@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/runner/prepare-inherited-gate.js

@@ -1,10 +1,11 @@
+import { principalNameOf } from "../principal-name.js";
 import { forkGovernanceDenial, resolveDelegationEntryCaps } from "../../agents/subagent.js";
 import { isLiveQuestionFace } from "../ask-question.js";
 import { parentSpecSeatOf } from "../parent-spec-seat.js";
 import { createPreToolUseConstraintPolicy } from "../hooks.js";
 import { chainJudges, sameInstallation } from "../mods/stations.js";
 import { childClampSeats, clampSourceOf } from "../child-clamp-seats.js";
-import { continuesLineage } from "../session-policy-store.js";
+import { rowFollowsFloor } from "./session-rule-policy.js";
 import { StubExecutionEnv } from "../stub-env.js";
 import { durableMandateSourceOf } from "../tool-policy.js";
 import { chainAnchorRecords } from "./child-tree.js";
@@ -16,7 +17,7 @@ import { frozenSkillGrants } from "../skill-grant.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 import { valveLeaves } from "../../agents/tool-filter.js";
 export function prepareInheritedGate(input) {
-    const { spec, deps, askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, pathRuleAnchors, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
+    const { spec, deps, askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, pathRuleAnchors, toolFaceSnapshot, mountsCallerTool, promptLean, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
     const liveInheritedGate = internals?.inheritedGate;
     const seedInheritedGate = resume?.seed.inheritedGate;
     const inheritedAncestorRules = (() => {
@@ -30,8 +31,8 @@ export function prepareInheritedGate(input) {
             return [...seedRules];
         const merged = seedRules.map((s) => {
             const live = liveRules.find((l) => l.sessionId === s.sessionId && l.principal === s.principal);
-            const sameLineage = live === undefined || continuesLineage(live, s);
-            return live !== undefined && sameLineage && live.rev >= s.rev ? live : s;
+            const follows = live !== undefined && rowFollowsFloor(live, s);
+            return follows && live.rev >= s.rev ? live : s;
         });
         const extras = liveRules.filter((l) => !seedRules.some((s) => s.sessionId === l.sessionId && s.principal === l.principal));
         return [...merged, ...extras];
@@ -221,7 +222,7 @@ export function prepareInheritedGate(input) {
             deferTools: toolFaceSnapshot.defer,
             alwaysLoadTools: toolFaceSnapshot.alwaysLoad,
             ...(toolFaceSnapshot.restoreGated !== undefined ? { restoreGatedTools: toolFaceSnapshot.restoreGated } : {}),
-            promptProfile,
+            ...(promptLean !== undefined ? { promptLean } : {}),
             ...(spec.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: spec.memoryPersistenceCapable } : {}),
             get memoryCaptureOptedOut() {
                 return input.memoryEngineSession()?.captureOptOut?.optedOut() ?? false;
@@ -238,6 +239,7 @@ export function prepareInheritedGate(input) {
             },
             getApiKeyAndHeaders: spec.getApiKeyAndHeaders,
             parentCwd: taskRootFinal,
+            ...(input.hostFloor !== undefined ? { hostFloor: input.hostFloor } : {}),
             ...(fileHistoryEnabled ? { fileHistoryLineage: { scope: historyScope, root: historyRoot, fs: historyFs } } : {}),
             reminderMark,
             reminderDisclosureCounts,
@@ -264,7 +266,7 @@ export function prepareInheritedGate(input) {
             ...(sessions.fork !== undefined
                 ? {
                     hostSessionFork: async () => {
-                        const forked = (await sessions.fork(sessionId, spec.principal ?? null)) ?? null;
+                        const forked = (await sessions.fork(sessionId, principalNameOf(spec.principal) ?? null)) ?? null;
                         if (forked === null)
                             return null;
                         return {

package/dist/core/runner/prepare-memory-engine-session.js

@@ -7,7 +7,7 @@ import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { fileArgPath } from "../tool-registry.js";
 import { RosterBuilder } from "../tool-roster.js";
-import { isNotStartedDelegationResult } from "../../agents/subagent.js";
+import { isNotStartedDelegationResult } from "../delegation-not-started.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareMemoryEngineSession(input) {
     const { memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mountedMcp, sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef } = input;

package/dist/core/runner/prepare-park-ask.js

@@ -2,22 +2,22 @@ import { callTargetReadingOf } from "../effective-path-target.js";
 import { approvalTargetsOf } from "../approval-object.js";
 import { uuidv7 } from "../../engine/session/uuid.js";
 import { Value } from "typebox/value";
-import { classifyQuestionOutcome, validateAskQuestions } from "../ask-question.js";
+import { classifyQuestionOutcome, isEngineQuestionFace, validateAskQuestions } from "../ask-question.js";
 import { hasBackgroundShell, sweepBackgroundShells, sweepRunBoundaryBackgroundShells } from "../background-shell.js";
 import { boundInputHashOf, exactBoundInputHashOf } from "../canonical-json.js";
-import { unencodableIn } from "../checkpoint-requirements.js";
-import { buildRiskDescriptor, debitLedger, encodeAtFidelity, mintCheckpointId, mintCheckpointToken, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
+import { buildRiskDescriptor, debitLedger, encodeAtFidelity, mintCheckpointId, mintCheckpointToken, resolveDeclaredFidelity, } from "../checkpoint-store.js";
 import { pauseOf } from "../pause-registry.js";
+import { samePlainValue } from "../same-plain-value.js";
 import { askCarryRowMembers } from "../hooks.js";
 import { askMandateMember, ownedClearanceFacts } from "../ask-origin.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { advertisedWritableRootsSeat, exemptRootsSeat, isLiveApproverSeat, licenseCovers, carriesBidiControls, describeThrown, ownArgs, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, bindableArgsOf, exemptRootsSeat, isLiveApproverSeat, licenseCovers, carriesBidiControls, describeThrown, ownArgs, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
 import { InMemoryToolResultStore, ScopedToolResultStore, isVolatileOffloadStore } from "../tool-result-store.js";
 import { raceAbort, raceSettlementAgainstSignal } from "./abort-race.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { DEFAULT_UNATTENDED_APPROVAL_TTL_MS, publishCommittedSuspend, sanitizedTtlMs } from "./park-commit.js";
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
-import { approvalCardMemberOf, callFaceSeat, engineCardOf, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
+import { approvalCardMemberOf, callFaceSeat, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
 import { seatOf } from "../tool-name-readings.js";
 class ParkRefusal extends Error {
     constructor(message, options) {
@@ -112,7 +112,7 @@ export function prepareParkAsk(input) {
     };
     const suspendAsk = parkLaneArmed && checkpointStore !== undefined
         ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, allowRuleShadowed, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated, carry) => {
-            const contentAsk = engineCardOf(req) === "question";
+            const contentAsk = isEngineQuestionFace(req.face);
             const syncFirstEligible = contentAsk ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
             if (syncFirstEligible &&
                 runtimeCaps?.forceDurableGate !== true &&
@@ -146,12 +146,12 @@ export function prepareParkAsk(input) {
                         `a durable approval row must hold an inert snapshot of exactly what a human approves and a resume executes`, { cause: captured.cause });
                 }
                 const parkedArgs = captured.value;
-                const unencodable = unencodableIn(parkedArgs, "pendingAction.args");
-                if (unencodable !== undefined)
-                    throw new ParkRefusal(`the arguments of "${req.toolName}" cannot be bound into the approval row's digest (${unencodable.kind} at ${unencodable.path}) — a durable approval row must hold an inert snapshot of exactly what a human approves and a resume executes`);
+                const bindable = bindableArgsOf(req.toolName, parkedArgs);
+                if (!bindable.ok)
+                    throw new ParkRefusal(bindable.refusal);
                 const parkedHash = exactBoundInputHashOf(parkedArgs);
                 if (parkedHash === undefined)
-                    throw new ParkRefusal(`the arguments of "${req.toolName}" hold a value no exact digest binds — no approval row can be bound to them`);
+                    throw new ParkRefusal(`the canonical form of the arguments of "${req.toolName}" cannot be built — no approval row can be bound to them`);
                 const projectionMovedArgs = backendFidelity !== "structured-clone" && !samePlainValue(parked.value, parkedArgs);
                 if (projectionMovedArgs && basePolicyForResumeEdit === undefined) {
                     throw new ParkRefusal(`the arguments of "${req.toolName}" change shape when stored by this checkpoint backend, and no policy is wired to re-adjudicate the stored shape ` +
@@ -179,7 +179,7 @@ export function prepareParkAsk(input) {
                         return undefined;
                     if (reprojectedRaced.tag === "threw")
                         throw reprojectedRaced.error;
-                    const reprojected = refuseOutOfContractDecision(reprojectedRaced.value);
+                    const reprojected = refuseOutOfContractDecision(reprojectedRaced.value, { call: req });
                     const filedAsHeld = ownArgs(parkedArgs);
                     const rewroteTheFiledValue = reprojected.updatedInput !== undefined && !(filedAsHeld.ok && samePlainValue(reprojected.updatedInput, filedAsHeld.value));
                     if (reprojected.action === "deny" || rewroteTheFiledValue) {
@@ -188,7 +188,7 @@ export function prepareParkAsk(input) {
                             `refusing to file a row whose executable form nothing adjudicated`);
                     }
                     if (reprojected.action === "ask")
-                        storedShapeFacts = ownedClearanceFacts(reprojected);
+                        storedShapeFacts = ownedClearanceFacts(reprojected, req);
                 }
                 const rowRealApproval = realApproval ?? (storedShapeFacts?.requiresRealApproval === true ? { origin: carry?.origin ?? wordlessDemand(req.toolName) } : undefined);
                 if (offloadStore && isVolatileOffloadStore(offloadStore) && !offloadStore.isEmpty()) {

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -6,8 +6,8 @@
  * inherited-unavailable marker channel, the grant record, the sandbox-admission mode's arming and its three
  * sideband maps, the source-identity and risk-axes factories, the two permission-rule lanes and the rule-offer
  * factory, the approved-edit re-check, the inherited-constraint wrappers (the same-instance adapter and the true
- * wrapper), the rewrite-emitter index and the instrumented chain, the integrity guards, the fold, and the final-form
- * re-check that is the effective policy. The advised-names dedupe pair only this section reads moved with it.
+ * wrapper), the instrumented chain, the integrity guards, the fold, and the same-instance arbitration refresh that is the
+ * effective policy. The advised-names dedupe pair only this section reads moved with it.
  * The interface is the dependency list the segment had implicitly.
  *
  * ASYNC PHASE: the stretch awaits the session-policy store (the task's own rules and each ancestor's live re-read)
@@ -42,7 +42,10 @@ import { type ModeGateSeats, type PermissionModeController } from "../mode-polic
 import { type InheritedAskGrant } from "./inherited-ask-grants.js";
 import { createRuleOffersOf, type PermissionRuleLanes } from "./permission-rule-lanes.js";
 import type { ToolCallLike } from "../tool-registry.js";
+import { type HostFloor } from "../host-floor.js";
 export interface PreparePolicyChainInput {
+    /** borrowed-readonly — the deployment's host floor as the config doors compiled it: the leading narrowing layer when declared. */
+    hostFloor: HostFloor | undefined;
     /** borrowed-readonly — the REBOUND spec. Read: `sessionId` / `principal` (the session-rule read and the lanes' identity),
      *  `durableApproval` / `checkpointStore` (the mandate-park facility test and the sandbox arming's park prerequisites), `taskId` (the late-ask observer's detail),
      *  `tools` (the names the caller mounted, for the name audit). Never mutated. */
@@ -177,7 +180,7 @@ export interface PreparePolicyChainInput {
     /** borrowed-readonly — the injectable wall-clock (the inherited arms' human-wait timing). */
     now: () => number;
     /** borrowed-mutable — the own session-rules snapshot seat (the inherited-gate phase mints it; `inheritedGateForChildren`
-     *  reads it late). Writer: THIS phase, once, when the store returns this task's own rules. */
+     *  reads it late). Writer: THIS phase — the own layer's seed at prepare, then each row the layer comes to enforce. */
     ownSessionRulesRef: {
         current?: {
             sessionId: string;
@@ -202,7 +205,7 @@ export interface PreparePolicyChainResult {
     };
     /** owned — the caller-facing policy layers (the wiring manifest reads their COUNT). */
     policyLayers: ToolPolicy[];
-    /** owned — THE effective policy the gate station adjudicates with (the fold plus its final-form re-check), or undefined. */
+    /** owned — THE effective policy the gate station adjudicates with (the fold, plus the same-instance arbitration refresh), or undefined. */
     effectivePolicy: ToolPolicy | undefined;
     /** borrowed-mutable — the inherited-unavailable marker channel. Writers: the inherited arms here (mark); the gate station
      *  (the lifecycle-end sweep) and the park lane's consumers (delete on consumption). */

package/dist/core/runner/prepare-policy-chain.js

@@ -1,10 +1,11 @@
 import { argsAsTheToolReads, withArgsReading } from "../effective-path-target.js";
+import { outletAsk, readRejudge, rewriteChasedSentence, sameBytes } from "../rewrite-rejudge.js";
 import { policyAskClassOf } from "../ask-class.js";
-import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
+import { ASK_USER_QUESTION_TOOL_NAME, isEngineQuestionFace } from "../ask-question.js";
 import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { chainJudges, inheritedToolChecks, screeningInstallationsOf, standsInFor } from "../mods/stations.js";
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
+import { isCoveringRuleName, ruleNameCovers } from "../namespaced-rule-name.js";
 import { isIsolated } from "../remote-env.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 import { earlierGrammarNotice } from "../session-policy-store.js";
@@ -29,8 +30,9 @@ import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf
 import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-policy.js";
 import { policyThrowLine, reportPolicyThrow } from "./policy-throw.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
+import { hostFloorPolicy } from "../host-floor.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, pathRuleAnchors, headLeads, tools, harnessTools, selector, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, modBus, ownModChain, autoModeDecider, readFace, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, pathRuleAnchors, headLeads, tools, harnessTools, selector, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, modBus, ownModChain, autoModeDecider, readFace, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef, hostFloor } = input;
     const ancestorArbitrations = new Map();
     const arbitrateInherited = (ask, toolCallId, judged) => {
         const verdict = arbitrateByMode(permissionMode.current, judged.classification, { origin: judged.origin, ...askMandateMember(ancestorFacts(judged.ask.action === "ask" ? judged.ask : undefined)) });
@@ -55,7 +57,7 @@ export async function preparePolicyChain(input) {
             for (const g of nameGroups) {
                 for (const [kind, list] of [["deny", g.deny], ["ask", g.ask], ["allow", g.allow]]) {
                     for (const n of list ?? []) {
-                        const verdict = judgeRuleToolName(n, known);
+                        const verdict = judgeRuleToolName(n, known, kind);
                         const twin = verdict.kind === "current" && !inherited ? nearMissSpellingOf(n, rootFacing) : undefined;
                         const stale = verdict.kind !== "current" ? verdict : twin !== undefined ? { kind: "case_twin", twin, carrier: known.has(twin) || callerNames.has(twin) ? "run" : pool.names.has(twin) ? "pool" : "catalog" } : undefined;
                         if (stale !== undefined) {
@@ -85,7 +87,7 @@ export async function preparePolicyChain(input) {
                         }
                         if (known.has(n))
                             continue;
-                        if (isNamespacedCoveringRuleName(n) && [...known].some((k) => namespacedRuleNameCovers(n, k)))
+                        if (isCoveringRuleName(n, kind) && [...known].some((k) => ruleNameCovers(n, k)))
                             continue;
                         unmatched.add(`"${n}" (${kind})`);
                     }
@@ -102,7 +104,7 @@ export async function preparePolicyChain(input) {
                 }
                 advisedPolicyNames.set(deps, advised);
                 try {
-                    const e = new Error(`toolPolicy name audit: ${[...unmatched].join(", ")} match(es) no tool mounted this run (primary or alias) — the rule cannot fire here. Often a typo or a self-report/wire name skew (e.g. TodoWrite vs the mounted TaskCreate family; "*" has no wildcard meaning in a name-keyed policy). Advisory only: enforcement is unchanged, and a name can be legitimate for another scenario or a per-spawn tool.`);
+                    const e = new Error(`toolPolicy name audit: ${[...unmatched].join(", ")} match(es) no tool mounted this run (primary or alias) — the rule cannot fire here. Often a typo or a self-report/wire name skew (e.g. TodoWrite vs the mounted TaskCreate family; a "*" on a deny or ask list reaches every name its pattern matches). Advisory only: enforcement is unchanged, and a name can be legitimate for another scenario or a per-spawn tool.`);
                     e.code = "config.toolpolicy.unmatched_names";
                     deps.onError?.(e, { phase: "config", sessionId });
                 }
@@ -138,8 +140,7 @@ export async function preparePolicyChain(input) {
             };
         };
         sessionRulePolicy = createSessionRulePolicy({ seed, read: createLiveSessionRules(store, { ...sessionRuleKey, seed }, { onUnreadable: announceSessionRulesUnreadable, onEnforced: publishOwnRules }) }, { env: executionEnv, rootPath: taskRootFinal, toolEffects, anchors: pathRuleAnchors.leg, onEarlierGrammar: announceEarlierGrammar(sessionRuleKey.sessionId) });
-        if (rules)
-            publishOwnRules(rules);
+        publishOwnRules(seed);
     }
     const ancestorRulePolicies = [];
     for (const [position, snap] of (inheritedAncestorRules ?? []).entries()) {
@@ -153,19 +154,14 @@ export async function preparePolicyChain(input) {
                 rules: row,
             });
         };
-        ancestorRulePolicies.push(createSessionRulePolicy({
-            seed,
-            ...(deps.sessionPolicyStore
-                ? { read: createLiveSessionRules(deps.sessionPolicyStore, { sessionId: snap.sessionId, ...(snap.principal !== undefined ? { principal: snap.principal } : {}), seed }, { onUnreadable: announceSessionRulesUnreadable, onEnforced: publishAncestorRules }) }
-                : {}),
-        }, { env: executionEnv, rootPath: taskRootFinal, toolEffects, anchors: pathRuleAnchors.leg, onEarlierGrammar: announceEarlierGrammar(snap.sessionId) }));
+        ancestorRulePolicies.push(createSessionRulePolicy({ seed, read: createLiveSessionRules(deps.sessionPolicyStore, { sessionId: snap.sessionId, ...(snap.principal !== undefined ? { principal: snap.principal } : {}), seed }, { onUnreadable: announceSessionRulesUnreadable, onEnforced: publishAncestorRules }) }, { env: executionEnv, rootPath: taskRootFinal, toolEffects, anchors: pathRuleAnchors.leg, onEarlierGrammar: announceEarlierGrammar(snap.sessionId) }));
     }
     const frozenConstraintLayers = (seedInheritedGate?.constraintChain ?? [])
         .filter((e) => !("opaque" in e))
         .map((entry) => ({
         check: (creq) => checkToolPolicyProjection(entry, creq) ?? { action: "allow" },
     }));
-    const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, ...frozenConstraintLayers].filter((p) => p !== undefined);
+    const narrowingLayers = [hostFloor !== undefined ? hostFloorPolicy(hostFloor) : undefined, sessionRulePolicy, ...ancestorRulePolicies, ...frozenConstraintLayers].filter((p) => p !== undefined);
     auditPolicyNames(sessionRulePolicy);
     for (const layer of ancestorRulePolicies)
         auditPolicyNames(layer, true);
@@ -175,6 +171,16 @@ export async function preparePolicyChain(input) {
     const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
     const sharedFirstDecision = new Map();
     const SHARED_FIRST_DECISION_CAP = 256;
+    const staleArbitrations = new Map();
+    const noteArbitration = (toolCallId, arbitrate, stale) => {
+        const rest = (staleArbitrations.get(toolCallId) ?? []).filter((a) => a !== arbitrate);
+        if (stale)
+            rest.push(arbitrate);
+        if (rest.length > 0)
+            staleArbitrations.set(toolCallId, rest);
+        else
+            staleArbitrations.delete(toolCallId);
+    };
     const inheritedUnavailableAsks = new Set();
     const INHERITED_UNAVAILABLE_CAP = 256;
     const markInheritedUnavailable = (toolCallId) => {
@@ -235,7 +241,7 @@ export async function preparePolicyChain(input) {
         list.push({ cls, layer });
         foldAskClasses.set(toolCallId, list);
     };
-    const isDelegatedQuestion = (creq) => wireOf("inherited.questionFloat", creq) === ASK_USER_QUESTION_TOOL_NAME;
+    const isDelegatedQuestion = (creq) => isEngineQuestionFace(creq.face);
     const sandboxBoundaryCapable = (call) => heldBy("gate.sandboxBoundary.egress", egressTools, call) || !envHandToolNames.has(wireOf("gate.sandboxBoundary.hand", call));
     const emitSandboxAdmitted = (info) => {
         emitTrace(deps.tracer, () => ({
@@ -261,8 +267,8 @@ export async function preparePolicyChain(input) {
     };
     const callerPolicyLayer = policy !== undefined && sameInstanceAncestorCount > 0
         ? wrapToolPolicy(policy, async (creq, csignal) => {
-            const decision = refuseOutOfContractDecision(await policy.check(creq, csignal ?? abortController.signal));
-            sharedFirstDecision.set(creq.toolCallId, decision);
+            const decision = refuseOutOfContractDecision(await policy.check(creq, csignal ?? abortController.signal), { call: creq });
+            sharedFirstDecision.set(creq.toolCallId, { decision, judged: creq.args });
             if (sharedFirstDecision.size > SHARED_FIRST_DECISION_CAP) {
                 const oldest = sharedFirstDecision.keys().next().value;
                 if (oldest !== undefined)
@@ -303,7 +309,7 @@ export async function preparePolicyChain(input) {
         const seat = seatMarksOf(call);
         const face = readFace();
         return {
-            ...INHERITED_STATION_FACTS,
+            ...INHERITED_STATION_FACTS, call: { toolCallId: call.toolCallId, toolName: call.toolName },
             mandateMarks: { egress: seat.egress, shellGated: false, ...(seat.tier === "always" && !seat.shellGated ? { irreversibility: "always" } : {}) },
             ...(seat.sources.size > 0 ? { toolMarkSources: seat.sources } : {}),
             ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}),
@@ -358,7 +364,7 @@ export async function preparePolicyChain(input) {
             }
             let re;
             try {
-                re = refuseOutOfContractDecision(await pol.check(await withArgsReading(creq, editArgs, csignal ?? abortController.signal), csignal ?? abortController.signal));
+                re = refuseOutOfContractDecision(await pol.check(await withArgsReading(creq, editArgs, csignal ?? abortController.signal), csignal ?? abortController.signal), { call: creq });
             }
             catch (err) {
                 reportPolicyThrow(notifyOwnHookCrash, "an inherited parent policy's re-check of the approved edit", creq, err, csignal ?? abortController.signal);
@@ -369,13 +375,16 @@ export async function preparePolicyChain(input) {
             }
             if (re.action === "deny")
                 return vetoed(re);
-            if (re.action === "allow") {
-                const stated = re.updatedInput === undefined ? "mode" : re.decisionReason;
-                return onApproval(withAttestation({ action: "allow", updatedInput: re.updatedInput !== undefined ? re.updatedInput : editArgs, ...(stated !== undefined ? { decisionReason: stated } : {}) }, re.attestation));
+            const read = readRejudge(creq, editArgs, re);
+            if (read.kind === "rewritten") {
+                editArgs = read.form;
+                const { updatedInput: _form, ...verdict } = re;
+                re = outletAsk(verdict, creq.toolName, editArgs);
             }
-            if (re.updatedInput !== undefined)
-                editArgs = argsAsTheToolReads(creq, re.updatedInput);
-            const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), route: frozenApproverRoute(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
+            else if (re.action === "allow") {
+                return onApproval(withAttestation({ action: "allow", updatedInput: editArgs, decisionReason: "mode" }, re.attestation));
+            }
+            const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: read.kind === "rewritten" ? undefined : ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), route: frozenApproverRoute(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
             if (judged.kind === "allow") {
                 return onApproval(judged.result);
             }
@@ -384,7 +393,10 @@ export async function preparePolicyChain(input) {
             const { ask: editAsk } = judged;
             re = editAsk;
             const editArbitrated = arbitrateInherited(re, creq.toolCallId, judged);
-            if (editArbitrated !== undefined) {
+            const outletReleased = read.kind === "rewritten" && editArbitrated?.action === "allow";
+            if (outletReleased)
+                ancestorArbitrations.delete(creq.toolCallId);
+            if (editArbitrated !== undefined && !outletReleased) {
                 return onApproval(editArbitrated.action === "allow" ? { action: "allow", updatedInput: editArgs, decisionReason: "mode" } : editArbitrated);
             }
             const { resolved: rr, judged: settled } = await resolveInheritedAsk(judged, (j) => resolveAsk({
@@ -475,8 +487,14 @@ export async function preparePolicyChain(input) {
         ? { check: () => ({ action: "allow" }) }
         : policy !== undefined && pc.policy === policy
             ? {
-                check: async (creq, csignal) => {
-                    const first = sharedFirstDecision.get(creq.toolCallId);
+                check: async function arbitrate(creq, csignal) {
+                    const recorded = sharedFirstDecision.get(creq.toolCallId);
+                    const first = recorded?.decision;
+                    const stale = recorded !== undefined && !sameBytes(creq, recorded.decision.updatedInput !== undefined ? recorded.decision.updatedInput : recorded.judged, creq.args);
+                    if (recorded !== undefined)
+                        noteArbitration(creq.toolCallId, arbitrate, stale);
+                    if (stale)
+                        return { action: "allow" };
                     if (first === undefined) {
                         return {
                             action: "deny",
@@ -552,7 +570,7 @@ export async function preparePolicyChain(input) {
             : wrapToolPolicy(pc.policy, async (creq, csignal) => {
                 let decision;
                 try {
-                    decision = refuseOutOfContractDecision(await pc.policy.check(creq, csignal ?? abortController.signal));
+                    decision = refuseOutOfContractDecision(await pc.policy.check(creq, csignal ?? abortController.signal), { call: creq });
                 }
                 catch (err) {
                     reportPolicyThrow(notifyOwnHookCrash, "an inherited parent policy", creq, err, csignal ?? abortController.signal);
@@ -581,88 +599,57 @@ export async function preparePolicyChain(input) {
         const settled = await settleInstallationAsk(pc, ask, creq, csignal);
         return settled.kind === "settled" ? settled.result : settled.resolved;
     });
-    const rewriteCapableLayers = policy !== undefined || parentConstraintWrappers.length > 0;
-    const rewriteEmitterIndex = new Map();
     const rewriteCapableChain = [
         ...(callerPolicyLayer !== undefined ? [callerPolicyLayer] : []),
         ...parentConstraintWrappers,
     ];
     const callerSlotOffset = callerPolicyLayer !== undefined ? 1 : 0;
-    const sameInstanceAdapterIndices = new Set();
-    (inheritedParentConstraints ?? []).forEach((pc, j) => {
-        if (policy !== undefined && pc.policy === policy)
-            sameInstanceAdapterIndices.add(j + callerSlotOffset);
-    });
     const instrumentedChain = rewriteCapableChain.map((layer, idx) => wrapToolPolicy(layer, async (creq, csignal) => {
-        const d = refuseOutOfContractDecision(await layer.check(creq, csignal));
-        if (d.updatedInput !== undefined)
-            rewriteEmitterIndex.set(creq.toolCallId, idx);
+        const d = refuseOutOfContractDecision(await layer.check(creq, csignal), { call: creq });
         if (d.action === "ask") {
             recordFoldAskClass(creq.toolCallId, idx < callerSlotOffset ? policyAskClassOf(policy) : "mandate", idx < callerSlotOffset ? "caller_policy" : "ancestor_constraint");
         }
         return d;
     }));
     const modeGateLayer = createModeGatePolicy(permissionMode, { env: executionEnv, rootPath: taskRootFinal, acceptDirs: [taskRootFinal, ...additionalRootsCanonical], roster: toolRosterDeltas, readOnlyDeclared: (name) => mountedToolDeclaresReadOnly(tools, name), ...(scratchpadDir !== undefined ? { exemptDirs: [scratchpadDir] } : {}) });
-    const policyLayers = [
-        ...narrowingLayers,
-        ...instrumentedChain,
-        ...(rewriteCapableLayers ? narrowingLayers : []),
-    ];
+    const policyLayers = [...narrowingLayers, ...instrumentedChain, ...(rewriteCapableChain.length > 0 ? narrowingLayers : [])];
     const integrityGuardLayers = [createTranscriptIntegrityPolicy(), createUnverifiableDeletePolicy({ removalSeat: { env: executionEnv, additionalRoots: () => additionalRootsCanonical } })];
-    const guardedPolicyLayers = rewriteCapableLayers
-        ? [...integrityGuardLayers, ...policyLayers, modeGateLayer, ...integrityGuardLayers]
-        : [...integrityGuardLayers, ...policyLayers, modeGateLayer];
+    const guardedPolicyLayers = [...integrityGuardLayers, ...policyLayers, modeGateLayer];
     const foldedPolicy = guardedPolicyLayers.length === 1 ? guardedPolicyLayers[0] : combinePolicies(...guardedPolicyLayers);
-    const effectivePolicy = foldedPolicy !== undefined && rewriteCapableLayers
+    const effectivePolicy = foldedPolicy !== undefined && sameInstanceAncestorCount > 0
         ? wrapToolPolicy(foldedPolicy, async (req, signal) => {
             let decision;
+            let stale;
             try {
                 decision = await foldedPolicy.check(req, signal);
             }
-            catch (err) {
-                rewriteEmitterIndex.delete(req.toolCallId);
-                throw err;
+            finally {
+                stale = staleArbitrations.get(req.toolCallId) ?? [];
+                staleArbitrations.delete(req.toolCallId);
             }
-            const emitterIdx = rewriteEmitterIndex.get(req.toolCallId);
-            rewriteEmitterIndex.delete(req.toolCallId);
-            if (decision.action === "deny" || decision.updatedInput === undefined)
+            if (decision.action === "deny" || stale.length === 0)
                 return decision;
-            const recheckPrefix = rewriteCapableChain.slice(0, emitterIdx ?? rewriteCapableChain.length);
-            const postEmitterSameInstanceAdapters = [];
-            if (emitterIdx !== undefined && emitterIdx > 0) {
-                for (let i = emitterIdx + 1; i < rewriteCapableChain.length; i++) {
-                    if (sameInstanceAdapterIndices.has(i))
-                        postEmitterSameInstanceAdapters.push(rewriteCapableChain[i]);
-                }
-            }
-            const recheckLayers = [...recheckPrefix, ...postEmitterSameInstanceAdapters];
-            const finalReq = await withArgsReading(req, decision.updatedInput, signal);
+            const finalReq = decision.updatedInput !== undefined ? await withArgsReading(req, decision.updatedInput, signal) : req;
+            const carried = decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {};
             let asked;
             let revalidated;
             try {
-                for (const layer of recheckLayers) {
-                    const d = refuseOutOfContractDecision(await layer.check(finalReq, signal));
-                    if (d.action === "deny") {
-                        return withAttestation({ ...d, updatedInput: decision.updatedInput }, mergeAttestation(req, attestationOf(decision, req), attestationOf(d, req), "answer"));
-                    }
-                    if (d.updatedInput !== undefined) {
-                        return {
-                            action: "deny",
-                            message: "policy required a rewrite during final-form re-check — the arguments that would execute were not accepted as-is (fail-closed; rewrite chains are not iterated to a fixpoint)",
-                            updatedInput: decision.updatedInput,
-                        };
-                    }
+                for (const arbitrate of stale) {
+                    const d = refuseOutOfContractDecision(await arbitrate(finalReq, signal), { call: finalReq });
+                    if (d.action === "deny")
+                        return withAttestation({ ...d, ...carried }, mergeAttestation(req, attestationOf(decision, req), attestationOf(d, req), "answer"));
+                    if (readRejudge(finalReq, finalReq.args, d).kind === "rewritten")
+                        return { action: "deny", message: rewriteChasedSentence(req.toolName), ...carried };
                     if (d.action === "ask" && asked === undefined)
                         asked = d;
                     revalidated = mergeAttestation(req, revalidated, d.attestation);
                 }
             }
             finally {
-                rewriteEmitterIndex.delete(req.toolCallId);
-            }
-            if (asked !== undefined && decision.action === "allow") {
-                return { ...asked, updatedInput: decision.updatedInput };
+                staleArbitrations.delete(req.toolCallId);
             }
+            if (asked !== undefined && decision.action === "allow")
+                return { ...asked, ...carried };
             if (decision.action === "allow")
                 return withAttestation(decision, mergeAttestation(req, attestationOf(decision, req), revalidated));
             return decision;

package/dist/core/runner/prepare-project-context.d.ts

@@ -13,8 +13,9 @@ export interface PrepareProjectContextInput {
     deps: Pick<RunnerDeps, "loadProjectMemory" | "onError" | "sharedMemoryStores" | "onNotice" | "allowedTools">;
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `sessionId` (phase derivation + the
      *  continuation projections), `skills` (the roster), `userInvokedSkills` (the person's invoked skills — their
-     *  rows are written here), `principal` (the shared-memory tools' trusted identity). Never mutated. */
-    spec: Pick<TaskSpec, "sessionId" | "skills" | "userInvokedSkills" | "principal" | "excludeAllTools">;
+     *  rows are written here), `principal` (the shared-memory tools' trusted identity), `projectMemory` (the request's
+     *  off switch for the seam — the config door's one reading). Never mutated. */
+    spec: Pick<TaskSpec, "sessionId" | "skills" | "userInvokedSkills" | "principal" | "excludeAllTools" | "projectMemory">;
     /** borrowed-readonly — trusted internals: `agentName` (seam ctx), `inheritedSkillGrants` (the parent's captured
      *  skill grant rows, seeded as `inherited`), `inheritedAllowedTools` (the parent's request entries, seeded as this leg's
      *  own). `undefined` on a standalone prepare. */
@@ -95,6 +96,8 @@ export interface PrepareProjectContextResult {
         path: string;
         contentHash: string | null;
     }> | undefined;
+    /** owned — `"on"` iff this phase called the deployment's seam, `"disabled"` the request turned a wired one off, `"absent"` none is wired. */
+    projectMemoryFact: NonNullable<import("../wiring-manifest.js").WiringManifest["projectMemory"]>;
     /** owned — the RAW snapshot text (pre-compose) for the compaction lanes' instruction-file seat
      *  (`Prepared.projectInstructionContent`). */
     projectInstructionContent: string | undefined;

package/dist/core/runner/prepare-project-context.js

@@ -22,7 +22,10 @@ export async function prepareProjectContext(input) {
     let memoryBlock = memoryBlockFromEngine;
     let instructionSources;
     let projectInstructionContent;
-    if (deps.loadProjectMemory) {
+    const seam = deps.loadProjectMemory;
+    const loadProjectMemory = seam && spec.projectMemory === undefined ? seam : undefined;
+    const projectMemoryFact = loadProjectMemory ? "on" : seam ? "disabled" : "absent";
+    if (loadProjectMemory) {
         let projectMemoryPhase = spec.sessionId ? "resume" : "fresh";
         if (spec.sessionId) {
             try {
@@ -47,7 +50,7 @@ export async function prepareProjectContext(input) {
         }
         let loaded = null;
         try {
-            loaded = await Promise.resolve(deps.loadProjectMemory({
+            loaded = await Promise.resolve(loadProjectMemory.call(deps, {
                 cwd: taskRootFinal,
                 handsEnabled,
                 isSubagent: delegation.isNonForkChild,
@@ -158,5 +161,5 @@ export async function prepareProjectContext(input) {
                 ?
                     { entries: [], seedAnnounced: true, budget: skillListingBudget }
                 : undefined;
-    return { memoryBlock, instructionSources, projectInstructionContent, skillSpecs, skillSeatOf, skillsListing, sharedMemoryPairMounted, memoryEnginePairMounted };
+    return { memoryBlock, instructionSources, projectMemoryFact, projectInstructionContent, skillSpecs, skillSeatOf, skillsListing, sharedMemoryPairMounted, memoryEnginePairMounted };
 }

package/dist/core/runner/prepare-prompt-assembly.d.ts

@@ -3,7 +3,7 @@ import type { Model } from "../../internal/llm.js";
 import { assemblePrompt, type AssembledPrompt } from "../../prompt-assembly/assemble.js";
 import { type CenterAdoption } from "../../prompt-assembly/artifact.js";
 import { type RunPromptIdentity } from "../../prompt-assembly/epoch.js";
-import type { HostForm, HostRole } from "../../prompt-assembly/catalog/schema.js";
+import type { HostForm, HostRole, PromptTraitName } from "../../prompt-assembly/catalog/schema.js";
 import type { SourcedOverlay } from "../../prompt-assembly/overlay.js";
 import { type EnvironmentFacts } from "../../prompts/default.js";
 import { type LegModBus } from "../mods/stations.js";
@@ -47,15 +47,13 @@ export interface PreparePromptAssemblyInput {
     memoryBlock: string | undefined;
     /** borrowed-readonly — the environment facts; `date` is the assembly's date, the block builder re-renders on a date change. */
     envFacts: EnvironmentFacts;
-    /** borrowed-readonly — the resolved prompt profile (a runtime fact of the assembly). */
-    promptProfile: "simple" | "classic";
-    /** borrowed-readonly — the fable mitigations switch (a runtime fact of the assembly). */
-    fableMitigations: boolean;
+    /** borrowed-readonly — the run's effective prompt traits (a selector value of the assembly). */
+    promptTraits: ReadonlySet<PromptTraitName>;
     /** borrowed-readonly — the run's ONE tool roster, read only: the assembly receives DETACHED copies, the audit and the
      *  manifest read it in place. Never mutated here. */
     tools: readonly AgentTool[];
-    /** borrowed-readonly — the task model: `promptGuidance` (the model-guidance section) and `id` (the compose event's `model`). */
-    model: Pick<Model, "id" | "promptGuidance">;
+    /** borrowed-readonly — the task model: `id` (the compose event's `model`). */
+    model: Pick<Model, "id">;
     /** borrowed-readonly — the acquired session id (every operator line's attribution). */
     sessionId: string;
     /** borrowed-readonly — the once-per-session ledger's operator sink (the collision audit's two lines). */