@sema-agent/core 7.54.1 → 7.55.0

package/dist/core/tool-catalog-entries.js

@@ -6,6 +6,7 @@ export const TASK_GET_TOOL_NAME = "TaskGet";
 export const TASK_UPDATE_TOOL_NAME = "TaskUpdate";
 export const TASK_LIST_TOOL_NAME = "TaskList";
 export const TODO_WRITE_TOOL_NAME = "TodoWrite";
+export const OUTPUT_TOOL_NAME = "StructuredOutput";
 export const REFRESH_MCP_TOOLS_TOOL_NAME = "RefreshMcpTools";
 export const ARTIFACT_TOOL_NAME = "Artifact";
 const shellRuleFace = (params) => ({ grammar: "command", primaryParams: ["command"], params });
@@ -115,55 +116,56 @@ export const TOOL_CATALOG_ENTRIES = [
     },
     {
         id: "artifact", name: ARTIFACT_TOOL_NAME, source: "builtin", definedIn: "src/tools/artifact/artifact-tool.ts", mountedBy: ["optional"], cards: ["artifact"],
-        face: { family: "other", boundaryLegs: "per_call", effect: "write", contract: c("core.artifact@1"), ruleFace: { primaryParams: ["action"] }, renderHints: { summaryParams: ["action", "file_path", "url"] } },
+        face: { family: "other", boundaryLegs: "per_call", effect: "write", contract: c("core.artifact@1"), ruleFace: { primaryParams: ["action"], params: ["action", "file_path", "url", "title", "description", "favicon", "label", "baseVersion", "force", "publishContext", "scope", "limit", "path"] }, renderHints: { summaryParams: ["action", "file_path", "url"] } },
     },
-    { id: "enter-worktree", name: "EnterWorktree", source: "builtin", definedIn: "src/tools/worktree.ts", mountedBy: ["hands"], cards: ["worktree"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.enter_worktree@1") } },
-    { id: "exit-worktree", name: "ExitWorktree", source: "builtin", definedIn: "src/tools/worktree.ts", mountedBy: ["hands"], cards: ["worktree"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.exit_worktree@1") } },
-    { id: "task-output-hands", name: "TaskOutput", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"], cards: [], face: { family: "delegate", boundaryLegs: ["env"], effect: "read", contract: TASK_OUTPUT_CONTRACT } },
-    { id: "task-stop-hands", name: "TaskStop", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"], cards: [], face: { family: "delegate", boundaryLegs: ["env"], effect: "write", contract: TASK_STOP_CONTRACT } },
-    { id: "task-output", name: "TaskOutput", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-output"], face: { family: "delegate", boundaryLegs: "per_call", effect: "read", contract: TASK_OUTPUT_CONTRACT } },
-    { id: "task-stop", name: "TaskStop", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-stop"], face: { family: "delegate", boundaryLegs: "per_call", effect: "write", contract: TASK_STOP_CONTRACT } },
+    { id: "enter-worktree", name: "EnterWorktree", source: "builtin", definedIn: "src/tools/worktree.ts", mountedBy: ["hands"], cards: ["worktree"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.enter_worktree@1"), ruleFace: { params: ["name", "path", "baseRef"] } } },
+    { id: "exit-worktree", name: "ExitWorktree", source: "builtin", definedIn: "src/tools/worktree.ts", mountedBy: ["hands"], cards: ["worktree"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.exit_worktree@1"), ruleFace: { params: ["keep", "discardChanges", "action", "discard_changes"] } } },
+    { id: "task-output-hands", name: "TaskOutput", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"], cards: [], face: { family: "delegate", boundaryLegs: ["env"], effect: "read", contract: TASK_OUTPUT_CONTRACT, ruleFace: { params: ["task_id", "filter"] } } },
+    { id: "task-stop-hands", name: "TaskStop", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"], cards: [], face: { family: "delegate", boundaryLegs: ["env"], effect: "write", contract: TASK_STOP_CONTRACT, ruleFace: { params: ["task_id", "shell_id"] } } },
+    { id: "task-output", name: "TaskOutput", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-output"], face: { family: "delegate", boundaryLegs: "per_call", effect: "read", contract: TASK_OUTPUT_CONTRACT, ruleFace: { params: ["task_id", "block", "timeout", "filter"] } } },
+    { id: "task-stop", name: "TaskStop", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-stop"], face: { family: "delegate", boundaryLegs: "per_call", effect: "write", contract: TASK_STOP_CONTRACT, ruleFace: { params: ["task_id", "shell_id"] } } },
     { id: "monitor", name: "Monitor", source: "builtin", definedIn: "src/tools/monitor.ts", mountedBy: ["backgroundTasks"], cards: ["monitor-start", "readonly_out_of_root", "read_unestablished"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.monitor@1"), ruleFace: shellRuleFace(["command", "description", "timeout_ms", "persistent"]), offloadThresholdChars: 10_000 } },
-    { id: "send-message", name: "SendMessage", protocol: ["teammate"], source: "builtin", definedIn: "src/agents/send-message-tool.ts", mountedBy: ["delegation", "hostInternals", "peerLane"], cards: ["send-message"], face: { family: "protocol", boundaryLegs: ["outside_write"], effect: "write", contract: c("core.send_message@1") } },
-    { id: "agent-transcript", name: "AgentTranscript", source: "builtin", definedIn: "src/agents/agent-transcript-tool.ts", mountedBy: ["delegation"], cards: ["agent-transcript"], face: { family: "delegate", boundaryLegs: [], effect: "read", contract: c("core.agent_transcript@1") } },
-    { id: "list-agents", name: "ListAgents", source: "builtin", definedIn: "src/agents/list-agents-tool.ts", mountedBy: ["delegation", "peerLane"], cards: ["list-agents"], face: { family: "protocol", boundaryLegs: [], effect: "read", aliases: ["ListPeers"], contract: c("core.list_agents@1") } },
-    { id: "read-inbox", name: "ReadInbox", source: "builtin", definedIn: "src/agents/read-inbox-tool.ts", mountedBy: ["peerLane"], cards: ["read-inbox"], face: { family: "protocol", boundaryLegs: [], effect: "read", contract: c("core.read_inbox@1"), offload: false, budgetExempt: true } },
-    { id: "workflow", name: "Workflow", source: "builtin", definedIn: "src/orchestration/run-workflow-tool.ts", mountedBy: ["workflow"], cards: ["workflow-run"], face: { family: "delegate", boundaryLegs: [], effect: "write", contract: c("core.workflow@1") } },
-    { id: "report-blocked", name: "ReportBlocked", protocol: ["delegated"], source: "builtin", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["always"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.report_blocked@1") } },
-    { id: "report-findings", name: "ReportFindings", source: "builtin", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["always"], cards: ["report-findings"], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.report_findings@1") } },
-    { id: "structured-output", name: "StructuredOutput", protocol: ["structured"], source: "synthetic", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["optional"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.structured_output@1") } },
-    { id: "skill", name: "Skill", source: "builtin", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["optional"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.skill@1") } },
-    { id: "read-tool-result", name: "ReadToolResult", source: "builtin", definedIn: "src/core/tool-result-store.ts", mountedBy: ["optional"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.read_tool_result@1"), budgetExempt: true } },
-    { id: "tool-search", name: "ToolSearch", source: "builtin", definedIn: "src/core/runner/tool-disclosure.ts", mountedBy: ["optional"], cards: ["tool-search"], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.tool_search@1") } },
-    { id: "ask-user-question", name: "AskUserQuestion", source: "builtin", definedIn: "src/core/ask-question.ts", mountedBy: ["optional"], cards: ["ask-question"], face: { family: "other", boundaryLegs: [], effect: "read", contract: c("core.ask_user_question@1"), renderHints: { approvalCard: "question" } } },
-    { id: "exit-plan-mode", name: "ExitPlanMode", source: "builtin", definedIn: "src/core/present-plan-tool.ts", mountedBy: ["optional"], cards: ["exit-plan-mode"], face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.exit_plan_mode@1"), renderHints: { userFacingName: "", approvalCard: "plan" } } },
-    { id: "enter-plan-mode", name: "EnterPlanMode", source: "builtin", definedIn: "src/core/present-plan-tool.ts", mountedBy: ["optional"], cards: ["enter-plan-mode"], face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.enter_plan_mode@1") } },
-    { id: "refresh-mcp-tools", name: REFRESH_MCP_TOOLS_TOOL_NAME, source: "builtin", definedIn: "src/core/runner/prepare-protocol-tools.ts", mountedBy: ["optional"], cards: [], face: { family: "protocol", boundaryLegs: ["outside_read"], effect: "read" } },
-    { id: "memory-search", name: "memory_search", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contentOrigin: "local", contract: c("core.memory_search@1", "7"), offload: false } },
-    { id: "memory-get", name: "memory_get", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contentOrigin: "local", contract: c("core.memory_get@1", "7"), offload: false } },
-    { id: "memory-index", name: "memory_index", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contentOrigin: "local", contract: c("core.memory_index@1", "2"), offload: false } },
-    { id: "memory-list", name: "memory_list", source: "builtin", definedIn: "src/core/shared-memory/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contract: c("core.memory_list@1"), offload: false } },
-    { id: "memory-read", name: "memory_read", source: "builtin", definedIn: "src/core/shared-memory/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contract: c("core.memory_read@1"), offload: false } },
-    { id: "cron-create", name: "CronCreate", protocol: ["teammate"], source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["cron-create"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.cron_create@1") } },
-    { id: "cron-delete", name: "CronDelete", protocol: ["teammate"], source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["cron-delete"], face: { family: "other", boundaryLegs: ["env"], effect: "idempotent", contract: c("core.cron_delete@1") } },
-    { id: "cron-list", name: "CronList", protocol: ["teammate"], source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["cron-list"], face: { family: "other", boundaryLegs: ["env"], effect: "read", contract: c("core.cron_list@1") } },
-    { id: "schedule-wakeup", name: "ScheduleWakeup", source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["schedule-wakeup"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.schedule_wakeup@1") } },
+    { id: "send-message", name: "SendMessage", protocol: ["teammate"], source: "builtin", definedIn: "src/agents/send-message-tool.ts", mountedBy: ["delegation", "hostInternals", "peerLane"], cards: ["send-message"], face: { family: "protocol", boundaryLegs: ["outside_write"], effect: "write", contract: c("core.send_message@1"), ruleFace: { params: ["to", "message", "summary", "notify_when_idle", "urgent"] } } },
+    { id: "agent-transcript", name: "AgentTranscript", source: "builtin", definedIn: "src/agents/agent-transcript-tool.ts", mountedBy: ["delegation"], cards: ["agent-transcript"], face: { family: "delegate", boundaryLegs: [], effect: "read", contract: c("core.agent_transcript@1"), ruleFace: { params: ["id", "lastN"] } } },
+    { id: "list-agents", name: "ListAgents", source: "builtin", definedIn: "src/agents/list-agents-tool.ts", mountedBy: ["delegation", "peerLane"], cards: ["list-agents"], face: { family: "protocol", boundaryLegs: [], effect: "read", aliases: ["ListPeers"], contract: c("core.list_agents@1"), ruleFace: { params: ["includeAll"] } } },
+    { id: "read-inbox", name: "ReadInbox", source: "builtin", definedIn: "src/agents/read-inbox-tool.ts", mountedBy: ["peerLane"], cards: ["read-inbox"], face: { family: "protocol", boundaryLegs: [], effect: "read", contract: c("core.read_inbox@1"), offload: false, budgetExempt: true, ruleFace: { params: ["limit"] } } },
+    { id: "workflow", name: "Workflow", source: "builtin", definedIn: "src/orchestration/run-workflow-tool.ts", mountedBy: ["workflow"], cards: ["workflow-run"], face: { family: "delegate", boundaryLegs: [], effect: "write", contract: c("core.workflow@1"), renderHints: { approvalCard: "workflow" }, ruleFace: { params: ["script", "name", "scriptPath", "resumeFromRunId"] } } },
+    { id: "report-blocked", name: "ReportBlocked", protocol: ["delegated"], source: "builtin", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["always"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.report_blocked@1"), ruleFace: { params: ["reason"] } } },
+    { id: "report-findings", name: "ReportFindings", source: "builtin", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["always"], cards: ["report-findings"], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.report_findings@1"), ruleFace: { params: ["level"] } } },
+    { id: "structured-output", name: OUTPUT_TOOL_NAME, protocol: ["structured"], source: "synthetic", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["optional"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.structured_output@1") } },
+    { id: "skill", name: "Skill", source: "builtin", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["optional"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.skill@1"), renderHints: { approvalCard: "skill" }, ruleFace: { params: ["skill", "args"] } } },
+    { id: "read-tool-result", name: "ReadToolResult", source: "builtin", definedIn: "src/core/tool-result-store.ts", mountedBy: ["optional"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.read_tool_result@1"), budgetExempt: true, ruleFace: { params: ["ref", "offset", "limit"] } } },
+    { id: "tool-search", name: "ToolSearch", source: "builtin", definedIn: "src/core/runner/tool-disclosure.ts", mountedBy: ["optional"], cards: ["tool-search"], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.tool_search@1"), ruleFace: { params: ["query", "max_results"] } } },
+    { id: "advisor", name: "advisor", source: "builtin", definedIn: "src/core/runner/advisor-tool.ts", mountedBy: ["optional"], cards: ["advisor"], face: { family: "scaffold", boundaryLegs: [], effect: "read", contentOrigin: "local", contract: c("core.advisor@1"), offload: false, budgetExempt: true, ruleFace: { params: [] } } },
+    { id: "ask-user-question", name: "AskUserQuestion", source: "builtin", definedIn: "src/core/ask-question.ts", mountedBy: ["optional"], cards: ["ask-question"], face: { family: "other", boundaryLegs: [], effect: "read", contract: c("core.ask_user_question@1"), renderHints: { approvalCard: "question" }, ruleFace: { params: [] } } },
+    { id: "exit-plan-mode", name: "ExitPlanMode", source: "builtin", definedIn: "src/core/present-plan-tool.ts", mountedBy: ["optional"], cards: ["exit-plan-mode"], face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.exit_plan_mode@1"), renderHints: { userFacingName: "", approvalCard: "plan" }, ruleFace: { params: ["plan"] } } },
+    { id: "enter-plan-mode", name: "EnterPlanMode", source: "builtin", definedIn: "src/core/present-plan-tool.ts", mountedBy: ["optional"], cards: ["enter-plan-mode"], face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.enter_plan_mode@1"), ruleFace: { params: [] } } },
+    { id: "refresh-mcp-tools", name: REFRESH_MCP_TOOLS_TOOL_NAME, source: "builtin", definedIn: "src/core/runner/prepare-protocol-tools.ts", mountedBy: ["optional"], cards: [], face: { family: "protocol", boundaryLegs: ["outside_read"], effect: "read", ruleFace: { params: ["server"] } } },
+    { id: "memory-search", name: "memory_search", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contentOrigin: "local", contract: c("core.memory_search@1", "7"), offload: false, ruleFace: { params: ["query", "limit", "includeSuperseded", "includeShadowed"] } } },
+    { id: "memory-get", name: "memory_get", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contentOrigin: "local", contract: c("core.memory_get@1", "7"), offload: false, ruleFace: { params: ["id", "slug", "scope", "offset", "limit", "lineCursor"] } } },
+    { id: "memory-index", name: "memory_index", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contentOrigin: "local", contract: c("core.memory_index@1", "2"), offload: false, ruleFace: { params: ["offset", "limit", "listingRev", "scope", "includeSuperseded", "includeShadowed"] } } },
+    { id: "memory-list", name: "memory_list", source: "builtin", definedIn: "src/core/shared-memory/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contract: c("core.memory_list@1"), offload: false, ruleFace: { params: ["store", "path_prefix", "cursor"] } } },
+    { id: "memory-read", name: "memory_read", source: "builtin", definedIn: "src/core/shared-memory/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contract: c("core.memory_read@1"), offload: false, ruleFace: { params: ["store", "path"] } } },
+    { id: "cron-create", name: "CronCreate", protocol: ["teammate"], source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["cron-create"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.cron_create@1"), ruleFace: { params: ["prompt", "cron", "recurring", "durable", "label"] } } },
+    { id: "cron-delete", name: "CronDelete", protocol: ["teammate"], source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["cron-delete"], face: { family: "other", boundaryLegs: ["env"], effect: "idempotent", contract: c("core.cron_delete@1"), ruleFace: { params: ["id"] } } },
+    { id: "cron-list", name: "CronList", protocol: ["teammate"], source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["cron-list"], face: { family: "other", boundaryLegs: ["env"], effect: "read", contract: c("core.cron_list@1"), ruleFace: { params: [] } } },
+    { id: "schedule-wakeup", name: "ScheduleWakeup", source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["schedule-wakeup"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.schedule_wakeup@1"), ruleFace: { params: ["delaySeconds", "reason", "prompt", "stop", "noop"] } } },
     {
         id: "web-fetch", name: "WebFetch", source: "builtin", definedIn: "src/tools/web.ts", mountedBy: ["scenario"], cards: ["web-fetch"],
-        face: { family: "web", boundaryLegs: ["outside_read"], effect: "read", contentOrigin: "external", contract: c("core.web_fetch@1"), ruleFace: { primaryParams: ["url"] }, renderHints: { summaryParams: ["url"], approvalCard: "fetch" }, compactable: true },
+        face: { family: "web", boundaryLegs: ["outside_read"], effect: "read", contentOrigin: "external", contract: c("core.web_fetch@1"), hostTarget: { param: "url" }, ruleFace: { primaryParams: ["url"], params: ["url", "prompt"] }, renderHints: { summaryParams: ["url"], approvalCard: "fetch" }, compactable: true },
     },
     {
         id: "web-search", name: "WebSearch", source: "builtin", definedIn: "src/tools/web.ts", mountedBy: ["scenario"], cards: ["web-search"],
-        face: { family: "web", boundaryLegs: ["outside_read"], effect: "read", contentOrigin: "external", contract: c("core.web_search@1"), ruleFace: { primaryParams: ["query"] }, renderHints: { summaryParams: ["query"] }, compactable: true },
+        face: { family: "web", boundaryLegs: ["outside_read"], effect: "read", contentOrigin: "external", contract: c("core.web_search@1"), ruleFace: { primaryParams: ["query"], params: ["query"] }, renderHints: { summaryParams: ["query"] }, compactable: true },
     },
-    { id: "todo-write", name: TODO_WRITE_TOOL_NAME, source: "builtin", definedIn: "src/tools/todo.ts", mountedBy: ["scenario"], cards: ["todo"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "idempotent", contract: c("core.todo_write@1") } },
-    { id: "task-create", name: TASK_CREATE_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "write", contract: c("core.task_create@1") } },
-    { id: "task-get", name: TASK_GET_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.task_get@1") } },
-    { id: "task-update", name: TASK_UPDATE_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "idempotent", contract: c("core.task_update@1") } },
-    { id: "task-list", name: TASK_LIST_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task-list"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.task_list@1") } },
-    { id: "agent", name: "Agent", source: "builtin", definedIn: "src/agents/subagent.ts", mountedBy: ["scenario"], cards: ["agent", "fork"], face: { family: "delegate", boundaryLegs: [], contentOrigin: "local", contract: c("core.agent@1") } },
-    { id: "observer-report", name: "ObserverReport", protocol: ["observer"], source: "builtin", definedIn: "src/agents/observer.ts", mountedBy: ["scenario"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "write", contract: c("core.observer_report@1") } },
-    { id: "declare-done", name: "DeclareDone", protocol: ["goal"], source: "builtin", definedIn: "src/orchestration/goal.ts", mountedBy: ["scenario"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read" } },
+    { id: "todo-write", name: TODO_WRITE_TOOL_NAME, source: "builtin", definedIn: "src/tools/todo.ts", mountedBy: ["scenario"], cards: ["todo"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "idempotent", contract: c("core.todo_write@1"), ruleFace: { params: [] } } },
+    { id: "task-create", name: TASK_CREATE_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "write", contract: c("core.task_create@1"), ruleFace: { params: ["subject", "description", "activeForm"] } } },
+    { id: "task-get", name: TASK_GET_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.task_get@1"), ruleFace: { params: ["taskId"] } } },
+    { id: "task-update", name: TASK_UPDATE_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "idempotent", contract: c("core.task_update@1"), ruleFace: { params: ["taskId", "status", "subject", "description", "activeForm"] } } },
+    { id: "task-list", name: TASK_LIST_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task-list"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.task_list@1"), ruleFace: { params: [] } } },
+    { id: "agent", name: "Agent", source: "builtin", definedIn: "src/agents/subagent.ts", mountedBy: ["scenario"], cards: ["agent", "fork"], face: { family: "delegate", boundaryLegs: [], contentOrigin: "local", contract: c("core.agent@1"), ruleFace: { params: ["subagent_type", "description", "prompt", "name", "cwd", "model", "isolation", "run_in_background"] } } },
+    { id: "observer-report", name: "ObserverReport", protocol: ["observer"], source: "builtin", definedIn: "src/agents/observer.ts", mountedBy: ["scenario"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "write", contract: c("core.observer_report@1"), ruleFace: { params: ["report"] } } },
+    { id: "declare-done", name: "DeclareDone", protocol: ["goal"], source: "builtin", definedIn: "src/orchestration/goal.ts", mountedBy: ["scenario"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", ruleFace: { params: ["summary"] } } },
 ];
 export const ENGINE_CARDS = Object.freeze({
     mcp: "src/core/mcp.ts",
@@ -177,13 +179,26 @@ const byId = new Map();
 for (const e of TOOL_CATALOG_ENTRIES) {
     if (byId.has(e.id))
         throw new Error(`tool catalog: duplicate definition id ${JSON.stringify(e.id)}`);
+    if (e.face.pathTarget !== undefined && e.face.hostTarget !== undefined)
+        throw new Error(`tool catalog: ${JSON.stringify(e.id)} declares a path target and a host target — a face names one protected target`);
     byId.set(e.id, e);
 }
+const CATALOG_CONTRACTS = new WeakSet();
 export function toolFace(id) {
     const e = byId.get(id);
     if (e === undefined)
         throw new Error(`tool catalog: no definition ${JSON.stringify(id)}`);
-    return { contentOrigin: "local", ...structuredClone(e.face) };
+    const face = { contentOrigin: "local", ...structuredClone(e.face) };
+    if (face.contract !== undefined)
+        CATALOG_CONTRACTS.add(face.contract);
+    return face;
+}
+export function isCatalogContract(contract) {
+    return typeof contract === "object" && contract !== null && CATALOG_CONTRACTS.has(contract);
+}
+export function mountRuleFace(id) {
+    const primaryParams = toolFace(id).ruleFace?.primaryParams;
+    return primaryParams === undefined ? undefined : { primaryParams: [...primaryParams] };
 }
 function deepFreeze(value) {
     if (value !== null && typeof value === "object" && !Object.isFrozen(value)) {

package/dist/core/tool-conformance.js

@@ -33,5 +33,6 @@ export const TOOL_CONFORMANCE_VECTORS = [
         { name: "ToolSearch", why: "needs a deferred tool" },
         { name: "RefreshMcpTools", why: "needs a declared MCP server" },
         { name: "EnterPlanMode", why: "needs a checkpoint store beside plan mode" },
+        { name: "advisor", why: "needs a named advisor model and a ranked pair (TaskSpec.advisorModel, RunnerDeps.tiers)" },
     ]),
 ];

package/dist/core/tool-errors.d.ts

@@ -2,7 +2,7 @@ import type { TSchema } from "typebox";
 /**
  * Truncate a long error to head + "[N characters truncated]" + tail (design/64 §11.2, CC parity).
  *
- * Anchored on CC 2.1.220 `A7e` (the current authority; the previous anchor was CC 88's `toolErrors.ts`,
+ * Cut on the reference's current rule (an older implementation
  * which cut at raw code-unit indices): head and tail are cut on a code-POINT boundary — an astral character
  * straddling either cut is dropped whole rather than emitted as a lone surrogate — and the reported count is
  * `len − head − tail`, i.e. derived from what was actually KEPT, so a rollback is not under-reported.
@@ -10,7 +10,7 @@ import type { TSchema } from "typebox";
  * DELIBERATE DIVERGENCE from the sibling truncators in this repo (mcp.ts `truncateMcpErrorText`,
  * engine/compaction `truncateForSummary`, untrusted-egress `boundedString`), which iterate the kept length
  * down so the marker fits INSIDE the budget (RB-152): here the marker is NOT budgeted — a barely-over input
- * comes back ~36 chars LONGER than the budget. That is CC-verbatim behaviour (`A7e` keeps 5000+marker+5000),
+ * comes back ~36 chars LONGER than the budget. That is the reference's behaviour (it keeps 5000+marker+5000),
  * it is pinned as a contract in test/core-toolgate-coverage.test.ts, and changing it would be a divergence
  * FROM the anchor, not a fix. Recorded as an intentional divergence in the cc-parity divergence registry
  * (internal assets repo, `cc-parity/`), not as an open defect.

package/dist/core/tool-face-reader.js

@@ -2,11 +2,13 @@ import { dataKind, perToolEmptyName, perToolEntryRefusal, quotedName, receivePer
 import { isPlainRecord } from "./mods/kernel/receive.js";
 import { faceProblem } from "./runner/tool-face-overlay.js";
 import { inlineUntrusted } from "./untrusted-text.js";
-const TOOL_FACE_MEMBERS = { family: true, pathTarget: true, renderHints: true, ruleFace: true };
+const TOOL_FACE_MEMBERS = { family: true, pathTarget: true, hostTarget: true, renderHints: true, ruleFace: true };
 const PATH_TARGET_KINDS = { param: "string", aliases: "list", access: "string", skillScopeEligible: "boolean", base: "string", absent: "string", patternParam: "string" };
 const PATH_TARGET_REQUIRED = ["param", "access"];
+const HOST_TARGET_KINDS = { param: "string" };
+const HOST_TARGET_REQUIRED = ["param"];
 const RENDER_HINT_KINDS = { userFacingName: "string", activity: "string", summaryParams: "list", resultCards: "list", approvalCard: "string" };
-const RULE_FACE_KINDS = { primaryParams: "list", params: "list" };
+const RULE_FACE_KINDS = { primaryParams: "list", params: "list", nameValues: "list" };
 function kindProblem(label, value, kind) {
     if (value === undefined)
         return undefined;
@@ -47,7 +49,7 @@ function readOneToolFace(raw) {
     const face = membersOf(raw, "the face", Object.keys(TOOL_FACE_MEMBERS));
     if (typeof face === "string")
         return face;
-    const records = { pathTarget: [PATH_TARGET_KINDS, PATH_TARGET_REQUIRED], renderHints: [RENDER_HINT_KINDS, []], ruleFace: [RULE_FACE_KINDS, []] };
+    const records = { pathTarget: [PATH_TARGET_KINDS, PATH_TARGET_REQUIRED], hostTarget: [HOST_TARGET_KINDS, HOST_TARGET_REQUIRED], renderHints: [RENDER_HINT_KINDS, []], ruleFace: [RULE_FACE_KINDS, []] };
     const entries = [];
     for (const member of Object.keys(face)) {
         const value = face[member];

package/dist/core/tool-face.d.ts

@@ -40,7 +40,7 @@ import type { AssertAllKeysHandled } from "./ask-origin.js";
 /** The closed set of specialised approval cards a shell may pre-select from a render hint. The hint is a
  *  PRE-FILTER: the shell owns each card's input schema and validates the call's full args before
  *  mounting the card (design/388 §2.5 boundary ①). */
-export declare const TOOL_APPROVAL_CARDS: readonly ["file-edit", "file-write", "notebook-edit", "shell", "fetch", "plan", "question", "generic"];
+export declare const TOOL_APPROVAL_CARDS: readonly ["file-edit", "file-write", "notebook-edit", "shell", "fetch", "skill", "workflow", "plan", "question", "generic"];
 export type ToolApprovalCard = (typeof TOOL_APPROVAL_CARDS)[number];
 /** Membership in the closed set — the one screen a stored or declared card word passes before it is read. */
 export declare function isToolApprovalCard(word: unknown): word is ToolApprovalCard;
@@ -141,16 +141,34 @@ export interface ToolRosterPathTarget extends ToolCallPathTarget {
  * So the floor hands over the slot and keeps its mouth shut about the resolution.
  */
 export declare function pathTargetSlotOnly(pt: ToolCallPathTarget): ToolCallPathTarget;
+/**
+ * The parameter that names the URL a tool's call reaches — the HOST-RULE face: the slot a `<Tool>(domain:<host>)` rule of the
+ * tool's name is read on, in every direction (deny / ask / allow), by the one host reader (`callHostTargetOf`, host-target.ts).
+ * Host rules are a grammar of a tool NAME the catalog declares one for (today `WebFetch`); a face may declare a slot only on a
+ * tool of such a name (its wire name), and is refused on any other (`config.tool_face_invalid`). It says WHERE the named host is,
+ * never where the execution goes after it: only the engine's own fetch tool guarantees it connects to no host the gate did not
+ * judge (a cross-host redirect is handed back to the model). A face declares one protected target — this or a
+ * {@link ToolPathTarget}, never both. One shape for every spelling (a catalog row, a `ToolSpec`, the roster row, the call face,
+ * the parked approval row): the slot is all it carries.
+ */
+export interface ToolHostTarget {
+    readonly param: string;
+}
 /**
  * The parameter vocabulary a permission rule (`Tool(param:pattern)`) may name. DERIVED by default from
  * the tool's schema: the SCALAR top-level parameters (string/number/integer/boolean and their enum/const/
  * union forms) plus {@link ToolPathTarget.aliases}; object/array parameters never enter (a rule on them
- * can never match — `matchParamRules` skips non-scalar values). A declaration can only NARROW the derived
+ * can never match — the argument predicate `paramRuleReaches` skips non-scalar values). A declaration can only NARROW the derived
  * set; `primaryParams` defaults to the path target's `param` + aliases.
  */
 export interface ToolRuleFace {
     primaryParams?: readonly string[];
     params?: readonly string[];
+    /** The VALUES this mounted tool takes for the argument its name rules are read against — present on a tool whose rule row says
+     *  its values are the mounted tool's own (the name grammar's `values: "mounted"`, the delegation tool's `Agent(<subagent_type>)`):
+     *  the agent types this mount offers. Data, declared at mount; it rides the roster row and every call's face, and a rule of the
+     *  tool is resolved against it (`canonicalNameValue`). Absent on such a tool ⇒ its calls cannot be read against those rules. */
+    nameValues?: readonly string[];
 }
 /** The roster's WIRE bounds on a tool name and a contract member (design/388 §2.5 / B20). Distinct from
  *  protocol-naming's `TOOL_NAME_MAX_CHARS` (64), the provider-facing bound the MCP/A2A namespacing helper
@@ -211,6 +229,7 @@ export interface ToolFaceDeclaration {
     };
     aliases?: string[];
     pathTarget?: ToolPathTarget;
+    hostTarget?: ToolHostTarget;
     /**
      * The rule face ({@link ToolRuleFace}) and, for a definition whose primary parameter is a shell command line, the grammar
      * that judges it — `grammar: "command"`, the SHELL FACE. Every `Bash(<command>)` rule (the command grammar's one spelling,

package/dist/core/tool-face.js

@@ -1,6 +1,6 @@
 export const TOOL_FAMILIES = Object.freeze(["shell", "file-read", "file-write", "search", "web", "delegate", "plan", "scaffold", "memory", "protocol", "other"]);
 export const TOOL_MOUNT_TAGS = Object.freeze(["hands", "backgroundTasks", "workflow", "delegation", "hostInternals", "peerLane", "scheduler", "memory", "scenario", "always", "optional"]);
-export const TOOL_APPROVAL_CARDS = Object.freeze(["file-edit", "file-write", "notebook-edit", "shell", "fetch", "plan", "question", "generic"]);
+export const TOOL_APPROVAL_CARDS = Object.freeze(["file-edit", "file-write", "notebook-edit", "shell", "fetch", "skill", "workflow", "plan", "question", "generic"]);
 export function isToolApprovalCard(word) {
     return typeof word === "string" && TOOL_APPROVAL_CARDS.includes(word);
 }

package/dist/core/tool-model-gate.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/277 — the tool-registration MODEL GATE (CC 233 counterpart, first formalized there as a
+ * design/277 — the tool-registration MODEL GATE (first formalized upstream as a
  * family+version-floor table over the todo/task-board tool family).
  *
  * WHAT THE GATE IS: a DEFAULT-MOUNT trim, never a capability ban. A {@link ToolSpec.modelGate}
@@ -42,7 +42,7 @@ export declare function modelIdTail(id: string): string;
 export interface ToolModelGateRule {
     /** claude-syntax family+floor rows — meaningful only for ids whose TAIL SEGMENT matches
      *  `claude-<letters>-<digits(-digits)*>`. Version tuples compare positionally, missing positions
-     *  read 0, tuple ≥ floor ⇒ gated (CC 233 comparator, verbatim semantics). Any other id shape
+     *  read 0, tuple ≥ floor ⇒ gated (the reference's comparator semantics). Any other id shape
      *  falls through this axis entirely (fail-open). */
     floors?: ReadonlyArray<readonly [family: string, floor: ReadonlyArray<number>]>;
     /** Exact-id rows (explicit-id discipline): the resolved `Model.id`'s tail segment must equal the
@@ -52,7 +52,7 @@ export interface ToolModelGateRule {
     modelIds?: ReadonlyArray<string>;
 }
 /**
- * The built-in gate table: gate-class → rule. CC 233 z_S floors, verbatim (evidence D2; the
+ * The built-in gate table: gate-class → rule. The reference's floors (evidence D2; the
  * `mythos` row rides per the anchor). v1 vocabulary = ONE class, `"task-scaffold"` — the
  * TodoWrite/TaskCreate/TaskGet/TaskUpdate/TaskList default bundle (`assembleCodeTools`). One class
  * is evidence discipline, not mechanism limit: a family enters this table only with positive

package/dist/core/tool-name-aliases.d.ts

@@ -1,4 +1,5 @@
 import { type ProtocolNamespace } from "./protocol-table.js";
+import type { RuleBehavior } from "./permission-rule-model.js";
 /**
  * RB-476-A stage 2 (ruling 2026-08-02, RB-476 "no compatibility surface survives", replay
  * resolution included) — the durable-name machinery this module used to hold is RETIRED:
@@ -42,10 +43,12 @@ export declare const RULE_TOOL_NAME_VERDICTS: readonly ["current", "retired", "u
  *  - `unmintable_segment` — carries a protocol prefix, but a segment of it is not one the mint produces: the peer segment
  *    (the server / remote agent) is empty or not a spelling the mint produces for any peer (the name is read as written —
  *    peers compare exactly — and every mounted tool carries the minted spelling, so the name reaches none of them), or the
- *    tool segment is EMPTY (a trailing separator, `mcp__srv__`: no tool is minted under an empty segment). `guidance` says
- *    so in one line; `currentName` is the whole name rewritten with the spelling the mint produces (`mcp__github.com__*` →
- *    `mcp__github_com__*`), absent when a segment is empty and there is nothing to rewrite. A tool segment that is not empty
- *    is never judged: it is a literal tool name or a glob over one, and an unmatched one is the audit's advisory.
+ *    tool segment is EMPTY (a trailing separator, `mcp__srv__`: no tool is minted under an empty segment), or the peer segment
+ *    carries a wildcard the list's behavior does not read (`mcp__git*`, `mcp__*__get_*`; and `mcp__*` / `mcp__*__*` in an
+ *    allow list — a deny or ask list reads those two as every tool of the protocol, see {@link wholeProtocolOf}). `guidance`
+ *    says so in one line; `currentName` is the whole name rewritten with the spelling the mint produces (`mcp__github.com__*` →
+ *    `mcp__github_com__*`), absent when a segment is empty or wild and there is nothing to rewrite. A tool segment that is not
+ *    empty is never judged: it is a literal tool name or a glob over one, and an unmatched one is the audit's advisory.
  *
  * `roster` = the tool names (aliases included) the reader knows are mounted: a run's assembled roster at prepare, the
  * names a deployment DECLARES it mounts its own tools under at a session-rule store (an empty set when it declares none).
@@ -65,7 +68,7 @@ export type RuleToolNameVerdict = {
 };
 /**
  * A name in ANY protocol namespace split into its owning namespace, its peer segment and its optional tool segment —
- * CC `rP` (:70710) verbatim, re-anchored on the {@link protocolOf} lookup instead of CC's literal `"mcp"` first split element.
+ * Re-anchored on the {@link protocolOf} lookup instead of CC's literal `"mcp"` first split element.
  * `undefined` for a name that is not namespaced (no protocol prefix). The peer is the first segment — EMPTY for `mcp____x` and
  * for the bare prefix, which name no peer; the tool segment is the REST of the split rejoined, so a tool whose minted segment
  * itself carries the separator (charset normalization maps `get..issue` → `get__issue`) decomposes back to one tool name, and
@@ -77,11 +80,29 @@ export declare function splitNamespacedName(name: string): {
     readonly peer: string;
     readonly tool?: string;
 } | undefined;
-/** See {@link RuleToolNameVerdict}. Pure; the one answer to "is this rule's tool name a name that reaches no tool". */
-export declare function judgeRuleToolName(name: string, roster: ReadonlySet<string>): RuleToolNameVerdict;
+/**
+ * The protocol a name spells as a WHOLE — `mcp__*` and `mcp__*__*`, the two spellings that name every tool of every peer of one
+ * namespace — or `undefined` for any other name. THE one reading of that spelling: the name judgment, the covering matcher, the
+ * entry reader and the tool-name lists all ask it, so none keeps a second list of the spellings.
+ */
+export declare function wholeProtocolOf(name: string): ProtocolNamespace | undefined;
+/**
+ * Does a list of this behavior read a whole-protocol spelling ({@link wholeProtocolOf})? A list that RESTRICTS (`deny`, `ask`) does:
+ * the spelling reaches every tool of the protocol. A list that GRANTS (`allow`) does not — an allow names the scope it widens,
+ * and the reference's allow settings refuse a wildcard in the server position — and neither does a caller that states no
+ * behavior: the spelling then names no tool, the reading every list had before it was one.
+ */
+export declare function readsWholeProtocol(behavior: RuleBehavior | undefined): boolean;
+/** The judgment's sentence for a namespaced name whose peer segment carries a wildcard the list's `behavior` does not read, else `undefined`
+ *  — only that arm of the judgment, for the stations that ask it with no roster (a rule policy's compile, an allowlist constructor). */
+export declare function wildcardPeerRefusalOf(name: string, behavior: RuleBehavior | undefined): string | undefined;
+/** See {@link RuleToolNameVerdict}. Pure; the one answer to "is this rule's tool name a name that reaches no tool".
+ *  `behavior` = the behavior of the list the name is written in: a restricting one (`deny`, `ask`) reads the whole-protocol
+ *  spelling ({@link wholeProtocolOf}) as `current`; with `allow` or none the spelling names no peer and is `unmintable_segment`. */
+export declare function judgeRuleToolName(name: string, roster: ReadonlySet<string>, behavior?: RuleBehavior): RuleToolNameVerdict;
 /** The two kinds of tool-name miss — a closed set. `unknown`: the name is none the engine ever mounted (a typo, a
  *  guess). `expected-absent`: the name is one the engine RETIRED ({@link RETIRED_TOOL_NAMES}), so its absence is no
- *  surprise and the table says what replaced it (CC 2.1.296 spells the same two words for its render-time miss). */
+ *  surprise and the table says what replaced it (the reference spells the same two words for its render-time miss). */
 export declare const TOOL_MISS_KINDS: readonly ["unknown", "expected-absent"];
 declare const UNKNOWN_MISS: "unknown", ABSENT_MISS: "expected-absent";
 /** What {@link judgeToolNameMiss} answers: the kind (a {@link TOOL_MISS_KINDS} word) and, for `expected-absent`, the clause. */

package/dist/core/tool-name-aliases.js

@@ -53,11 +53,28 @@ export function splitNamespacedName(name) {
     const [peer = "", ...rest] = name.slice(ns.prefix.length).split(NAMESPACE_SEPARATOR);
     return rest.length > 0 ? { ns, peer, tool: rest.join(NAMESPACE_SEPARATOR) } : { ns, peer };
 }
-function unmintableSegmentOf({ ns, peer, tool }) {
+const WHOLE_PROTOCOL_PEER = "*";
+export function wholeProtocolOf(name) {
+    const split = splitNamespacedName(name);
+    return split !== undefined && spellsWholeProtocol(split) ? split.ns : undefined;
+}
+function spellsWholeProtocol(split) {
+    return split.peer === WHOLE_PROTOCOL_PEER && (split.tool === undefined || split.tool === "*");
+}
+export function readsWholeProtocol(behavior) {
+    return behavior === "deny" || behavior === "ask";
+}
+function peerWildcardGuidance(ns) {
+    return `a ${ns.id} entry takes no wildcard in its peer segment — write ${ns.prefix}<peer> (every tool of one peer) or ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<tool> (one tool); a deny or ask entry may also write ${ns.prefix}* or ${ns.prefix}*${NAMESPACE_SEPARATOR}* for every ${ns.id} tool`;
+}
+function unmintableSegmentOf(split, behavior) {
+    const { ns, peer, tool } = split;
     if (peer === "")
         return { kind: "unmintable_segment", guidance: `the ${ns.id} name has an empty peer segment — no tool is minted under it` };
     if (tool === "")
         return { kind: "unmintable_segment", guidance: `the ${ns.id} name has an empty tool segment — no tool is minted under it; write ${ns.prefix}<peer> to cover every tool of a peer, or ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<tool> for one tool` };
+    if (peer.includes("*"))
+        return spellsWholeProtocol(split) && readsWholeProtocol(behavior) ? undefined : { kind: "unmintable_segment", guidance: peerWildcardGuidance(ns) };
     const minted = mintNamespacePrefix(ns, peer).slice(ns.prefix.length, -NAMESPACE_SEPARATOR.length);
     if (minted === peer)
         return undefined;
@@ -67,7 +84,14 @@ function unmintableSegmentOf({ ns, peer, tool }) {
         currentName: `${ns.prefix}${minted}${tool !== undefined ? `${NAMESPACE_SEPARATOR}${tool}` : ""}`,
     };
 }
-export function judgeRuleToolName(name, roster) {
+export function wildcardPeerRefusalOf(name, behavior) {
+    const split = splitNamespacedName(name);
+    if (split === undefined || !split.peer.includes("*"))
+        return undefined;
+    const verdict = unmintableSegmentOf(split, behavior);
+    return verdict?.kind === "unmintable_segment" ? verdict.guidance : undefined;
+}
+export function judgeRuleToolName(name, roster, behavior) {
     if (roster.has(name))
         return CURRENT;
     const guidance = RETIRED_TOOL_NAMES.get(name);
@@ -78,7 +102,7 @@ export function judgeRuleToolName(name, roster) {
     const split = splitNamespacedName(name);
     if (split === undefined)
         return carriesNamespaceSeparator(name) ? UNPREFIXED : CURRENT;
-    return unmintableSegmentOf(split) ?? CURRENT;
+    return unmintableSegmentOf(split, behavior) ?? CURRENT;
 }
 export const TOOL_MISS_KINDS = Object.freeze(["unknown", "expected-absent"]);
 const [UNKNOWN_MISS, ABSENT_MISS] = TOOL_MISS_KINDS;

package/dist/core/tool-name-readings.d.ts

@@ -98,14 +98,6 @@ export declare const NAME_READINGS: {
         readonly kind: "wire";
         readonly file: string;
     };
-    readonly "lanes.persistedEditSkip": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
-    readonly "lanes.persistedLaneSkip": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
     readonly "lanes.allowLayerQuestionSkip": {
         readonly kind: "wire";
         readonly file: string;
@@ -163,6 +155,11 @@ export declare const NAME_READINGS: {
         readonly rank: "member";
         readonly file: string;
     };
+    readonly "floor.protectiveHostTarget": {
+        readonly kind: "seat";
+        readonly rank: "member";
+        readonly file: string;
+    };
     readonly "mode.planRosterRow": {
         readonly kind: "wire";
         readonly file: string;

package/dist/core/tool-name-readings.js

@@ -26,8 +26,6 @@ export const NAME_READINGS = {
     "lanes.modeFileCommand": wire(LANES),
     "lanes.contentAskRoute": wire(LANES),
     "lanes.orgContentAskExemption": wire(LANES),
-    "lanes.persistedEditSkip": wire(LANES),
-    "lanes.persistedLaneSkip": wire(LANES),
     "lanes.allowLayerQuestionSkip": wire(LANES),
     "lanes.sandboxQuestionSkip": wire(LANES),
     "policy.nameLists": any(POLICY),
@@ -42,6 +40,7 @@ export const NAME_READINGS = {
     "policy.durableQuestion": any("src/core/ask-question.ts"),
     "policy.sensitivePathGuardedByName": any("src/core/sensitive-path-policy.ts"),
     "floor.protectivePathTarget": seat("member", "src/core/tool-registry.ts"),
+    "floor.protectiveHostTarget": seat("member", "src/core/host-target.ts"),
     "mode.planRosterRow": wire("src/core/mode-policy.ts"),
     "offer.laneTool": wire(OFFER),
     "offer.orgQuestionExemption": wire(OFFER),

package/dist/core/tool-policy.d.ts

@@ -5,6 +5,7 @@ export { policyCannotAnswer, rowDemandsAPerson } from "./real-approval.js";
 import { type BindingFault } from "./canonical-json.js";
 import { type DecisionReason } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
+import { type RuleBehavior } from "./permission-rule-model.js";
 import { type RemovalGuardSeat } from "../tools/fs/removal-targets.js";
 /** A tool call presented to a policy before it executes. */
 /** design/388 B6 — the per-call face (see {@link ToolCallRequest.face}). */
@@ -16,6 +17,14 @@ export interface ToolCallFace {
     names?: readonly string[];
     family: import("./tool-face.js").ToolFamily;
     pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
+    /** The URL slot a host rule of the tool's name is read on (`callHostTargetOf`), as the tool declared it — absent when it
+     *  declares none, so no allow by host reaches the call (a deny or an ask still reads the catalog's slot for the name). */
+    hostTarget?: import("./tool-face.js").ToolHostTarget;
+    /** The values the mounted tool takes for the argument its name rules are read against (`ToolRuleFace.nameValues`, off the
+     *  roster row — the delegation tool's offered agent types): a name rule of such a tool resolves its value and the call's against
+     *  them (`nameRuleReach`). Absent where the tool declares none, and on a face rebuilt from a park row: a rule that needs them
+     *  then cannot be read against the call (a deny refuses, an ask asks a person, an allow grants nothing). */
+    nameValues?: readonly string[];
     capabilityId: string;
     contractId: string;
     shapeDigest: string;
@@ -25,6 +34,10 @@ export interface ToolCallFace {
      *  ask, the parked gate and the pending row, so no reader recovers the card from a name. Absent on a face rebuilt
      *  from a park row (a re-judgment reads no card). */
     approvalCard?: import("./tool-face.js").ToolApprovalCard;
+    /** Present (`true`) iff one of the ENGINE's own mount sites mounted the tool the call dispatches to — a built-in or synthetic tool
+     *  the engine minted for the leg, never a caller's `TaskSpec.tools` entry or a protocol peer's tool (`engineMountedRow`). The one
+     *  identity a caller cannot wear: a name and a contract id can be declared. Absent on a face rebuilt from a park row. */
+    engineMounted?: true;
 }
 export interface ToolCallRequest {
     /** The tool's wire name — the Runner's gate resolves a call made under an alias to the wire name of the tool it
@@ -384,7 +397,7 @@ export type PermissionResult = {
     decisionReason?: DecisionReason;
     requiresRealApproval?: boolean;
     /** This ask is the classifier DENIAL-LIMIT fallback — the block that reached a
-     *  bound (CC 2.1.250 `FO`, count-then-judge) handed to a person instead of being denied.
+     *  bound (count-then-judge) handed to a person instead of being denied.
      *  ENGINE-STAMPED beside `requiresRealApproval: true` and `decisionReason: "classifier"` at the
      *  classifier block sites (the gate's own and the inherited-lane arms); carries the COUNTS ONLY —
      *  the auto-deny window is a fact of the ask's ROUTE, so this type has no member to hold one
@@ -410,7 +423,9 @@ export type PermissionResult = {
     /** backlog #239 disclosure (additive): WHY the reversibility probe did not clear this call, in the
      *  probe's own words. ENGINE-STAMPED at the irreversibility tighten (which constructs this decision
      *  wholesale), already neutralized + capped there; a `"maybe"` tier whose probe supplied no cause,
-     *  and the `"always"` tier (which runs no probe), leave it absent. Same DISPLAY-ONLY posture as
+     *  and the `"always"` tier (which runs no probe), leave it absent. Also stamped beside a mandate merged onto an
+     *  ask another layer raised (the read station's account of its finding): it is the one sentence that says why
+     *  a matching allow rule did not clear a `probe_mandate` ask, on the card and in the parked row alike. Same DISPLAY-ONLY posture as
      *  {@link allowRuleShadowed}: a policy that self-declares it can only put its own prose on its
      *  own card — nothing reads this member to decide anything, so it is not an authority channel. */
     probeReason?: string;
@@ -780,6 +795,10 @@ export interface ToolPolicyProjection {
  *
  * The list is usually empty, which is why every call site tests it before scanning.
  *
+ * `behavior` = what the list does with a call it reaches: `deny` / `ask` (restricting) lists also read the whole-protocol
+ * spelling (`mcp__*`, `mcp__*__*`) as a covering entry — every tool of the namespace — and an `allow` list does not (the
+ * spelling names no peer there; the constructors and the prepare-time audit refuse it, and a stored allowlist reads it as nothing).
+ *
  * Exported for the OTHER name-keyed lane in this engine — the persisted session/ancestor rules in
  * `session-rule-policy.ts`. Not part of the public API (`src/index.ts` re-exports by name and does not
  * list these two): every publisher of {@link ToolPolicyNameSets} must resolve a covering entry the same
@@ -791,7 +810,7 @@ export interface ToolPolicyProjection {
  * the package index: an external lane either compiles through `createPermissionRulePolicy` or
  * self-checks with those.
  */
-export declare function namespacedCoveringEntries(entries: readonly string[] | undefined): readonly string[];
+export declare function namespacedCoveringEntries(entries: readonly string[] | undefined, behavior: RuleBehavior): readonly string[];
 /** Does any covering entry reach the call — under ANY name it answers to, the same reading the exact lists take through
  *  `nameListHolds` (a covering entry and an exact entry in one list are one rule: it reaches the call iff its name is on the
  *  list)? See {@link namespacedCoveringEntries}. */
@@ -1162,7 +1181,7 @@ export declare function createCoarseCommandNamePolicy(opts: {
     tools?: string[];
 }): ToolPolicy;
 /**
- * CC 220 "Unverifiable Deletion Target" parity (auto-mode rule; its text is in 220–245, gone from 2.1.250 on): ASK on a recursive+forced delete whose
+ * "Unverifiable Deletion Target" (auto-mode rule; since dropped upstream): ASK on a recursive+forced delete whose
  * target is a variable / substitution that cannot be resolved from the command itself — fail-closed in the
  * sense that with no live classifier/approver the ask degrades to deny (see {@link PermissionResult}'s
  * `ask` doc), never to allow. The guard reads ONE plan, the read station's (`removalReadingOf`,
@@ -1176,7 +1195,7 @@ export declare function createCoarseCommandNamePolicy(opts: {
  * RB-341 (2026-07-29) re-checked that citation against the 220 corpus and corrected it in BOTH directions.
  * The RB-203 note claimed the phrase "traces to the 206 bundle; it does not appear anywhere in the 220
  * corpus for THIS rule" — that sentence was wrong and is retracted. The phrase has 8 hits in 220, and two
- * of them are this exact rule's own message text: `pretty220` 461365 (the `rm -rf $UNSET/*`
+ * of them are this exact rule's own message text: (the `rm -rf $UNSET/*`
  * variable-expansion arm, verbatim «e.g. `rm -rf $UNSET/*` becomes `rm -rf /*`. This requires explicit
  * approval and cannot be auto-allowed by permission rules.») and 461444 (its command-substitution twin).
  * Five more are the sibling deterministic `rm`/`rmdir` arms (457337/457364/457379/457387/457402) and one is