@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/ask-origin.d.ts

@@ -25,6 +25,7 @@
  * the ask). Both stay where they are and are consumed beside the origin, not folded into it.
  */
 import type { PermissionResult } from "./tool-policy.js";
+import { type EngineAttestation } from "./engine-attestation.js";
 import type { ContainmentFace } from "../tools/fs/containment-face.js";
 /**
  * The closed set, in AUTHORITY order — the order {@link askOriginOf} resolves a fold in when several
@@ -93,6 +94,12 @@ export type AssertAllKeysHandled<T extends never> = T;
  *  itself. Every member is a plain boolean/word read ONCE by the gate, so the derivation is a pure
  *  function that a test can drive arm by arm. */
 export interface AskOriginFacts {
+    /** The call these facts are about — the one an engine record on the decision must be bound to for the derivation to read it
+     *  ({@link import("./engine-attestation.js").attestationOf}): a record handed back for another call reads as absent. */
+    readonly call: {
+        readonly toolCallId: string;
+        readonly toolName: string;
+    };
     /** The call is on the reserved question tool. */
     readonly contentQuestion: boolean;
     /** The call is marked unresolvable by an ancestor (see the gate's `isMarkedUnresolvable` seat). */
@@ -148,7 +155,7 @@ export declare function askOriginOf(decision: Extract<PermissionResult, {
  * word, so a site that stamped without it would be a second, quieter answer to one question.
  * The same stamp writes the ask's CLASS members (`askClass` / `classes`, {@link askClassMembersOf} over the
  * `classification` the caller derived from this decision under these facts): the word and the class leave the
- * gate on one object, and a value a policy put on either is replaced.
+ * gate on one object. No policy states either (the decision receipt refuses a stamp member).
  */
 export declare function stampAskOrigin<T extends Extract<PermissionResult, {
     action: "ask";
@@ -237,10 +244,14 @@ export interface RuleClearanceFacts {
     /** The ask is being resolved at an ANCESTOR's frozen approver (the three inherited-lane mint sites
      *  pass it literally) — this task's rule lane never adjudicates it. */
     ancestorResolved?: boolean;
-    /** The classes of the contributors the policy fold carried under this ask (see {@link import("./tool-policy.js").PermissionResult});
-     *  a member whose row no rule may clear keeps the question a person's. */
-    foldedAskClasses?: readonly AskClass[];
+    /** The classes of the contributors the policy fold carried under this ask — the decision's engine record's
+     *  ({@link EngineAttestation.foldedClasses}), filled in by the builder of these facts ({@link withFoldedOf}); a member whose row
+     *  no rule may clear keeps the question a person's. */
+    foldedClasses?: readonly AskClass[];
 }
+/** `facts` with the folded contributors' classes the decision's record carries for its call — the one way a builder of
+ *  {@link RuleClearanceFacts} fills them (a decision carries no such member: the record is their one carrier). */
+export declare function withFoldedOf<F extends RuleClearanceFacts>(facts: F, record: EngineAttestation | undefined): F;
 /** The ask FACE's mandate members — the bit and its table word, spread at the four mint stations and the
  *  park row. The stations hand it the SAME facts object they hand the rule-offer factory, so the card's word
  *  and these members are readings of one derivation and cannot drift. The tool SEAT is not re-judged here:
@@ -251,12 +262,25 @@ export declare function askMandateMember(ask: RuleClearanceFacts | undefined): {
     mandate?: PersistedRuleMandate;
     authoredBy?: "deployment";
 };
+/**
+ * A MANDATE merged onto an ask another layer raised — the one writer of both merge arms (the read station's, the reversibility
+ * probe's; `gate-fold.ts`). The mandate is the fact that a standing allow rule may not clear the ask, and its account is the only
+ * sentence that can say why (the allow layer's disclosure words a `probe_mandate` with it, on the card and in the parked row): the
+ * two travel together. The FIRST layer to mandate an ask brings its account, or none: a `probeReason` the ask arrived with can only
+ * be its own author's prose, and is replaced by the account — or removed where the mandating layer gave none, so it is never read as
+ * the reason the mandate stands; an ask already mandated keeps the first layer's. The ask's action, message, reason and every other
+ * disclosure are untouched.
+ */
+export declare function withProbeMandate<D extends Extract<PermissionResult, {
+    action: "ask";
+}>>(decision: D, account: string | undefined): D;
 /** The clearance facts of an ask the engine did not construct (a policy's verdict), each member read ONCE into
  *  an engine-owned value — for a station that keeps the answer past its own side effects, where the verdict's
- *  accessors must not run again. The members a verdict may carry that narrow what may clear it. */
+ *  accessors must not run again. The members a verdict may carry that narrow what may clear it, and the folded classes its
+ *  record carries for `call`. */
 export declare function ownedClearanceFacts(d: Extract<PermissionResult, {
     action: "ask";
-}>): RuleClearanceFacts;
+}>, call: AskOriginFacts["call"]): RuleClearanceFacts;
 /**
  * Which origins IMPLY the `requiresRealApproval` bit, and WHERE that implication is verified — the
  * consistency table {@link askOriginOf} reads. An ask of a must-carry origin exists so that no automatic
@@ -300,8 +324,10 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  *
  *  - `operator_always` — the operator's `always` floor: per-call confirmation for shell commands.
  *  - `tool_marks` — the tool's own egress / irreversibility / interaction declaration.
- *  - `probe_mandate` — this call's reversibility probe declared the demotion STRUCTURAL.
- *  - `probe_unanswered` — the probe was consulted and did not answer: the boundary is UNKNOWN.
+ *  - `probe_mandate` — this call's reversibility probe declared the demotion STRUCTURAL. For the engine's own shell station it
+ *    is a FINDING about this call — a path outside the allowed directories (read or written) or a command whose reads it could
+ *    not establish — and the finding's account (the ask's `probeReason`) is the word's whole disclosure ({@link FINDING_ACCOUNT}).
+ *  - `probe_unanswered` — the probe was consulted and did not answer: whether the call is reversible is UNKNOWN.
  *  - `write_protection` — the table covers this write's target. A write onto load-executed configuration
  *    re-authorizes the agent, so the question is a property of the TARGET, not of anyone's hesitation.
  *  - `target_unresolved` — the reading of a written target could not say where it leads on disk:
@@ -314,11 +340,20 @@ export declare const PERSISTED_RULE_MANDATES: readonly ["operator_always", "tool
 export type PersistedRuleMandate = (typeof PERSISTED_RULE_MANDATES)[number];
 /** Membership test for {@link PersistedRuleMandate} — the screen a row reader applies to a stored word. */
 export declare function isPersistedRuleMandate(v: unknown): v is PersistedRuleMandate;
+/** The row of a word whose reason is a FINDING about this very call (what the read station found — a path outside the allowed
+ *  directories, read or written, or a command whose reads it could not establish): no sentence of the table can say which, so
+ *  the reason is the finding's own account — the sentence the station minted for the card, which the ask carries as
+ *  `probeReason` ({@link mandateDisclosureOf} reads it there). A row, not an absence: the word is disclosed, by the ask. */
+export declare const FINDING_ACCOUNT: Readonly<{
+    readonly reasonIs: "the account of the finding, carried on the ask as probeReason";
+}>;
 /** WHY a matching persisted allow rule did not clear the ask, in the sentence a PERSON reads — one row per
  *  word (the ladder this replaces ended in a catch-all arm). Display prose; nothing reads it back to decide. */
-declare const MANDATE_DISCLOSURE: {
-    readonly probe_mandate: "the reversibility check declared this call structurally gated (the built-in shell check raises this for a read outside the directories allowed for this session) — it is cleared by confirming this call, never by a standing allow rule";
-    readonly probe_unanswered: "the reversibility check did not answer for this call (it timed out or failed), so whether the call reads outside the directories allowed for this session is unknown — it is cleared by confirming this call, never by a standing allow rule";
+export declare const MANDATE_DISCLOSURE: {
+    readonly probe_mandate: Readonly<{
+        readonly reasonIs: "the account of the finding, carried on the ask as probeReason";
+    }>;
+    readonly probe_unanswered: "the reversibility check did not answer for this call (it timed out or failed), so whether the call is reversible is unknown — it is cleared by confirming this call, never by a standing allow rule";
     readonly operator_always: "this deployment mandates per-call confirmation for shell commands (shellGate: always)";
     readonly tool_marks: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)";
     readonly write_protection: "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule";
@@ -327,9 +362,18 @@ declare const MANDATE_DISCLOSURE: {
 };
 /** The fence over the disclosure table: `never` while every word has a row. */
 export type DisclosureTableCoversEveryMandate = AssertAllKeysHandled<Exclude<PersistedRuleMandate, keyof typeof MANDATE_DISCLOSURE>>;
-/** The disclosed reason for one word. `undefined` — no mandate — is the lane's OTHER refusal: a standing
- *  "ask me each time" rule matched, which outranks the remembered yes on its own. */
-export declare function mandateDisclosureOf(mandate: PersistedRuleMandate | undefined): string;
+/** The sentence for the lane's OTHER refusal — no mandate: a standing "ask me each time" rule matched, which outranks the
+ *  remembered yes on its own. */
+export declare const ASK_RULE_DISCLOSURE = "an explicit ask rule matched this call (a person's or the deployment's ask-me-each-time outranks a standing allow rule)";
+/**
+ * The disclosed reason for one word. `undefined` — no mandate — is the lane's OTHER refusal ({@link ASK_RULE_DISCLOSURE}).
+ * A word whose row is {@link FINDING_ACCOUNT} is disclosed by the ask's own account of its finding (`account`, the
+ * `probeReason` the ask carries) and by nothing else: with no account there is no sentence (`undefined`) — a word whose reason is
+ * a finding is never worded from a general statement, which would be true of one finding and false of the next. Every
+ * mandate the engine's own read station raises carries its account; an ask that arrives without one (a deployment probe that
+ * supplied no `reason`, a station the host mounted) is a mandate stated without a reason, and the card does not invent one.
+ */
+export declare function mandateDisclosureOf(mandate: PersistedRuleMandate | undefined, account?: string): string | undefined;
 /**
  * The mandate provenance of one call, judged from the SAME mark inputs the gate is driven with —
  * the WORD a mandated ask discloses for its marks (the class derivation reads the same marks as classes,
@@ -781,16 +825,22 @@ export declare function askClassMembersOf(c: AskClassification): AskClassMembers
  *  first member in {@link ASK_CLASSES} order. The copy returned is fresh and frozen, never the caller's array. */
 export declare function screenAskClassMembers(askClass: unknown, classes: unknown): AskClassMembers | undefined;
 /**
- * The DECISION half of the class derivation — what ONE ask says about itself through its own members, read
- * per contributing ask at the policy fold so a member the fold does not copy (a guard mark, the unreadable-rule
- * fact) is not lost behind the ask that won the slot. The bare-bit rules are applied over THIS ask's own set:
- * `requiresRealApproval` with no explaining class is `policy_rra`; a self-declared `mandated` with no other
- * class is `operator_forced` (a deployment probe's own mandate, read conservatively). Returns the specific
- * classes only — an empty set is "nothing but hesitation", which the caller reads as `ordinary`.
+ * The OWN half of the class derivation — what ONE ask says about itself through its own members, and the integrity guards
+ * its engine record carries for its call (`record`, read by the caller through {@link attestationOf}): the guards are engine
+ * findings, never a member, so a policy cannot move a real-approval question into a guard's class. The bare-bit rules are
+ * applied over THIS ask's own set: `requiresRealApproval` with no explaining class is `policy_rra`; a self-declared
+ * `mandated` with no other class is `operator_forced` (a deployment probe's own mandate, read conservatively). Returns the
+ * specific classes only — an empty set is "nothing but hesitation", which the caller reads as `ordinary`.
  */
+export declare function ownAskClassesOf(d: Extract<PermissionResult, {
+    action: "ask";
+}>, record: EngineAttestation | undefined): Set<AskClass>;
+/** The DECISION's classes as the policy fold reads a contributing ask: its own ({@link ownAskClassesOf}) and the classes of the
+ *  asks a fold already collapsed into it ({@link EngineAttestation.foldedClasses}) — both off its record for `call`, so a
+ *  fact the fold does not copy is not lost behind the ask that won the slot. */
 export declare function decisionAskClassesOf(d: Extract<PermissionResult, {
     action: "ask";
-}>): Set<AskClass>;
+}>, call: AskOriginFacts["call"]): Set<AskClass>;
 /** Fold a class set onto one row: `bypassImmune` and `hookAskFloor` by OR (any immune member keeps the ask; any floored
  *  member floors a hook's ask), the three permissive switches by AND (one refusing member withholds the lane). An empty
  *  set is `ordinary`. The two faces the ask was raised under enter HERE and nowhere else, so every reader of the folded row
@@ -809,17 +859,60 @@ export declare function classifyAsk(d: Extract<PermissionResult, {
     action: "ask";
 }>, facts: AskClassFacts): AskClassification;
 /** The refusal the model reads when an ask reaches a run with no approver: the reference implementation's sentence
- *  (2.1.280) — the call did NOT run because this session has no approval surface — with the run's own fact beside it
+ *  the call did NOT run because this session has no approval surface — with the run's own fact beside it
  *  and the ask's prompt as what was requested. The gate appends the caller-side remedy. */
 export declare function headlessDenialMessage(toolName: string, askMessage: string): string;
+/**
+ * The refusal the model reads when the `dontAsk` permission mode refuses an ask (`deniedBy: "mode"`): the reference implementation's
+ * head (whose permission, which mode — with the ask's class beside it) and its guidance ({@link REFUSED_CAPABILITY_GUIDANCE}), then
+ * the way out, the ONE remedy function's `dontAsk` arm ({@link headlessApprovalRemedy}) — the same sentence a headless refusal's
+ * remedy is written by, so a mode refusal and a headless one say the way out in one voice. `ruleShape` is the shape of the allow
+ * rule that would speak for the call (`ruleShapeOf` under `allow`, the rule model's reading of the call's grammar). The sentence
+ * names where allow rules live in a person's words (a settings file, the request's or the deployment's allow list), never a seat
+ * of the library: a host reads the same answer off the denied disposition — `deniedBy: "mode"`, `mode`, and the folded
+ * `classes`, whose row ({@link foldArbitrationRow}) says `ruleMayClear` — and offers its own seat.
+ */
+export declare function dontAskRefusalMessage(input: {
+    readonly toolName: string;
+    readonly classification: AskClassification;
+    readonly coveredWrite: boolean;
+    readonly ruleShape: string;
+}): string;
 /** The state of the approver seat a remedy is written for: `absent` — no approver is wired for the leg; `unavailable` — one is
  *  wired and answered that nobody is reachable for this ask; `declared_none` — the run declared that nobody on it can be
  *  asked (`approvalReach: "none"`), whatever is wired. Absent in the input reads as `absent` (the posture the function was
  *  written for). */
 export type HeadlessApproverSeat = "absent" | "unavailable" | "declared_none";
+/** The kinds of way out a refusal carries as DATA: `approver` — a person who can answer becomes reachable (the sentence's approver clause);
+ *  `permission_mode` — a mode that releases the ask with nobody answering it (`bypassPermissions`, unless the deployment's caps deny it:
+ *  a denied bypass folds to `default`). A host renders a kind or leaves it unrendered; the sentence a user reads never teaches the release. */
+export declare const APPROVAL_REMEDY_KINDS: readonly ["approver", "permission_mode"];
+export type ApprovalRemedyKind = (typeof APPROVAL_REMEDY_KINDS)[number];
+/** Membership test for {@link ApprovalRemedyKind} — the word rides a notice detail across process boundaries. */
+export declare function isApprovalRemedyKind(v: unknown): v is ApprovalRemedyKind;
+/** One way out, discriminated by `kind` ({@link APPROVAL_REMEDY_KINDS}). `permission_mode` names the mode (`value`: `bypassPermissions`, the one
+ *  mode that releases an ask a person did not answer) and where the release is disclosed (`disclosedOn`: the allowed disposition's `released`
+ *  member on the call's `tool_end.gate`) — the disclosure a host shows beside the offer. */
+export type ApprovalRemedy = {
+    readonly kind: "approver";
+} | {
+    readonly kind: "permission_mode";
+    readonly value: "bypassPermissions";
+    readonly disclosedOn: "gate.disposition.released";
+};
+/** One {@link ApprovalRemedy} read from `v`, as a fresh plain object holding only the fields its kind owns — or `undefined` when `v` is not exactly
+ *  one (a kind outside the closed set, a member missing, a member beyond the kind's own, any field inherited rather than own). Each field is read
+ *  once; the notice mint copies through this and refuses what it cannot read. */
+export declare function readApprovalRemedy(v: unknown): ApprovalRemedy | undefined;
+/** The headless remedy: `sentence` — the user-facing way out, which names the approver and never offers the bypass release — and `remedies` — every way out as data, the approver first. */
+export interface HeadlessApprovalRemedy {
+    readonly sentence: string;
+    readonly remedies: readonly ApprovalRemedy[];
+}
 /**
- * The ONE sentence a headless auto-deny (an ask that reached its final deny because no approver is wired) adds
- * after its refusal: the caller-side change that would have let this call run. Read off the effective mode, the
+ * The ONE answer a headless auto-deny (an ask that reached its final deny because no approver is wired) adds
+ * after its refusal: the caller-side change that would have let this call run, as a sentence (`sentence`) and as the
+ * ways out in data (`remedies`, {@link ApprovalRemedy}: the approver in every arm). Read off the effective mode, the
  * ask's folded class row and whether the call is a covered write (the mode write gate's own question):
  *  · a class no permission mode releases (`bypassImmune`) — only a person can answer it: wire an approver;
  *  · the plan mode's own question (`mode`) — leave plan (steer the mode, or approve the plan) or wire an approver;
@@ -827,11 +920,16 @@ export type HeadlessApproverSeat = "absent" | "unavailable" | "declared_none";
  *    directories through without asking;
  *  · the same ask under `acceptEdits` — the target lies outside the working directories: add its directory to
  *    `additionalDirectories`;
- *  · any other releasable ask — `bypassPermissions` releases it (disclosed on the call).
+ *  · any other releasable ask, and a tool that states no permission of its own — `bypassPermissions` releases it (disclosed on the call):
+ *    the sentence does not say so; `remedies` carries it as a `permission_mode` member for a host that chooses to offer it.
  * Every arm also names the approver, in the clause of the seat's own state ({@link HeadlessApproverSeat}): none wired ⇒
  * wire one; one wired that answered `unavailable` for this ask ⇒ make a person reachable through it (a wired approver is
  * never told to be wired); the run declared nobody can be asked ⇒ run it where a person can be, or park it. The refusal's tool text and the `delegation.ask_unresolvable` notice both carry this sentence —
- * they call this function, neither spells it.
+ * they call this function, neither spells it — and the notice carries `remedies` beside it.
+ * Under `dontAsk` (the mode answers no ask: {@link dontAskRefusalMessage} carries this arm) the one question is whether an allow
+ * rule may clear the ask — the folded row's `ruleMayClear`, the allow layer's own reading: yes ⇒ add an allow rule covering the
+ * call, in the tool's rule shape (`ruleShape`, the caller's reading of the call's grammar — never a rule minted for the call), or
+ * run under a mode with an approver; no ⇒ only a person can answer it.
  */
 export declare function headlessApprovalRemedy(input: {
     readonly mode: PermissionMode | undefined;
@@ -841,8 +939,9 @@ export declare function headlessApprovalRemedy(input: {
         readonly program: "cp" | "mv";
     };
     readonly approverSeat?: HeadlessApproverSeat;
-}): string;
-/** The reference implementation's sentence (2.1.280) for a `cp` / `mv` the mode will not answer because it carries option
+    readonly ruleShape?: string;
+}): HeadlessApprovalRemedy;
+/** The reference implementation's sentence for a `cp` / `mv` the mode will not answer because it carries option
  *  words — the approval card's message under `acceptEdits` and the head of the headless remedy. */
 export declare function fileCommandOptionsSentence(program: "cp" | "mv"): string;
 /** What the mode arbitration decided for one surviving ask. `ask` hands it on unchanged (park / approver); `accepted` is
@@ -890,4 +989,3 @@ export declare function arbitrateByMode(mode: PermissionMode, c: AskClassificati
 }, call?: {
     readonly fileCommand?: boolean;
 }): Arbitration;
-export {};

package/dist/core/ask-origin.js

@@ -1,3 +1,4 @@
+import { attestationOf } from "./engine-attestation.js";
 import { isShellFaceToolName } from "./tool-registry.js";
 export const ASK_ORIGINS = Object.freeze(["content_question", "plan_review", "ancestor_marked", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"]);
 const ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
@@ -15,8 +16,8 @@ const TIGHTEN_ONLY_ORIGINS = new Set(["shell_gate_tighten", "safety_tighten"]);
 export function stampAskOrigin(decision, facts, classification) {
     const origin = askOriginOf(decision, facts);
     const classed = askClassMembersOf(classification);
-    const { mandate: _selfDeclared, ...unstamped } = decision;
-    const clearance = ruleClearanceOf(unstamped, facts.mandateMarks);
+    const { mandate: _earlierStamp, ...unstamped } = decision;
+    const clearance = ruleClearanceOf(withFoldedOf(unstamped, attestationOf(decision, facts.call)), facts.mandateMarks);
     const mandated = { ...unstamped, ...(clearance.mandated ? { mandated: true } : {}), ...(clearance.mandate !== undefined ? { mandate: clearance.mandate } : {}), ...(facts.mandateMarks.requiresUserInteraction === true ? { requiresRealApproval: true } : {}) };
     if (mandated.probeReadRootCandidate === undefined || TIGHTEN_ONLY_ORIGINS.has(origin))
         return { ...mandated, origin, ...classed };
@@ -26,7 +27,7 @@ export function stampAskOrigin(decision, facts, classification) {
 export const RULE_OFFERS_ABSENCES = Object.freeze(["mandated", "allow_outranked", "ask_rule_matched", "lane_cannot_speak"]);
 export function ruleClearanceOf(ask, marks) {
     const marksWord = ask?.crossBoundaryMandated === true ? "cross_boundary_taint" : persistedRuleMandateOf({ ...marks, probeMandated: ask?.probeMandated === true });
-    const foldedDoor = (ask?.foldedAskClasses ?? []).some((c) => !MODE_ARBITRATION[c].ruleMayClear);
+    const foldedDoor = (ask?.foldedClasses ?? []).some((c) => !MODE_ARBITRATION[c].ruleMayClear);
     const doorOutsideTable = ask?.requiresRealApproval === true || ask?.decisionReason === "hook" || ask?.decisionReason === "mode" || foldedDoor || ask?.authoredBy === "deployment" || ask?.inheritedUnresolved === true || ask?.ancestorResolved === true;
     const mandated = ask?.mandated === true || doorOutsideTable || marksWord !== undefined;
     const stampedWord = ask?.mandated === true && isPersistedRuleMandate(ask.mandate) ? ask.mandate : undefined;
@@ -52,23 +53,32 @@ export function ruleClearanceOf(ask, marks) {
     })();
     return { ...(word !== undefined ? { word } : {}), mandated, ...(mandate !== undefined ? { mandate } : {}) };
 }
+export function withFoldedOf(facts, record) {
+    const folded = record?.foldedClasses;
+    return folded !== undefined && folded.length > 0 ? { ...facts, foldedClasses: [...folded] } : facts;
+}
 export function askMandateMember(ask) {
     const { mandated, mandate } = ruleClearanceOf(ask, {});
     const authored = ask?.authoredBy === "deployment" ? { authoredBy: "deployment" } : {};
     return mandated ? { mandated: true, ...(mandate !== undefined ? { mandate } : {}), ...authored } : authored;
 }
-export function ownedClearanceFacts(d) {
-    const { mandated, requiresRealApproval, decisionReason, matchedAskRule, probeMandated, crossBoundaryMandated, authoredBy, foldedAskClasses } = d;
-    return {
+export function withProbeMandate(decision, account) {
+    if (decision.probeMandated === true)
+        return decision;
+    const { probeReason: _arrivedWith, ...rest } = decision;
+    return { ...rest, probeMandated: true, ...(account !== undefined ? { probeReason: account } : {}) };
+}
+export function ownedClearanceFacts(d, call) {
+    const { mandated, requiresRealApproval, decisionReason, matchedAskRule, probeMandated, crossBoundaryMandated, authoredBy } = d;
+    return withFoldedOf({
         ...(crossBoundaryMandated === true ? { crossBoundaryMandated } : {}),
         ...(mandated === true ? { mandated } : {}),
-        ...(Array.isArray(foldedAskClasses) && foldedAskClasses.length > 0 ? { foldedAskClasses: [...foldedAskClasses] } : {}),
         ...(authoredBy === "deployment" ? { authoredBy } : {}),
         ...(requiresRealApproval === true ? { requiresRealApproval } : {}),
         ...(decisionReason !== undefined ? { decisionReason } : {}),
         ...(typeof matchedAskRule === "string" ? { matchedAskRule } : {}),
         ...(probeMandated === true ? { probeMandated } : {}),
-    };
+    }, attestationOf(d, call));
 }
 function originLadder(decision, facts) {
     if (facts.contentQuestion)
@@ -112,17 +122,22 @@ const PERSISTED_RULE_MANDATE_SET = new Set(PERSISTED_RULE_MANDATES);
 export function isPersistedRuleMandate(v) {
     return PERSISTED_RULE_MANDATE_SET.has(v);
 }
-const MANDATE_DISCLOSURE = {
-    probe_mandate: "the reversibility check declared this call structurally gated (the built-in shell check raises this for a read outside the directories allowed for this session) — it is cleared by confirming this call, never by a standing allow rule",
-    probe_unanswered: "the reversibility check did not answer for this call (it timed out or failed), so whether the call reads outside the directories allowed for this session is unknown — it is cleared by confirming this call, never by a standing allow rule",
+export const FINDING_ACCOUNT = Object.freeze({ reasonIs: "the account of the finding, carried on the ask as probeReason" });
+export const MANDATE_DISCLOSURE = {
+    probe_mandate: FINDING_ACCOUNT,
+    probe_unanswered: "the reversibility check did not answer for this call (it timed out or failed), so whether the call is reversible is unknown — it is cleared by confirming this call, never by a standing allow rule",
     operator_always: "this deployment mandates per-call confirmation for shell commands (shellGate: always)",
     tool_marks: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)",
     write_protection: "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule",
     target_unresolved: "where this write leads on disk could not be determined (a link on the way could not be examined, or the environment could not resolve the target), so whether it lands on a guarded path is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can",
     cross_boundary_taint: "this run executes on a device outside the deployment's trust boundary and the deployment is multi-tenant, so an org-side write — or, after an off-target read, a call bound for the device — is confirmed by the deployment's approver for this call: no standing allow rule and no automatic lane answers for it, and an allow the configuration gives (a blanket seat or a policy's answer) is refused",
 };
-export function mandateDisclosureOf(mandate) {
-    return mandate === undefined ? "an explicit ask rule matched this call (a person's or the deployment's ask-me-each-time outranks a standing allow rule)" : MANDATE_DISCLOSURE[mandate];
+export const ASK_RULE_DISCLOSURE = "an explicit ask rule matched this call (a person's or the deployment's ask-me-each-time outranks a standing allow rule)";
+export function mandateDisclosureOf(mandate, account) {
+    if (mandate === undefined)
+        return ASK_RULE_DISCLOSURE;
+    const row = MANDATE_DISCLOSURE[mandate];
+    return typeof row === "string" ? row : account;
 }
 export function persistedRuleMandateOf(marks) {
     if (marks.targetUnresolved === true)
@@ -271,9 +286,9 @@ export function screenAskClassMembers(askClass, classes) {
         return undefined;
     return { askClass, classes: Object.freeze(ordered) };
 }
-export function decisionAskClassesOf(d) {
+export function ownAskClassesOf(d, record) {
     const out = new Set();
-    for (const guard of d.guards ?? [])
+    for (const guard of record?.guards ?? [])
         out.add(guard);
     if (d.ruleUnreadable !== undefined)
         out.add("rule_unreadable");
@@ -297,7 +312,12 @@ export function decisionAskClassesOf(d) {
         out.add("policy_rra");
     if (out.size === 0 && d.mandated === true)
         out.add("operator_forced");
-    for (const c of d.foldedAskClasses ?? [])
+    return out;
+}
+export function decisionAskClassesOf(d, call) {
+    const record = attestationOf(d, call);
+    const out = ownAskClassesOf(d, record);
+    for (const c of record?.foldedClasses ?? [])
         out.add(c);
     return out;
 }
@@ -317,7 +337,8 @@ export function foldArbitrationRow(classes, readFace, askFace) {
     return { bypassImmune, classifierEligible, sandboxAdmission, ruleMayClear, hookAskFloor };
 }
 export function classifyAsk(d, facts) {
-    const classes = decisionAskClassesOf({ ...d, foldedAskClasses: undefined });
+    const record = attestationOf(d, facts.call);
+    const classes = ownAskClassesOf(d, record);
     classes.delete("policy_rra");
     if (facts.contentQuestion)
         classes.add("content_question");
@@ -354,7 +375,7 @@ export function classifyAsk(d, facts) {
         classes.add(c);
     if (d.requiresRealApproval === true && ![...classes].some((c) => RRA_EXPLAINERS.has(c)))
         classes.add("policy_rra");
-    for (const c of d.foldedAskClasses ?? [])
+    for (const c of record?.foldedClasses ?? [])
         classes.add(c);
     if (classes.size === 0 && d.mandated === true)
         classes.add("operator_forced");
@@ -366,7 +387,48 @@ export function classifyAsk(d, facts) {
 export function headlessDenialMessage(toolName, askMessage) {
     return `Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session (nobody can be asked to approve "${toolName}" in this run — headless auto-deny). The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative. What was requested: ${askMessage}`;
 }
+const REFUSED_CAPABILITY_GUIDANCE = "IMPORTANT: you may try to accomplish this with other tools that would naturally be used for it (for example `head` instead of `cat`), but do not work around this denial in malicious ways — for example, do not use your ability to run tests to run non-test actions; only work around it in reasonable ways that keep to the intent behind it. If you believe this capability is essential to complete the user's request, STOP and explain to the user what you were trying to do and why you need this permission, and let the user decide how to proceed.";
+export function dontAskRefusalMessage(input) {
+    const remedy = headlessApprovalRemedy({ mode: "dontAsk", classification: input.classification, coveredWrite: input.coveredWrite, ruleShape: input.ruleShape }).sentence;
+    return `Permission to use ${input.toolName} has been denied because this run is in the dontAsk permission mode (this call needed approval: ${input.classification.askClass}). ${REFUSED_CAPABILITY_GUIDANCE} To let a call like this run: ${remedy}.`;
+}
+export const APPROVAL_REMEDY_KINDS = Object.freeze(["approver", "permission_mode"]);
+const APPROVAL_REMEDY_KIND_SET = new Set(APPROVAL_REMEDY_KINDS);
+export function isApprovalRemedyKind(v) {
+    return APPROVAL_REMEDY_KIND_SET.has(v);
+}
+export function readApprovalRemedy(v) {
+    if (typeof v !== "object" || v === null || Array.isArray(v))
+        return undefined;
+    const keys = Object.keys(v);
+    const field = (k) => (keys.includes(k) ? v[k] : undefined);
+    const kind = field("kind");
+    if (!isApprovalRemedyKind(kind))
+        return undefined;
+    switch (kind) {
+        case "approver":
+            return keys.length === 1 ? { kind } : undefined;
+        case "permission_mode": {
+            const value = field("value");
+            const disclosedOn = field("disclosedOn");
+            return keys.length === 3 && value === "bypassPermissions" && disclosedOn === "gate.disposition.released" ? { kind, value, disclosedOn } : undefined;
+        }
+        default: {
+            const _exhaustive = kind;
+            return _exhaustive;
+        }
+    }
+}
+const APPROVER_REMEDY = Object.freeze({ kind: "approver" });
+const RELEASE_REMEDY = Object.freeze({ kind: "permission_mode", value: "bypassPermissions", disclosedOn: "gate.disposition.released" });
 export function headlessApprovalRemedy(input) {
+    const way = (sentence, release = false) => ({ sentence, remedies: Object.freeze(release ? [APPROVER_REMEDY, RELEASE_REMEDY] : [APPROVER_REMEDY]) });
+    if (input.mode === "dontAsk") {
+        const c = input.classification;
+        return way(c?.row.ruleMayClear === true
+            ? `an allow rule covering this call answers it under dontAsk — add one${input.ruleShape !== undefined ? ` in this tool's rule shape (\`${input.ruleShape}\`)` : ""} to the allow rules (a settings file's \`permissions.allow\`, or the request's or the deployment's allow list), or run under a mode with an approver`
+            : `no allow rule answers this ask${c !== undefined ? ` (${c.askClass})` : ""} — only a person can: run under a mode with an approver, or change the call`);
+    }
     const approver = input.approverSeat === "unavailable"
         ? "make a person reachable through the approver that is wired (it answered `unavailable` for this ask)"
         : input.approverSeat === "declared_none"
@@ -374,21 +436,21 @@ export function headlessApprovalRemedy(input) {
             : "wire an approver (`onAsk`) to put it to a person";
     const c = input.classification;
     if (input.mode === "acceptEdits" && input.unplacedOptions !== undefined && (c === undefined || (c.classes.size === 1 && c.classes.has("ordinary"))))
-        return `${fileCommandOptionsSentence(input.unplacedOptions.program)} Spell the ${input.unplacedOptions.program} without option words for the mode to answer it, or ${approver}`;
+        return way(`${fileCommandOptionsSentence(input.unplacedOptions.program)} Spell the ${input.unplacedOptions.program} without option words for the mode to answer it, or ${approver}`);
     if (c !== undefined && bypassImmuneOf(c))
-        return `no permission mode releases this ask (${c.askClass}): ${approver}, or change the call`;
+        return way(`no permission mode releases this ask (${c.askClass}): ${approver}, or change the call`);
     if (input.mode === "plan" && c?.classes.has("mode") === true)
-        return `the plan permission mode asks before every write and every call to a tool the engine does not define that is not read-only — leave plan mode (\`setPermissionMode\` to another mode, or approve the plan) to run it, or ${approver}`;
+        return way(`the plan permission mode asks before every write and every call to a tool the engine does not define that is not read-only — leave plan mode (\`setPermissionMode\` to another mode, or approve the plan) to run it, or ${approver}`);
     if (c !== undefined && c.classes.size === 1 && c.classes.has("unstated"))
-        return `no allow entry, stored allow rule or hook granted this tool, and it states no permission of its own — grant it with an allow entry for its name (\`RunnerDeps.allowedTools\` / \`TaskSpec.allowedTools\`), run with \`permissionMode: "bypassPermissions"\`, or ${approver}`;
+        return way(`no allow entry, stored allow rule or hook granted this tool, and it states no permission of its own — grant it with an allow entry for its name (\`RunnerDeps.allowedTools\` / \`TaskSpec.allowedTools\`), or ${approver}`, true);
     const onlyOrdinary = c === undefined || (c.classes.size === 1 && c.classes.has("ordinary"));
     if (input.coveredWrite && onlyOrdinary) {
         if (input.mode === "acceptEdits")
-            return `under \`permissionMode: "acceptEdits"\` the mode asks only for a write outside the working directories — if this target is outside them, add its directory to \`additionalDirectories\`; otherwise (or besides) ${approver}`;
+            return way(`under \`permissionMode: "acceptEdits"\` the mode asks only for a write outside the working directories — if this target is outside them, add its directory to \`additionalDirectories\`; otherwise (or besides) ${approver}`);
         if (input.mode === undefined || input.mode === "default" || input.mode === "auto")
-            return `the mode's write gate asks every write under \`default\`: \`permissionMode: "acceptEdits"\` lets writes inside the working directories (the task root and \`additionalDirectories\`) through without asking (a question another policy raised still stands), or ${approver}`;
+            return way(`the mode's write gate asks every write under \`default\`: \`permissionMode: "acceptEdits"\` lets writes inside the working directories (the task root and \`additionalDirectories\`) through without asking (a question another policy raised still stands), or ${approver}`);
     }
-    return `run with \`permissionMode: "bypassPermissions"\` to release this ask (the release is disclosed on the call), or ${approver}`;
+    return way(approver, true);
 }
 export function fileCommandOptionsSentence(program) {
     return `${program} with flags requires manual approval to ensure path safety: the mode cannot automatically validate ${program} commands that use flags, as some flags like --target-directory=PATH can bypass path validation.`;

package/dist/core/ask-question.d.ts

@@ -3,15 +3,23 @@ import type { ToolPolicy } from "./tool-policy.js";
 /** The reserved tool name for AskUserQuestion — shared so the durable-resume path (runtask) can recognize it
  *  as a content-ask whose SHOWN questions must not be rewritten by an operator `updatedInput` (design/80 D-F).
  *
- *  RESERVED means the whole engine keys content-ask semantics on this name: a policy `ask` on it is NEVER
- *  routed to a synchronous PERMISSION approver — on the main gate, the degraded fall-through, and the
- *  inherited ancestor wrappers alike (a permission frame's allow/deny cannot carry an ANSWER; CC parity:
- *  AskUserQuestion never raises a permission card). What it DOES reach, in this order, is the run's own
- *  content-ask channel: a LIVE question face answers it in-stream (the gate routes the question, not a
- *  verdict), and only with no live face — or with the durable gate forced — does it park durably or answer
- *  the typed refusal. Permission-GATING this tool stays unsupported by design; content-ROUTING it is the
- *  supported path. A caller-supplied tool reusing this name inherits the same routing; don't. */
+ *  The engine mounts its own question tool under this name, and the gate's content-ask semantics belong to THAT tool,
+ *  read off the call's face ({@link isEngineQuestionFace}), never off this name: a policy `ask` on it is NEVER routed to
+ *  a synchronous PERMISSION approver (a permission frame's allow/deny cannot carry an ANSWER; CC parity: AskUserQuestion
+ *  never raises a permission card). What it DOES reach, in this order, is the run's own content-ask channel: a LIVE
+ *  question face answers it in-stream (the gate routes the question, not a verdict), and only with no live face — or
+ *  with the durable gate forced — does it park durably or answer the typed refusal. Permission-GATING this tool stays
+ *  unsupported by design; content-ROUTING it is the supported path. A caller-supplied tool reusing this name is an
+ *  ordinary caller tool to the gate, its park decline, an ancestor's settlement and a person's edit of its parked call — asked, cleared by an allow rule,
+ *  released by a mode or refused like any other; the approval card a call carries is still chosen by this name. */
 export declare const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
+/** "Is this call the engine's own question tool?" — the catalog's one mount judge ({@link engineMountedAs}) for the
+ *  question definition: every station that treats a call as a content ask (the gate's content-question class and route,
+ *  the park's sync-first decline, the ancestor adapters' question float, {@link createDurableQuestionPolicy}) reads this answer. */
+export declare const isEngineQuestionFace: (face: {
+    readonly engineMounted?: true;
+    readonly contractId: string;
+} | undefined) => boolean;
 /**
  * AskUserQuestion (design/64 §5). A model-callable tool that lets the agent ask the USER a structured
  * multiple-choice question (which approach? which of these?) — distinct from the design/37 permission `ask`
@@ -278,6 +286,41 @@ export interface AskUserQuestionToolOptions {
      *  would let a LATER question inherit the claim that an operator approved it. */
     redeemedApprovalQuestionsHash?: string;
 }
+/**
+ * Durable ask (design/64 TC-5.4 — ABOVE CC, the disconnected-human case): instead of the headless
+ * "proceed with your best judgment" default, an AskUserQuestion **suspends the task durably** and the
+ * answer resumes it — built ENTIRELY from existing primitives, no new gate kind.
+ *
+ * **The park is the fallback, not the mandate.** An adjudicated question parks durably UNLESS this run
+ * has a live question face (see {@link isLiveQuestionFace}), in which case the engine routes the question
+ * to that face and the answer arrives in-stream — same turn, no checkpoint, no rebuild. The park is what
+ * happens when nobody is there: no live face, the face affirming nobody is reachable, or a control-plane
+ * `forceDurableGate` that mandates the durable breakpoint regardless. A deployment that wired a live face
+ * AND wants every question parked anyway states that with `forceDurableGate` (or by not wiring the face).
+ *
+ *  1. Run the task with `durableApproval` + a durable `CheckpointStore` (+ durable session/offload
+ *     stores) and `combinePolicies(createDurableQuestionPolicy(), yourPolicy)`. The policy adjudicates
+ *     the AskUserQuestion call `ask`; in durable mode that suspends BEFORE the tool executes —
+ *     `onQuestion` is never called on the suspend side, so mount the tool with
+ *     {@link QUESTION_AWAITS_RESUME} when no live human is connected.
+ *  2. The HITL surface reads the questions from `checkpoint.pendingAction.args.questions` and collects
+ *     the human's {@link QuestionAnswer} out-of-band (hours/days later, any replica).
+ *  3. `runner.resume(token, { gate: "policy_ask", decision: "allow", boundCallId:
+ *     checkpoint.pendingAction.toolCallId }, { ...taskConfig, onQuestion: async () => answer })` — the resume
+ *     re-mounts the tool with the answer closure; the pending call executes against it and the model
+ *     continues with "The user answered: …". `boundCallId` (design/80 D-1) must name the pending call the
+ *     human answered, or the resume is rejected (`checkpoint.invalid_outcome`).
+ *
+ * A deployment that wants the CC-style threshold form ("wait N minutes for a live human, then go
+ * durable") implements it inside its own policy: return `allow` while a human is connected (the live
+ * `onQuestion` answers synchronously) and `ask` when none is — the sync-vs-durable choice is exactly
+ * one policy decision. Composing this policy's answer is how such a policy keeps the one judge (an `ask`
+ * from here means the call is the engine's question tool).
+ *
+ * The call it asks about is the ENGINE's question tool, read off the request's face ({@link isEngineQuestionFace}):
+ * a caller's tool that took the name is not asked about here, and neither is a bare request (no face — a host
+ * driving a policy outside a Runner stamps the face itself, `toolCallFaceOf(roster, name)`).
+ */
 export declare function createDurableQuestionPolicy(): ToolPolicy;
 /**
  * Placeholder {@link OnQuestion} that mounts the AskUserQuestion tool on a worker with NO live human