;
+    try {
+        branch = await session.getBranch();
+    }
+    catch {
+        return undefined;
+    }
+    let found;
+    for (let i = branch.length - 1; i >= 0 && branch[i].type !== "compaction"; i--) {
+        const e = branch[i];
+        if (found === undefined && e.type === "custom" && e.customType === DATE_ANCHOR_CUSTOM_TYPE)
+            found = normalizeDateAnchor(e.data);
+    }
+    const segment = conversationSegmentOf(branch);
+    return { current: found !== undefined && found.segment === segment ? { prefixDate: found.prefixDate, announcedDate: found.announcedDate } : undefined, segment };
+}
+export function owedDateAnchor(session, seat, state) {
+    const read = seat?.anchor;
+    if (read === undefined || state === undefined || read.current?.announcedDate === state.announcedDate)
+        return undefined;
+    const data = { prefixDate: seat.legDate, announcedDate: state.announcedDate, segment: read.segment };
+    return () => session.appendCustomEntry(DATE_ANCHOR_CUSTOM_TYPE, data).then(() => undefined, () => undefined);
+}

package/dist/core/runner/cross-boundary-lane.d.ts

@@ -5,11 +5,12 @@
  * WHERE THE STATE LIVES. The tree's state is one object, reached from the tree's opaque token (`RunInternals.crossBoundaryTree`,
  * `ToolExecuteContext.crossBoundaryTreeForChildren`) through this module alone; each leg joins into it what it knows at prepare (its
  * environment's declaration, its session's newest record, its posture) and every bit an exit sets lands there before the call
- * runs. Each leg's session holds a record (`CROSS_BOUNDARY_RECORD_TYPE`) of the state its content was produced under — written only
- * for an armed tree: at prepare and at an exit (before the call runs) when the state grew past what the session already says, and at
- * a leg's end (before a suspend's row is put, when the leg settles) also when conversation content follows the newest record. A
- * write that fails refuses its call (or its row) on a governed tree; a prepare's or a settle's, and any write on a tree that is not
- * governed, mints `config.cross_boundary_record_unwritten`. A record covers the content before it: a leg that takes over a session
+ * runs — after the record that carries it, so a call the exit refuses sets nothing. Each leg's session holds a record
+ * (`CROSS_BOUNDARY_RECORD_TYPE`) of the state its content was produced under — written only for an armed tree: at prepare and at an
+ * exit (before the call runs) when the state grew past what the session already says, and at a leg's end (before a suspend's row is
+ * put, when the leg settles) also when conversation content follows the newest record. A write that fails refuses its call (or its
+ * row) on a governed tree; a prepare's or a settle's, and any write on a tree that is not governed, mints
+ * `config.cross_boundary_record_unwritten`, once per state. A record covers the content before it: a leg that takes over a session
  * whose content no record covers (none on the branch, or after the newest), on an armed tree, reads that content as off-target.
  *
  * THE OBLIGATION of a call is read off three things at the moment it is asked ({@link crossBoundaryObligation}): the legs the

package/dist/core/runner/cross-boundary-lane.js

@@ -70,16 +70,22 @@ export async function prepareCrossBoundaryLane(input) {
         tree = joinCrossBoundaryTree(tree, { offTargetReadObserved: true });
     ref.current = tree;
     const stationEngaged = posture !== undefined || externalContentTargetActive || crossBoundaryTreeGoverned(tree);
-    const unwritten = (phase, err) => deliverEngineNotice(deps.onNotice, crossBoundaryRecordUnwrittenNotice({ sessionId, runId, phase, governed: crossBoundaryTreeGoverned(ref.current), cause: thrownText(err) }));
+    let reported;
+    const unwritten = (phase, state, catchUp, err) => {
+        if (reported !== undefined && crossBoundaryTreeCovers(reported, state))
+            return;
+        reported = state;
+        deliverEngineNotice(deps.onNotice, crossBoundaryRecordUnwrittenNotice({ sessionId, runId, phase, governed: crossBoundaryTreeGoverned(ref.current), catchUp, cause: thrownText(err) }));
+    };
     let writing = Promise.resolve();
     let storeWaits = 0;
-    const write = (phase, atLeaf) => {
+    const write = (phase, atLeaf, adds = {}) => {
         const next = writing.then(async () => {
             let leafAt = atLeaf;
             let cover = phase === "suspend" || phase === "settle";
             let written;
             for (;;) {
-                const state = ref.current;
+                const state = joinCrossBoundaryTree(ref.current, adds);
                 if (state.targetExecutionArmed !== true)
                     return written;
                 const grown = !crossBoundaryTreeCovers(recorded, state);
@@ -112,10 +118,12 @@ export async function prepareCrossBoundaryLane(input) {
                     cover = false;
                 }
                 catch (err) {
-                    if (crossBoundaryTreeGoverned(ref.current))
+                    const governed = crossBoundaryTreeGoverned(ref.current);
+                    if (governed && (phase === "exit" || phase === "suspend"))
                         throw err;
-                    unwritten(phase, err);
-                    recorded = state;
+                    unwritten(phase, state, written !== undefined, err);
+                    if (!governed)
+                        recorded = state;
                     return written;
                 }
             }
@@ -124,12 +132,13 @@ export async function prepareCrossBoundaryLane(input) {
         return next;
     };
     const owe = (atLeaf) => write(atLeaf !== undefined ? "suspend" : "exit", atLeaf);
+    const OBSERVED = Object.freeze({ offTargetReadObserved: true });
     const trace = (phase, call) => emitTrace(deps.tracer, () => ({ kind: "permission.cross_boundary_taint", version: 1, taskId: hostTaskId, runId, phase, taint: bitsOf(ref.current), governed: ref.current.governed === true, ...(call !== undefined ? { toolName: call.toolName, ...(call.toolCallId !== undefined ? { toolCallId: call.toolCallId } : {}) } : {}), ts: Date.now() }));
     if (tree.targetExecutionArmed === true) {
         trace(resumeLeg ? "resume" : "prepare");
         if (posture === undefined && tree.governed !== true)
             deliverEngineNotice(deps.onNotice, crossBoundaryPostureUndeclaredNotice({ sessionId, runId, tree }));
-        await write("prepare").catch((err) => unwritten("prepare", err));
+        await write("prepare");
     }
     let check;
     const lane = {
@@ -163,19 +172,21 @@ export async function prepareCrossBoundaryLane(input) {
                                 message: `tool "${call.toolName}" needs a person's confirmation: this run executes on a target device${ref.current.offTargetReadObserved === true ? " and has since let content from beyond it in, so a call that reaches beyond the device or back into it" : ", so a call that writes beyond the device"} is put to a person — this call was allowed by a configuration, not a person, and was not executed`,
                             };
                         }
-                        if (now.record && ref.current.offTargetReadObserved !== true) {
-                            ref.current = joinCrossBoundaryTree(ref.current, { offTargetReadObserved: true });
-                            trace("observed", call);
-                        }
+                        const adds = now.record && ref.current.offTargetReadObserved !== true ? OBSERVED : undefined;
                         const judged = ref.current;
                         try {
-                            await owe();
+                            await write("exit", undefined, adds);
                         }
                         catch (err) {
                             return { kind: "unrecorded", message: `tool "${call.toolName}" was not executed: the session's cross-boundary record could not be written before it ran (${thrownText(err)}) — on a governed tree a call that owes its record does not run without it; refused fail-closed` };
                         }
-                        if (ref.current === judged)
-                            return undefined;
+                        if (ref.current !== judged)
+                            continue;
+                        if (adds !== undefined) {
+                            ref.current = joinCrossBoundaryTree(ref.current, adds);
+                            trace("observed", call);
+                        }
+                        return undefined;
                     }
                 },
             };
@@ -184,7 +195,7 @@ export async function prepareCrossBoundaryLane(input) {
         owe,
         storeWaits: () => storeWaits,
         recorded: () => ref.current.targetExecutionArmed === true,
-        settle: () => write("settle").then(() => undefined, (err) => unwritten("settle", err)),
+        settle: () => write("settle").then(() => undefined),
     };
     return lane;
 }

package/dist/core/runner/decide-continuation.d.ts

@@ -17,7 +17,7 @@
  */
 import { type AskOrigin } from "../ask-origin.js";
 import { type OnQuestion, type QuestionAnswer } from "../ask-question.js";
-import { type Checkpoint, type ResolvedOutcome, type ResumeOutcome } from "../checkpoint-store.js";
+import { type Checkpoint, type CheckpointErrorField, type ResolvedOutcome, type ResumeOutcome } from "../checkpoint-store.js";
 import { type GateOutcome, type HostDecisionFacts } from "../gate-outcome.js";
 import type { ResumeRun } from "./contracts.js";
 /**
@@ -130,10 +130,13 @@ export declare function mintDecideRecord(cp: Checkpoint, facts: HostDecisionFact
  * answer differently each time — the check passing on text it never inspected. Refused pre-CAS so the
  * row stays `pending` for a well-formed decide, exactly like the other capture-time domain refusals,
  * and BEFORE the hygiene check so no guard ever consults a value outside the domain. The rejected field
- * is named in the message only — `CheckpointError`'s structured `detail.field` is a closed set covering
- * the approval lane's payload names, and widening it is a wire-surface change of its own.
+ * is named in the message, and in `detail` where the caller hands the closed set's word for the cell
+ * (`CheckpointErrorField`: `feedback` has one; `reason` and `editedPlan` have none, and widening the set is a
+ * wire-surface change of its own).
  */
-export declare function assertOutcomeText(value: string | undefined, field: "editedPlan" | "reason" | "feedback"): void;
+export declare function assertOutcomeText(value: string | undefined, field: "editedPlan" | "reason" | "feedback", detail?: {
+    field: CheckpointErrorField;
+}): void;
 /**
  * The continuation prompt for a resumed run. The vendored harness only exposes
  * `prompt(text)` (it always appends a user message — there is no "continue from tool results" entry), so

package/dist/core/runner/decide-continuation.js

@@ -123,9 +123,9 @@ export function mintDecideRecord(cp, facts, verdict) {
     const settlement = settlementOfHostDecision(facts, verdict.allowed ? "allowed" : "refused", verdict.note);
     return mintGateOutcome({ ...(verdict.allowed ? {} : { deniedBy: "ask_resolution" }), settled: { settlement, origin } });
 }
-export function assertOutcomeText(value, field) {
+export function assertOutcomeText(value, field, detail) {
     if (value !== undefined && typeof value !== "string") {
-        throw new CheckpointError("checkpoint.invalid_outcome", `resume \`${field}\` is not a plain string (got ${typeof value}) — a decide's text payload is an operator's plain data, not a live object; refusing pre-CAS, the checkpoint stays pending`);
+        throw new CheckpointError("checkpoint.invalid_outcome", `resume \`${field}\` is not a plain string (got ${typeof value}) — a decide's text payload is an operator's plain data, not a live object; refusing pre-CAS, the checkpoint stays pending`, detail);
     }
 }
 function reorientClause(fullShellReachable) {

package/dist/core/runner/denial-limit-arms.d.ts

@@ -170,13 +170,13 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
 };
 /**
  * The ancestor's frozen classifier, run BEFORE its frozen approver in the ancestor's own gate order,
- * with the denial-limit count folded in (CC 2.1.250 count-then-judge): `allow` ⇒ the classifier's
+ * with the denial-limit count folded in (count-then-judge): `allow` ⇒ the classifier's
  * auto-allow (and the streak resets); `block` below the bound ⇒ deny, the exact verdict the ancestor's
  * gate would have produced; `block` AT the bound ⇒ the ask is re-spoken in the classifier's voice as
  * the fallback (`decisionReason:"classifier"`, `requiresRealApproval`, the member carrying counts +
  * window) for the arm to resolve at the frozen approver; a classification that did not rule (`unavailable`, or a reply
  * with no verdict) ⇒ the gate's own exit (`classifierNoRulingArm`) on the frozen approver — a live one resolves the incoming
- * ask carrying why (never counted); none ⇒ the unavailable form is a DENY that says so (CC 2.1.250 form, never counted) and
+ * ask carrying why (never counted); none ⇒ the unavailable form is a DENY that says so (never counted) and
  * a reply with no verdict takes the block path with the CC parse-failure sentence (counted); a CONFLICTING reply takes the
  * block path too; excluded / no classifier ⇒ the incoming ask, unchanged. The member may ALREADY be on the incoming
  * ask (a deeper ancestor's fallback, minted inside the nested fold — the case the exclusion names):

package/dist/core/runner/derived-route-fallback.d.ts

@@ -1,22 +1,25 @@
 /**
- * The derived-leg route pre-flight shared by prepareTask's two derived seats: the compaction-summary model (the
- * driver's own seat, resolved before the offload prelude) and the auto-mode classifier model (the caps-and-workflow
- * phase's arming). Moved whole out of the orchestrator so the phase reaches DOWN for it instead of the two callers
- * spelling it twice. The judgment law and both announcements live in the brain's route adjudicator; this is the one
- * guarded seat around them.
+ * The derived-leg route pre-flight shared by prepareTask's derived seats: the compaction-summary model, the auto-mode
+ * classifier model and the advisor model. One guarded seat, reached DOWN for by each phase instead of spelled again; the
+ * judgment law and the announcements live in the brain's route adjudicator.
  */
-import type { Model } from "../../internal/llm.js";
+import type { Model, RouteRefusalCode } from "../../internal/llm.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
+/** What the pre-flight decided: keep the seat's model (same route as the primary, the pairing holds, the judge abstained, or
+ *  the deployment declined a fallback — the seat is kept and its calls refused), swap it for the primary, or take the seat
+ *  off this run. A move carries the refusal that caused it. */
+export type DerivedSeatOutcome = {
+    readonly action: "keep";
+} | {
+    readonly action: "fall_back" | "detach";
+    readonly cause: RouteRefusalCode;
+};
 /**
- * The derived-leg pairing pre-flight as ONE guarded seat: judge the derived model where its route
- * differs from the primary's, announce what a broken pairing means for THIS seat (`onBrokenPairing` —
- * one judgment, and the POSTURE is the deployment's), and ABSTAIN (keep the derived model) on ANY throw. The pre-flight is advisory — the brain's request gate re-runs the
- * same law — so neither a throwing judge face nor a garbage catalog value (the route-identity
- * normalization throws a TypeError on a non-string baseUrl) may widen into "task preparation
- * failed": at the compaction seat the session is already acquired and the throw-cleanup contract
- * is not yet armed, so a throw here would leak the acquired session view, and the garbage value
- * still earns its loud refusal at the request gate the moment the derived leg is actually used.
- * Returns whether the seat should fall back to the primary model.
+ * Judge the derived model where its route differs from the primary's, announce what a broken pairing means for THIS seat
+ * (`onBrokenPairing`), and ABSTAIN (keep) on ANY throw. The pre-flight is advisory — the brain's request gate re-runs the
+ * same law — so neither a throwing judge face nor a garbage catalog value may widen into "task preparation failed": at the
+ * compaction seat the session is already acquired and the throw-cleanup contract is not yet armed, and the garbage value
+ * still earns its loud refusal at the request gate the moment the derived leg is used.
  */
 export declare function derivedRouteFallsBack(args: {
     seat: string;
@@ -25,14 +28,11 @@ export declare function derivedRouteFallsBack(args: {
     brain: RunnerDeps["brain"];
     getApiKeyAndHeaders: TaskSpec["getApiKeyAndHeaders"];
     onNotice: RunnerDeps["onNotice"];
-    /** The run this seat resolution belongs to; carried onto the notice as its routing key
-     *  (the audience stays operator: correlation, not entitlement). Absent ⇒ nothing is fabricated. */
+    /** The session / INVOCATION this resolution belongs to: correlation keys on the notice (the audience stays operator). */
     sessionId?: string;
-    /** The INVOCATION this seat resolution belongs to. The session cannot stand in for it: two
-     *  runs of one session that both fall back on the same seat mint otherwise byte-identical lines. */
     runId?: string;
-    /** What this seat's DEPLOYMENT asked for on a broken pairing. Absent / `"fall_back"`: swap and announce `route.fallback_to_primary`
-     *  (the only posture a seat with no knob of its own has). `"refuse"`: keep the seat and announce `route.classifier_unroutable` — never
-     *  quietly granting a fallback the deployment declined (`autoMode.classifierFallback: "none"`); announcing is why no swap is not no word. */
-    onBrokenPairing?: "fall_back" | "refuse";
-}): Promise<boolean>;
+    /** Absent / `"fall_back"`: swap and announce `route.fallback_to_primary`. `"refuse"`: keep the seat and announce
+     *  `route.classifier_unroutable` (the deployment declined a fallback — never granted quietly). `"detach"`: take the seat
+     *  off the run and announce `route.seat_detached` (a seat the primary model cannot stand in for). */
+    onBrokenPairing?: "fall_back" | "refuse" | "detach";
+}): Promise<DerivedSeatOutcome>;

package/dist/core/runner/derived-route-fallback.js

@@ -1,21 +1,23 @@
-import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity, unroutableSeatNotice } from "../../brain/route-adjudicator.js";
+import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity, seatDetachedNotice, unroutableSeatNotice } from "../../brain/route-adjudicator.js";
 import { deliverEngineNotice } from "../types.js";
 export async function derivedRouteFallsBack(args) {
     try {
         if (sameRouteIdentity(args.derived, args.primary))
-            return false;
+            return { action: "keep" };
         const verdict = await adjudicateDerivedRoute({ brain: args.brain, model: args.derived, getApiKeyAndHeaders: args.getApiKeyAndHeaders });
         if (verdict === undefined || verdict.ok)
-            return false;
+            return { action: "keep" };
         const shared = { seat: args.seat, from: args.derived.id, verdict, ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}), ...(args.runId !== undefined ? { runId: args.runId } : {}) };
-        const refuse = args.onBrokenPairing === "refuse";
-        if (refuse)
+        const posture = args.onBrokenPairing ?? "fall_back";
+        if (posture === "refuse")
             deliverEngineNotice(args.onNotice, unroutableSeatNotice({ ...shared, primary: args.primary.id }));
+        else if (posture === "detach")
+            deliverEngineNotice(args.onNotice, seatDetachedNotice(shared));
         else
             deliverEngineNotice(args.onNotice, fallbackToPrimaryNotice({ ...shared, to: args.primary.id }));
-        return !refuse;
+        return posture === "refuse" ? { action: "keep" } : { action: posture, cause: verdict.code };
     }
     catch {
-        return false;
+        return { action: "keep" };
     }
 }

package/dist/core/runner/gate-exit.d.ts

@@ -22,6 +22,7 @@
  * contract (`ToolGateInput`, `ToolGateResult`, the observer payload), which stays declared there.
  */
 import { type ClassifierDenyCause, type DeniedBy, type GateOutcome, type ModeRefusal, type ModeRelease, type Settlement } from "../gate-outcome.js";
+import type { AllowRuleClearance } from "../allow-rule-shadow.js";
 import type { AutoModeClassifierRound } from "../auto-mode.js";
 import { type Arbitration, type AskClassification, type AskFace, type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
@@ -49,6 +50,8 @@ export interface GateExitFacts {
     classifier?: AutoModeClassifierRound;
     /** The permission mode RELEASED the surviving ask (the allow exit's account of it); never beside `deniedBy`. */
     released?: ModeRelease;
+    /** An allow-layer member CLEARED the standing ask (the allow exit's account of it); never beside `deniedBy`, a settlement or a release. */
+    clearedBy?: AllowRuleClearance;
     /** The permission mode REFUSED the surviving ask — only beside `deniedBy: "mode"`. */
     modeRefusal?: ModeRefusal;
 }
@@ -333,6 +336,9 @@ export interface GatePass {
     arbitration?: Exclude<Arbitration, {
         kind: "ask";
     }>;
+    /** borrowed-mutable — the allow-layer member that CLEARED the standing ask and the entries it stood on (the allow exit projects
+     *  it onto the disposition when nobody answered an ask on this pass). Writer: the lanes' allow layer. */
+    clearedBy?: AllowRuleClearance;
 }
 /**
  * The engine's fail-closed block of phase 1 — the PreToolUse face THREW or never ANSWERED, so the engine

package/dist/core/runner/gate-exit.js

@@ -23,7 +23,12 @@ export function mintGateOutcome(facts) {
                 ...(attribution !== undefined ? { classifier: attribution } : {}),
                 ...(facts.modeRefusal !== undefined ? { mode: facts.modeRefusal.mode, askClass: facts.modeRefusal.askClass, classes: Object.freeze([...facts.modeRefusal.classes]) } : {}),
             }
-            : { kind: "allowed", ...(attribution !== undefined ? { classifier: attribution } : {}), ...(facts.released !== undefined ? { released: Object.freeze({ ...facts.released, classes: Object.freeze([...facts.released.classes]) }) } : {}) }),
+            : {
+                kind: "allowed",
+                ...(attribution !== undefined ? { classifier: attribution } : {}),
+                ...(facts.released !== undefined ? { released: Object.freeze({ ...facts.released, classes: Object.freeze([...facts.released.classes]) }) } : {}),
+                ...(facts.clearedBy !== undefined ? { clearedBy: Object.freeze({ ...facts.clearedBy, entries: Object.freeze([...facts.clearedBy.entries]), ...(facts.clearedBy.positions !== undefined ? { positions: Object.freeze([...facts.clearedBy.positions]) } : {}) }) } : {}),
+            }),
         ...(facts.settled !== undefined ? { settlement: settlement, origin: facts.settled.origin } : {}),
     });
     const defects = screenGateOutcome(outcome, { reading: "producer" });
@@ -315,7 +320,7 @@ export async function exitGate(pass) {
         return undefined; const a = pass.arbitration === undefined ? input.ancestorArbitrationOf?.(toolCallId) : undefined; return a?.kind === "released" ? a : undefined; })();
     return {
         updatedInput: pass.currentInput,
-        gate: mintGateOutcome({ ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}), ...(release !== undefined ? { released: releaseRecordOf(release) } : {}) }),
+        gate: mintGateOutcome({ ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}), ...(release !== undefined ? { released: releaseRecordOf(release) } : {}), ...(pass.clearedBy !== undefined && ledger.settled === undefined && release === undefined ? { clearedBy: pass.clearedBy } : {}) }),
         finalInput: frozenInputSnapshot(pass.currentInput),
         preToolContext: pass.preToolContext,
     };

package/dist/core/runner/initial-run-state.js

@@ -4,7 +4,7 @@ export function createRunState() {
         degrade: { degradeToModel: undefined, degraded: undefined, outputErrorStreak: 0, outputInvalid: false, recordDegraded: () => { } },
         limits: { turnsExceeded: false, budgetHit: undefined, budgetAxis: undefined, platformTerminal: undefined, outputRetryCap: 0, effectiveMaxTurns: undefined },
         budget: { remainingMicroUsd: undefined, maxCostMicroUsd: undefined, remainingTokens: undefined, maxTokensWindow: undefined, overBudget: () => undefined, streamCancel: false, callOutputChars: 0, lastStreamBudgetCheck: 0, projectedOverBudget: () => undefined },
-        turn: { callStartAt: undefined, firstTokenAt: undefined, turnUsage: undefined, turnUsageMissing: false, turnStopReason: undefined, turnResponseModel: undefined, lastTurnHadToolCalls: false, toolBatch: [] },
+        turn: { callStartAt: undefined, firstTokenAt: undefined, turnUsage: undefined, turnUsageMissing: false, turnStopReason: undefined, turnResponseModel: undefined, toolBatch: [] },
         counters: { approachNoticesSent: 0, walltimeSyncBackstopFired: false, compactionFloor: 0, trimForceBackoff: false, compactionPasses: 0, repetitionCuts: 0, repetitionSpared: 0, repetitionEvents: [], REPETITION_EVENTS_CAP: 0, preemptIgnoredReported: false, wroteThisRun: false, finalVerifyInjections: 0, groundingSignalPreR9: false, groundingSignalPostR9: false, cadenceTurns: 0 },
         attach: { attachmentsCfg: undefined, agentListingOn: false, skillsListingOn: false, attachState: undefined, dateState: undefined, instrProbe: undefined, instrState: undefined, sizeGuidelineState: undefined, attachmentsInjected: 0 },
     };

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -32,7 +32,7 @@ import { type HeadLeads } from "../path-rule-binding.js";
 import type { ToolCallLike } from "../tool-registry.js";
 import { type OrgRuleResolution } from "../permission-rule-org.js";
 import { type EffectivePermissionRules, type PermissionRuleStoreProvider, type PersonRowsRead } from "../permission-rule-provider.js";
-/** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for it and the name tools); the other grammars' tools are derived (`ruleToolGrammarOf`). */
+/** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for it, the name tools and the host tools); the other grammars' tools are derived (`ruleToolGrammarOf`). */
 export declare const PERSISTED_RULE_TOOL = "Bash";
 /**
  * The evidence an INHERITED-lane ask carries.
@@ -225,7 +225,7 @@ interface RuleOffersAskFacts extends RuleClearanceFacts {
  *    "stop asking me this" on a card that will keep asking lets a person mint a rule that never
  *    takes effect where they minted it.
  *
- * (CC 2.1.245 toolPolicy 对表, F11: "wildcard `ask` … keeps every matching tool behind a
+ * (toolPolicy 对表, F11: "wildcard `ask` … keeps every matching tool behind a
  * per-call prompt (no persistent always-allow)") — `matchedAskRule` was the one conjunct of the
  * lane's own clearing predicate this door did not mirror, and the asymmetry was live: the
  * persisted-rule lane refuses to clear ANY ask carrying it (`hooks.ts`, the

package/dist/core/runner/permission-rule-lanes.js

@@ -1,6 +1,7 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, domainRuleSubjectOf, escapeForDisclosure, faceRowsSpeakFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
+import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, escapeForDisclosure, faceRowsSpeakFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForHost, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
+import { callHostTargetOf } from "../host-target.js";
 import { callTargetViewsOf, validatePath } from "../effective-path-target.js";
 import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
 import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
@@ -120,9 +121,9 @@ export function createPermissionRuleLanes(cfg) {
         const judged = laneToolNamesOf(req).map((n) => [n, ruleToolGrammarOf(n)]);
         if (!judged.some(([, g]) => g === "path") && faceRowsSpeakFor(callPathFaceOf(req)))
             judged.push([req.toolName, "path"]);
-        if (judged.length === 0)
-            return undefined;
         const view = await reader.pin(req.toolCallId);
+        if (judged.length === 0)
+            return view.unreadable !== undefined ? { unreadable: true } : undefined;
         try {
             const table = view.rules.filter((r) => r.behavior !== "allow" || cfg.stripsAllow?.(r, req) !== true);
             const leads = judged.some(([, g]) => g === "path") ? await cfg.leads.resolve(bindPathRules(table.filter((r) => r.match === "path" || r.match === "subpath").map((r) => ({ parsed: r, ruleText: r.rule, rule: r })), (spec) => anchorsOf(spec.rule))) : NO_LEADS;
@@ -144,9 +145,9 @@ export function createPermissionRuleLanes(cfg) {
         if (grammar === "path")
             return pathRuleLaneAnswer(table, req, { root: cfg.root, sessionId: cfg.sessionId, anchorsOf, leads, ...scope });
         if (grammar === "name")
-            return persistedRuleAnswerOf(adjudicatePersistedNameRules(table, { tool: req.toolName, name: nameRuleSubjectOf(req.toolName, req.args), cwd: cfg.root, sessionId: cfg.sessionId, ...scope }));
+            return persistedRuleAnswerOf(adjudicatePersistedNameRules(table, { tool: req.toolName, request: req, cwd: cfg.root, sessionId: cfg.sessionId, ...scope }));
         if (grammar === "domain")
-            return persistedRuleAnswerOf(adjudicatePersistedDomainRules(table, { tool: req.toolName, host: domainRuleSubjectOf(req.toolName, req.args), cwd: cfg.root, sessionId: cfg.sessionId, ...scope }));
+            return persistedRuleAnswerOf(adjudicatePersistedDomainRules(table, { tool: req.toolName, hosts: { tighten: callHostTargetOf(req, "tighten"), grant: callHostTargetOf(req, "grant") }, cwd: cfg.root, sessionId: cfg.sessionId, ...scope }));
         const command = req.args?.command;
         if (typeof command !== "string")
             return undefined;
@@ -163,7 +164,8 @@ export function createPermissionRuleLanes(cfg) {
 export function createRuleOffersOf(cfg) {
     return (call, args, ask) => {
         const toolName = wireOf("offer.laneTool", call);
-        if (!cfg.laneArmed || (toolName !== PERSISTED_RULE_TOOL && ruleToolGrammarOf(toolName) !== "name"))
+        const grammar = ruleToolGrammarOf(toolName);
+        if (!cfg.laneArmed || (toolName !== PERSISTED_RULE_TOOL && grammar !== "name" && grammar !== "domain"))
             return {};
         if ((cfg.principal === undefined || cfg.principal === "") && !cfg.localOwnerDeclared)
             return {};
@@ -175,10 +177,15 @@ export function createRuleOffersOf(cfg) {
         }).word;
         if (closedDoor !== undefined)
             return { ruleOffersAbsence: closedDoor };
-        if (ruleToolGrammarOf(toolName) === "name") {
+        if (grammar === "name") {
             const offer = suggestRuleForName(toolName, nameRuleSubjectOf(toolName, args) ?? "");
             return offer !== undefined ? { ruleOffers: [offer] } : { ruleOffersAbsence: "lane_cannot_speak" };
         }
+        if (grammar === "domain") {
+            const host = callHostTargetOf({ toolName: call.toolName, args, face: call.face }, "grant");
+            const offer = host !== undefined && "host" in host ? suggestRuleForHost(toolName, host.host) : undefined;
+            return offer !== undefined ? { ruleOffers: [offer] } : { ruleOffersAbsence: "lane_cannot_speak" };
+        }
         const command = args?.command;
         if (typeof command !== "string")
             return { ruleOffersAbsence: "lane_cannot_speak" };

package/dist/core/runner/person-path-rows.js

@@ -367,7 +367,7 @@ export function ruleStoreUnreadableNotice(onNotice, ids) {
         const which = sources !== undefined && sources.length > 0 ? `your persisted permission rules from the ${sourcesWord(sources)} sources` : "your persisted permission rules";
         deliverEngineNotice(onNotice, {
             code: "permission.rule_store_unavailable",
-            message: `${which} could not be read ${at === "prepare" ? "when this run started" : "for a call on this run"}. Until a read of them succeeds, none of their allow rows (Read directory rows included) applies, while the deny and ask rows most recently read from them this run still apply — a deny row you removed since that read keeps refusing until then. While they cannot be read, every call your rules judge (a file read, a write, a command) is asked about rather than allowed, until a read of them succeeds. Every later check reads them again.`,
+            message: `${which} could not be read ${at === "prepare" ? "when this run started" : "for a call on this run"}. Until a read of them succeeds, none of their allow rows (Read directory rows included) applies, while the deny and ask rows most recently read from them this run still apply — a deny row you removed since that read keeps refusing until then. While they cannot be read, every call is asked about rather than allowed, whatever its tool (rules nobody can read may name any), until a read of them succeeds. Every later check reads them again.`,
             detail: { at, sessionId: ids.sessionId, runId: ids.runId },
         });
     };

package/dist/core/runner/prepare-advisor.d.ts

@@ -0,0 +1,63 @@
+/**
+ * PrepareTask's ADVISOR phase: whether this leg mounts the `advisor` tool, and what it owes the model about it. In order —
+ * the deployment switch (`RunnerDeps.advisorTool: "disabled"` ignores the spec's advisor model unread); the static verdict
+ * (`advisorAttachVerdict`, the one answer a host's advisor query reads too); then the mount chain — the reserved name, the
+ * leg's tool selector (its valve's own predicate, asked of the tool's name), the conversation's hold (the transcript), the
+ * advisor route (the shared derived-seat pre-flight, posture `detach`) — and the mount. Its answer is the manifest fact,
+ * the person's notice for a reason they are told (root legs only, once per conversation per pair), and the leg's
+ * instruction seat (what the model is owed, against what it was told in the conversation's current segment).
+ *
+ * Runs after the scaffold mounts and before the tool-face fold, so the deferred classification, the prompt and the
+ * manifest see the roster the leg runs with. A leg whose spec names no advisor model and whose conversation never told
+ * the model about one does nothing here and reads nothing.
+ */
+import type { SessionTreeEntry } from "../../internal/harness-types.js";
+import type { Model } from "../../internal/llm.js";
+import type { CompactionForkContext } from "../auto-compaction.js";
+import type { ToolSelector } from "../tool-face.js";
+import type { RosterBuilder } from "../tool-roster.js";
+import { type RunnerDeps, type TaskSpec } from "../types.js";
+import type { WiringAdvisorFact } from "../wiring-manifest.js";
+import { type AdvisorInstructionSeat } from "./advisor-instructions.js";
+import { type AnnounceOnceLedger } from "./announce-once-ledger.js";
+import type { Prepared } from "./contracts.js";
+export interface PrepareAdvisorInput {
+    /** borrowed-readonly — the REBOUND spec: the advisor model, the caller's tools (the reserved name), the whole-face switch, the auth hook. */
+    spec: Pick<TaskSpec, "advisorModel" | "tools" | "excludeAllTools" | "getApiKeyAndHeaders">;
+    /** borrowed-readonly — the deployment switch as the value door screened it. */
+    advisorTool: "disabled" | undefined;
+    /** borrowed-readonly — the catalog and tiers the verdict reads, the brain the advisor lane books, the notice sink. */
+    deps: Pick<RunnerDeps, "models" | "tiers" | "brain" | "onNotice">;
+    /** borrowed-readonly — the leg's resolved main model. */
+    model: Model;
+    /** borrowed-mutable — the mount array (the advisor tool is mounted on it). */
+    roster: RosterBuilder;
+    /** borrowed-readonly — the leg's frozen tool selector (the valve's predicate). */
+    selector: ToolSelector;
+    /** borrowed-readonly — the acquired session: its branch (the hold, the segment). */
+    session: {
+        getBranch(): Promise<ReadonlyArray<SessionTreeEntry>>;
+    };
+    /** borrowed-readonly — the once-per-session ledger: what the model was told (`arms().advisor`), and the notice's dedupe. */
+    onceLedger: Pick<AnnounceOnceLedger, "arms" | "oncePerSession">;
+    /** borrowed-readonly — a leg the person reads (not a delegated child): only such a leg tells them. */
+    rootLeg: boolean;
+    /** borrowed-readonly — the acquired session's id (the notice's routing key). */
+    sessionId: string;
+    /** borrowed-readonly — this invocation's id (the notices' correlation key). */
+    runId: string | undefined;
+    /** borrowed-readonly — the leg's usage-account door (the run body binds it before any tool call). */
+    sideCallBookRef: Prepared["sideCallBookRef"];
+    /** borrowed-readonly — the request the main lane last sent (read at each call). */
+    lastSentRequest: () => CompactionForkContext | undefined;
+    /** borrowed-readonly — the leg's resolved brain-call guardrail (the value doors' answer; `undefined` = off). */
+    brainCallGuardrailMs: number | undefined;
+}
+export interface PrepareAdvisorResult {
+    /** The manifest's `advisor` fact; absent ⇔ the spec names no advisor model. */
+    manifest: WiringAdvisorFact | undefined;
+    /** The leg's instruction seat; absent when there is nothing to tell and nothing told. */
+    instruction: AdvisorInstructionSeat | undefined;
+}
+/** The phase body — see the module header. Throws only `config.reserved_tool_name` (a caller tool named `advisor` on a leg that mounts it). */
+export declare function prepareAdvisor(input: PrepareAdvisorInput): Promise<PrepareAdvisorResult>;