@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/runner/session-rule-policy.js

@@ -1,5 +1,5 @@
 import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from "../../tools/fs/safety.js";
-import { SESSION_RULES_GRAMMAR, compileSessionRuleBucket, continuesLineage, earlierGrammarAnnouncer, earlierGrammarRefusalClause, readSessionRulesShape, unreadableDenyEntries } from "../session-policy-store.js";
+import { SESSION_RULES_GRAMMAR, compileSessionRuleBucket, continuesLineage, earlierGrammarAnnouncer, earlierGrammarEntries, earlierGrammarRefusalClause, readSessionRulesShape, unreadableDenyEntries } from "../session-policy-store.js";
 import { compiledEntryName, judgeAllowEntries, uncoveredCommandSegment } from "../allow-entry.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { callTargetReadingOf, pathTargetBaseOf, readCallTarget } from "../effective-path-target.js";
@@ -32,8 +32,10 @@ const deny = (tool, detail) => ({
     message: ruleDenialSentence({ source: "session", tool, ...(detail !== undefined ? { detail } : {}) }),
     decisionReason: "rule",
 });
-const HANDOFF_BOUND = 256;
 const ANNOUNCED_REASONS_BOUND = 8;
+export function rowFollowsFloor(row, floor) {
+    return floor.rev === 0 || continuesLineage(row, floor);
+}
 export function createLiveSessionRules(store, floor, hooks) {
     const announced = new Set();
     const announce = (reason) => {
@@ -46,6 +48,8 @@ export function createLiveSessionRules(store, floor, hooks) {
     let servedRow = false;
     let vanished = false;
     const read = async (signal) => {
+        if (store === undefined)
+            return (announce(`this leg's runner has no session-policy store to re-read the rules of session ${JSON.stringify(floor.sessionId)} from`), enforced);
         let live;
         try {
             live = await withGateTimeout(store.getRules(floor.sessionId, floor.principal), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "sessionRulesRead");
@@ -64,15 +68,13 @@ export function createLiveSessionRules(store, floor, hooks) {
             }
             return enforced;
         }
-        if (enforced.rev > 0) {
-            if (!continuesLineage(live, enforced)) {
-                announce(`session ${JSON.stringify(floor.sessionId)} has a rules row of a new lineage (generation ${live.gen}, rev ${live.rev}), which does not continue the row this leg enforces (generation ${enforced.gen})`);
-                return enforced;
-            }
-            if (vanished && live.gen === undefined) {
-                announce(`session ${JSON.stringify(floor.sessionId)} has a new rules row at rev ${live.rev} after the row this leg enforced was deleted, and its backend carries no lineage to continue it by`);
-                return enforced;
-            }
+        if (!rowFollowsFloor(live, enforced)) {
+            announce(`session ${JSON.stringify(floor.sessionId)} has a rules row of a new lineage (generation ${live.gen}, rev ${live.rev}), which does not continue the row this leg enforces (generation ${enforced.gen})`);
+            return enforced;
+        }
+        if (vanished && live.gen === undefined) {
+            announce(`session ${JSON.stringify(floor.sessionId)} has a new rules row at rev ${live.rev} after the row this leg enforced was deleted, and its backend carries no lineage to continue it by`);
+            return enforced;
         }
         if (live.rev <= enforced.rev) {
             if (live.rev < enforced.rev) {
@@ -85,24 +87,7 @@ export function createLiveSessionRules(store, floor, hooks) {
         hooks?.onEnforced?.(live);
         return live;
     };
-    const handed = new Map();
-    return async (toolCallId, signal) => {
-        const handedRead = handed.get(toolCallId);
-        if (handedRead !== undefined) {
-            handed.delete(toolCallId);
-            const claimed = await handedRead;
-            if (continuesLineage(claimed, enforced) && claimed.rev >= enforced.rev)
-                return claimed;
-        }
-        const p = read(signal);
-        handed.set(toolCallId, p);
-        if (handed.size > HANDOFF_BOUND) {
-            const oldest = handed.keys().next().value;
-            if (oldest !== undefined)
-                handed.delete(oldest);
-        }
-        return p;
-    };
+    return (_toolCallId, signal) => read(signal);
 }
 function compileSessionRules(rules) {
     const shaped = readSessionRulesShape(rules);
@@ -110,7 +95,7 @@ function compileSessionRules(rules) {
     if ("fault" in shaped) {
         const { field, got } = shaped.fault;
         const what = got === "not a rule bucket" ? "a key that is no rule bucket" : field === "" ? `a value that is ${got}, not an object of rule buckets` : `${field} holding ${got}`;
-        return { deny: [], allow: undefined, earlier: { grammar: SESSION_RULES_GRAMMAR, toolAllow: [], toolDeny: [] }, allowDirs: undefined, pathRows: false, names: { deny: [], allow: [] }, unreadable: refuseEvery(what) };
+        return { deny: [], allow: undefined, earlier: { grammar: SESSION_RULES_GRAMMAR, toolAllow: [], toolDeny: [] }, announced: { toolAllow: [], toolDeny: [] }, allowDirs: undefined, pathRows: false, names: { deny: [], allow: [] }, unreadable: refuseEvery(what) };
     }
     const { toolAllow, allowDirs, grammar } = shaped.rules;
     const unreadDeny = unreadableDenyEntries(shaped.rules).length;
@@ -124,6 +109,7 @@ function compileSessionRules(rules) {
         deny,
         allow,
         earlier: { grammar, toolAllow: named(allowList, true), toolDeny: named(denyList, true) },
+        announced: { toolAllow: earlierGrammarEntries(shaped.rules, "toolAllow"), toolDeny: earlierGrammarEntries(shaped.rules, "toolDeny") },
         allowDirs: allowDirs !== undefined && allowDirs.length > 0 ? allowDirs : undefined,
         pathRows: [...deny, ...(allow ?? [])].some((r) => r.compiled.kind === "path"),
         names: { deny: [...deny.map((r) => compiledEntryName(r.compiled)), ...named(denyList, false)], allow: [...(allow ?? []).map((r) => compiledEntryName(r.compiled)), ...named(allowList, false)] },
@@ -143,7 +129,7 @@ export function createSessionRulePolicy(rules, opts) {
         if (compiled === undefined || compiledFor !== r) {
             compiled = compileSessionRules(r);
             for (const field of ["toolAllow", "toolDeny"])
-                announceEarlier(compiled.earlier[field], field, compiled.earlier.grammar);
+                announceEarlier(compiled.announced[field], field, compiled.earlier.grammar);
             compiledFor = r;
         }
         return compiled;

package/dist/core/runner/shell-env-withheld.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The run's seat for `inherit_env.names_withheld`: the person whose run drives the engine's shell tool is told which
+ * variables of the engine's environment that shell does not receive.
+ *
+ * ONE FACT, ONE MINT. Which entries a shell child loses is decided by the execution environment's one composition
+ * (`inheritedHostEnv(policy, findings)` and the adapter's explicit grants), and the environment hands the result over as
+ * the read `ExecutionEnv.withheldEnv`. This seat reads that answer and tells it; it never recomputes it (the policy and
+ * the grants are the adapter's, not the run's). The split into the scrub's half and the deployment's own credentials is
+ * the one the operator notice uses (`withheldEnvNames`).
+ *
+ * WHEN. At the start of every call to the engine's own shell tool (its mount, judged by the catalog's mount judge), on a
+ * root leg (the person reads the root; the delegation fact is the hook identity's, the leg's one derivation). The answer
+ * is read at each such call because it can grow during a run — a credential the engine takes in when it first routes a
+ * model, dials a peer or builds a seat is withheld from the next child — and a call follows at least one model request.
+ * Told once per SESSION per answer: the digest rides the session's announced record (`advisories`), and a run-time record
+ * write is parked for the leg's flush like every other run-time arm of that record.
+ *
+ * An answer of `"unknown"` is told as unknown, never as silence. A value that is neither a list of findings nor
+ * `"unknown"` (or a read that throws) is a wiring fault: it is announced to the operator under the existing
+ * capability-shape code, once per run, and the person is told nothing — no reading defaults to `"unknown"`.
+ */
+import { type EngineNotice } from "../engine-notice.js";
+import type { ExecutionEnv } from "../../internal/harness.js";
+import type { Prepared } from "./contracts.js";
+export type WithheldShellEnvSeatInput = Pick<Prepared, "sessionId" | "runId" | "hookIdentity" | "toolRosterDeltas" | "announcedListingsRef" | "frameReceipts"> & {
+    readonly harness: {
+        readonly env: Pick<ExecutionEnv, "withheldEnv">;
+    };
+};
+/** The seat, per run. `onToolStart` never throws: a diagnostic may not be what fails a call. */
+export declare function createWithheldShellEnvSeat(prepared: WithheldShellEnvSeatInput, onNotice: ((notice: EngineNotice) => void) | undefined): {
+    onToolStart(toolName: string): void;
+};

package/dist/core/runner/shell-env-withheld.js

@@ -0,0 +1,51 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+import { withheldEnvUserNotice } from "../secret-env.js";
+import { isEngineShellFace } from "../tool-catalog-entries.js";
+import { toolCallFaceOf } from "../tool-roster.js";
+import { announceDigest, withAnnounceDigests } from "./announce-once-ledger.js";
+const isFinding = (f) => typeof f === "object" && f !== null && typeof Reflect.get(f, "key") === "string" && typeof Reflect.get(f, "kind") === "string";
+function readWithheldEnv(env) {
+    try {
+        const value = env.withheldEnv;
+        if (value === "unknown")
+            return "unknown";
+        if (!Array.isArray(value))
+            return { malformed: value === null ? "null" : typeof value };
+        return value.every(isFinding) ? value : { malformed: "array holding a non-finding" };
+    }
+    catch {
+        return { malformed: "unreadable" };
+    }
+}
+export function createWithheldShellEnvSeat(prepared, onNotice) {
+    let shapeFaultTold = false;
+    return {
+        onToolStart(toolName) {
+            if (prepared.hookIdentity.isDelegatedChild || !isEngineShellFace(toolCallFaceOf(prepared.toolRosterDeltas.current, toolName)))
+                return;
+            const answer = readWithheldEnv(prepared.harness.env);
+            if (typeof answer === "object" && "malformed" in answer) {
+                if (shapeFaultTold)
+                    return;
+                shapeFaultTold = true;
+                deliverEngineNotice(onNotice, {
+                    code: "config.execution_env_capability_invalid",
+                    message: `The execution environment declares withheldEnv as (${answer.malformed}), not a list of findings or "unknown". The person whose run drives its shell is told nothing about the variables that shell does not receive. Fix the adapter — this is a wiring fault, not a supported way to leave the member unanswered.`,
+                    detail: { key: "withheldEnv", valueType: answer.malformed },
+                });
+                return;
+            }
+            const notice = withheldEnvUserNotice(answer, { sessionId: prepared.sessionId, runId: prepared.runId });
+            if (notice === undefined)
+                return;
+            const d = notice.detail;
+            const digest = announceDigest(notice.code, `${d.state}\n${[...(d.names ?? [])].sort().join("\n")}\n\n${[...(d.ownCredentials ?? [])].sort().join("\n")}`);
+            const record = prepared.announcedListingsRef;
+            if (record.advisories?.includes(digest) === true)
+                return;
+            deliverEngineNotice(onNotice, notice);
+            record.advisories = withAnnounceDigests(record.advisories, [digest]);
+            prepared.frameReceipts.listingSnapshotOwed = true;
+        },
+    };
+}

package/dist/core/runner/side-call-account.d.ts

@@ -1,22 +1,26 @@
 /**
  * The run's usage account for the model calls made BESIDE the main loop — the compaction summarizer, the permission
- * classifier, a mod's `$.model.complete`: the lanes, what a reply tells the account, the one door a lane books through, and the
- * ONE function behind it. The lane table says which `Stats` line keeps a lane's cost besides `costMicroUsd` (every lane folds
- * into the total — it is the budget coordinate and the reported figure); it is total over the lanes by its fence, so a fourth
- * lane is a row here, not a second accounting function.
+ * classifier, a mod's `$.model.complete`, the advisor tool: the lanes, what a reply tells the account, the one door a lane books
+ * through, and the ONE function behind it. The lane table says which `Stats` line keeps a lane's cost besides `costMicroUsd`
+ * (every lane folds into the total — it is the budget coordinate and the reported figure); it is total over the lanes by its
+ * fence, so another lane is a row here, not a second accounting function.
  */
 import type { AssistantMessageDiagnostic, Model, Usage } from "../../internal/llm.js";
 import { type ModelPricing } from "../pricing.js";
 import type { AssertAllKeysHandled } from "../ask-origin.js";
-import type { RunnerDeps, TaskSpec } from "../types.js";
+import type { Brain, RunnerDeps, TaskSpec } from "../types.js";
 import type { Stats } from "./assemble-result.js";
-/** Whose model call it is: the compaction summarizer, the permission classifier, a mod's `$.model.complete`. */
-export type SideCallLane = "compaction" | "classifier" | "mod";
-/** The `Stats` line a lane's cost is also kept in: compaction is its own partition line; the classifier and the mods share the side-call line. */
+/** Whose model call it is: the compaction summarizer, the permission classifier, a mod's `$.model.complete`, the advisor
+ *  tool's consultation of its advisor model. The word rides every side-call trace row (`brain.call.lane`). */
+export type SideCallLane = "compaction" | "classifier" | "mod" | "advisor";
+/** The `Stats` line a lane's cost is also kept in: compaction is its own partition line (the engine's upkeep); the
+ *  classifier, the mods and the advisor share the side-call line (calls the run's own agent caused, so they stay inside the
+ *  root agent's cost). */
 export declare const SIDE_CALL_LANE_TOTAL: {
     readonly compaction: "compactionMicroUsd";
     readonly classifier: "sideCallMicroUsd";
     readonly mod: "sideCallMicroUsd";
+    readonly advisor: "sideCallMicroUsd";
 };
 export type LaneTotalCoversEverySideCallLane = AssertAllKeysHandled<Exclude<SideCallLane, keyof typeof SIDE_CALL_LANE_TOTAL>>;
 /** A side call's reply as the account reads it: the provider's usage (absent ⇒ none reported), the marks of what is unknown,
@@ -64,5 +68,25 @@ export interface SideCallCall {
  * unknown is not free). A reply the brain itself marked `usageMissing` does the same for its zero-filled usage.
  */
 export declare function recordSideCallUsage(stats: Stats, usage: Usage | undefined, lane: SideCallLane, call: SideCallCall): void;
+/**
+ * The accounted brain of a DERIVED LEG — a model call made beside the main loop on the leg's behalf (the compaction summary,
+ * the advisor consultation): every reply is booked through `book` exactly once, under `lane`, and the call runs behind
+ * NO-OP status and reasoning-wire-facts sinks. Both arms obey the same law, whichever one the caller uses.
+ *
+ * The shields: a derived call fires inside the leg's `runWithStatusSink` scope (the compaction hook from `turn_boundary`
+ * within `harness.prompt`, the advisor from a tool call), so a 429/retry on it must not surface as a `status` event on the
+ * user's turn (status-sink.ts / TaskEvent.status), and its model, tier and output cap must not restate the leg's reasoning
+ * posture from a request the leg's caller never made — a no-op inner scope swallows the facts rather than consuming the
+ * leg's one correction.
+ *
+ * `complete` is ALWAYS provided (brainToRuntime prefers it), so the booking is awaited INLINE on both the native-complete and
+ * derived-from-stream paths, and the message is returned UNCHANGED (its `errorKind` is what the summary path's
+ * budget-escalation recovery reads). `stream` opens the inner stream inside the same scopes (the provider work it starts runs
+ * in them) and books the stream's final message when it settles: the inner `result()` settles once, whether the caller awaits
+ * it or only iterates, and the returned stream's `result()` is that booked settlement — a booking that throws rejects it rather
+ * than vanishing. A stream that ends without a final message books nothing; its caller owes the lower-bound mark. `brainOf`
+ * is read per call (a swapped deployment brain reaches legs already running).
+ */
+export declare function derivedLegBrain(brainOf: () => Brain, lane: SideCallLane, book: SideCallBook): Brain;
 /** The leg's door: `recordSideCallUsage` bound to the leg's `stats` and account, reading what the reply itself says (its marks, and who served it). */
 export declare function sideCallBookOf(stats: Stats, account: SideCallAccount): SideCallBook;

package/dist/core/runner/side-call-account.js

@@ -1,4 +1,5 @@
 import { readDegradation } from "../../brain/degrading.js";
+import { runWithReasoningWireFacts, runWithStatusSink } from "../../brain/status-sink.js";
 import { isModelPriced, modelCostToPricing } from "../pricing.js";
 import { emitTrace } from "../trace.js";
 import { cacheFamilyOf, usageCostMicroUsd } from "./usage-accounting.js";
@@ -6,6 +7,7 @@ export const SIDE_CALL_LANE_TOTAL = {
     compaction: "compactionMicroUsd",
     classifier: "sideCallMicroUsd",
     mod: "sideCallMicroUsd",
+    advisor: "sideCallMicroUsd",
 };
 function catalogModel(id, catalog) {
     if (catalog === undefined)
@@ -41,12 +43,32 @@ export function recordSideCallUsage(stats, usage, lane, call) {
     const total = SIDE_CALL_LANE_TOTAL[lane];
     stats[total] = (stats[total] ?? 0) + costMicroUsd;
     emitTrace(account.telemetry.tracer, () => ({
-        kind: "brain.call", version: 1, taskId: account.telemetry.taskId, model: modelId, ...(served !== undefined ? { provider: served.provider } : {}),
+        kind: "brain.call", version: 1, taskId: account.telemetry.taskId, model: modelId, lane, ...(served !== undefined ? { provider: served.provider } : {}),
         promptTokens: uncachedInputTokens, totalInputTokens, completionTokens: usage.output || 0,
         cacheRead: usage.cacheRead || 0, cacheWrite: usage.cacheWrite || 0,
         latencyMs: 0, ...(priced ? { costMicroUsd } : {}), ...(call.stopReason !== undefined ? { stopReason: call.stopReason } : {}), ts: Date.now(),
     }));
 }
+export function derivedLegBrain(brainOf, lane, book) {
+    const shielded = (fn) => runWithStatusSink(() => { }, async () => await runWithReasoningWireFacts(() => { }, fn));
+    return {
+        stream: (m, c, o) => shielded(async () => {
+            const inner = await Promise.resolve(brainOf().stream(m, c, o));
+            const booked = inner.result().then((msg) => {
+                book(lane, m, msg);
+                return msg;
+            });
+            booked.catch(() => { });
+            return { [Symbol.asyncIterator]: () => inner[Symbol.asyncIterator](), result: () => booked };
+        }),
+        complete: async (m, c, o) => {
+            const brain = brainOf();
+            const msg = await shielded(async () => (brain.complete ? await brain.complete(m, c, o) : await (await Promise.resolve(brain.stream(m, c, o))).result()));
+            book(lane, m, msg);
+            return msg;
+        },
+    };
+}
 export function sideCallBookOf(stats, account) {
     return (lane, model, reply) => {
         const degradedTo = readDegradation(reply)?.to;

package/dist/core/runner/skills-seat.js

@@ -39,7 +39,7 @@ export function readSkillsSeat(skills) {
         const at = `${SKILLS_SEAT}[${i}]`;
         if (typeof raw !== "object" || raw === null || Array.isArray(raw))
             throw skillsSeatRefusal(at, `must be an object { name, description, content } (got ${kindOf(raw)})`);
-        const { name, description, content, allowedTools, disallowedTools, files: rawFiles, baseDir, ...rest } = raw;
+        const { name, description, content, allowedTools, disallowedTools, files: rawFiles, baseDir, mods: rawMods, ...rest } = raw;
         void rest;
         for (const [member, value] of [["name", name], ["description", description], ["content", content]]) {
             if (typeof value !== "string")
@@ -47,11 +47,15 @@ export function readSkillsSeat(skills) {
         }
         const files = readSkillFiles(rawFiles, `${at}.files`);
         skillBaseDirOf(baseDir);
+        if (rawMods !== undefined && !Array.isArray(rawMods))
+            throw skillsSeatRefusal(`${at}.mods`, `must be a list of mods registrations (got ${kindOf(rawMods)})`);
         if (seen.has(name))
             continue;
         seen.add(name);
         const [allowed, denied] = [readSkillTable(allowedTools), readSkillTable(disallowedTools)];
-        out.push({ name, description, content, ...(allowed !== undefined ? { allowedTools: allowed } : {}), ...(denied !== undefined ? { disallowedTools: denied } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
+        const list = rawMods;
+        const mods = list === undefined ? undefined : Object.freeze(Array.from({ length: list.length }, (_, j) => list[j]));
+        out.push({ name, description, content, ...(allowed !== undefined ? { allowedTools: allowed } : {}), ...(denied !== undefined ? { disallowedTools: denied } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}), ...(mods !== undefined ? { mods } : {}) });
     }
     return out;
 }

package/dist/core/runner/stream-settle-backstop.js

@@ -74,7 +74,7 @@ export function streamSettleBackstop(input) {
             sessionId: taskIdRef.sessionId ?? "unknown",
             ...(taskIdRef.runId !== undefined ? { runId: taskIdRef.runId } : {}),
             terminal: { kind: "failed", ...(code !== undefined ? { code } : {}), message, ...(detail !== undefined ? { detail } : {}) },
-            result: "",
+            result: "", resultEntryIds: [],
             ...(remoteEnvFailure !== undefined ? { remoteEnvFailures: remoteEnvFailure } : {}),
             ...(taskIdRef.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: taskIdRef.effectiveMemoryScopes } : {}),
             ...(taskIdRef.effectiveReasoning !== undefined ? { effectiveReasoning: taskIdRef.effectiveReasoning } : {}),

package/dist/core/runner/strict-output-schema.d.ts

@@ -26,7 +26,7 @@ export type CompiledOutputSchema =
     fallbackReason: string;
 };
 /**
- * Validate + strict-derive a structured-output schema (CC 2.1.205 semantics):
+ * Validate + strict-derive a structured-output schema:
  *   invalid / oversized schema → `{error}` (the caller throws — no silent acceptance);
  *   in-subset schema → `{modelSchema: strictForm, strict:true}` (`additionalProperties:false` stamped);
  *   valid-but-unsupported schema → `{modelSchema: original, strict:false, fallbackReason}` (observable).

package/dist/core/runner/sub-agent-deny-lists.js

@@ -6,7 +6,7 @@ import { ENGINE_TOOLS } from "../tool-catalog-entries.js";
 import { callerToolNameProblem } from "../caller-tool-name.js";
 import { mintNamespacePrefix } from "../protocol-naming.js";
 import { PROTOCOL_TABLE, protocolOf } from "../protocol-table.js";
-import { mountedToolNames, splitNamespacedName } from "../tool-name-aliases.js";
+import { grantWildcardRefusalOf, mountedToolNames, splitNamespacedName } from "../tool-name-aliases.js";
 import { projectionToolNames } from "../tool-policy.js";
 import { declaredDelegationNameOf } from "../delegation-name.js";
 export function renamedDelegationMountSentence(...rosters) {
@@ -97,9 +97,6 @@ function readableToolNameList(where, side, value, code) {
             throw refused(notAStringSentence(where, side, index, read.type), code, "not_a_string");
         if (read.kind === "unreadable")
             throw grammarRefusal(where, side, { entry: read.entry, reason: "grammar" }, code);
-        if (side === "denied" && read.name === "*") {
-            throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: a denied list has no wildcard — the entry would hide nothing. To give the agent no tools, write an empty allowed list.`, code, "unsupported_pattern");
-        }
         return { entry: entry, name: read.name, content: read.content };
     });
 }
@@ -117,10 +114,11 @@ function judgeToolNameList(where, side, value, universe, advise, code) {
         const content = side === "denied" && written;
         const reach = side === "denied" ? readDeniedToolList([entry]) : (readAllowedToolList([entry]) ?? readDeniedToolList([]));
         const split = splitNamespacedName(name);
-        if (split !== undefined && split.peer === "*" && split.tool === undefined) {
+        const toolSplit = splitNamespacedName(toolName);
+        if (toolName.includes("*") && (toolSplit === undefined || toolSplit.peer.includes("*"))) {
             if (side === "denied")
                 continue;
-            throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: an allowed list has no protocol-wide form — name a peer (\`${split.ns.prefix}<peer>\`) or its tools.`, code, "unsupported_pattern");
+            throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: ${grantWildcardRefusalOf(name)}.`, code, "unsupported_pattern");
         }
         const { inert } = compileAllowList([toolName], "deny", universe.known);
         const flaw = inert[0] === undefined ? undefined : { ...inert[0], entry, ...(inert[0].reason === "near_miss" && inert[0].currentName !== undefined ? { carriedBy: universe.carrierOf(inert[0].currentName) } : {}) };

package/dist/core/runner/synthetic-tools.d.ts

@@ -3,12 +3,9 @@ import type { AgentTool } from "../../internal/harness-types.js";
 import type { TerminalBlockedDetail } from "../terminal-cause.js";
 import { type ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import { type SkillGrantTable } from "../skill-grant.js";
-/** Reserved name of the injected structured-output tool (CC 2.1.187 `StructuredOutput`; batch-A rename — old
- *  "submit_output" is canonicalized for pre-rename durable state). */
-export declare const OUTPUT_TOOL_NAME = "StructuredOutput";
 /** Reserved name of the injected blocked-report signal tool (PascalCase: `report_blocked`→`ReportBlocked`). */
 export declare const REPORT_BLOCKED_TOOL_NAME = "ReportBlocked";
-/** Name of the injected code-review findings echo tool (CC 2.1.207 parity — 锚 pretty.js:361412 `BCe`). */
+/** Name of the injected code-review findings echo tool. */
 export declare const REPORT_FINDINGS_TOOL_NAME = "ReportFindings";
 /** Default `submit_output` retries (council OS3); total attempts = retries + 1. Overridable via `TaskSpec.outputRetries`. */
 export declare const OUTPUT_DEFAULT_RETRIES = 2;
@@ -32,7 +29,7 @@ export interface OutputRef {
     set?: boolean;
 }
 /**
- * @param strictSchema CC 2.1.205 parity (strict-output-schema.ts): the STRICT derivation of `schema` when
+ * @param strictSchema (strict-output-schema.ts): the STRICT derivation of `schema` when
  *   it converted (`additionalProperties:false` stamped, subset-validated). It becomes the tool's
  *   `parameters` — both the model-visible wire schema (CC sends it as `strictInputJSONSchema`) and the
  *   validation schema (the strict form only TIGHTENS the caller's schema, so anything it accepts is valid
@@ -41,7 +38,7 @@ export interface OutputRef {
  */
 export declare function createOutputTool(ref: OutputRef, schema: TSchema, strictSchema?: TSchema): AgentTool;
 export declare function createReportBlockedTool(ref: BlockedRef): AgentTool;
-/** One reported finding (the CC 207 wire shape — see {@link createReportFindingsTool}). */
+/** One reported finding (the wire shape — see {@link createReportFindingsTool}). */
 export interface ReportedFinding {
     file: string;
     line?: number;
@@ -51,16 +48,22 @@ export interface ReportedFinding {
     verdict?: "CONFIRMED" | "PLAUSIBLE";
     outcome?: "fixed" | "skipped" | "no_change_needed";
 }
-/** Build the injected `ReportFindings` echo tool (CC 2.1.207 parity — description verbatim from 锚
- *  pretty.js:361413; `effect: "read"` mirrors CC `isReadOnly()`/`isConcurrencySafe()` → parallel-safe). */
+/** Build the injected `ReportFindings` echo tool (
+ *  `effect: "read"` mirrors CC `isReadOnly()`/`isConcurrencySafe()` → parallel-safe). */
 export declare function createReportFindingsTool(): AgentTool;
 /** Reserved name of the injected skill-loading tool (present only when `spec.skills` is non-empty). */
 export declare const SKILL_TOOL_NAME = "Skill";
-/** Per-skill LOAD gate on `SkillSpec.content` (CC 2.1.207 parity: CC's only invoke-time size door is a 1MB file-load gate — an over-limit skill is REJECTED
+/** Per-skill LOAD gate on `SkillSpec.content` (the reference's only invoke-time size door is a 1MB file-load gate — an over-limit skill is REJECTED
  *  WHOLE, never truncated, and the invoked body enters context untruncated). Sema skills are spec-supplied, so the equivalent gate sits at spec assembly:
  *  an oversized skill is excluded from the disclosure block and the tool, with an operator-visible config error. The compaction-time retention caps are a
  *  different door, deliberately. */
 export declare const SKILL_CONTENT_MAX_CHARS: number;
+/** The skills a leg LOADS — those the load gate above passes ({@link skillLoadReading}, the one predicate): the skills whose
+ *  hooks the leg's mods admission takes, as the roster's filter (which also reports each one it excludes) takes the same. */
+export declare function skillsThatLoad<T extends {
+    readonly content: string;
+    readonly baseDir?: unknown;
+}>(skills: readonly T[] | undefined): T[];
 /** Total per-invoke cap for a skill's inlined attachments (`SkillSpec.files`) — an ATTACHMENT-face budget, distinct from the (gone) body truncation door:
  *  the body is delivered untruncated at invoke time (CC parity), while attachments ride along bounded and truncation-disclosed. */
 export declare const SKILL_ATTACHMENTS_MAX_CHARS = 50000;
@@ -97,8 +100,8 @@ export interface SkillListingEntry {
      *  their descriptions when the block overflows its byte budget ({@link buildSkillsBlock} tier B); the
      *  DISPLAY order stays name-sorted, so adding this never moves a line.
      *
-     *  Why declaration order: CC 220's `sbs` (@317547) takes a priority function and is called with
-     *  `uNt(name)` (@608552 → @402383) = usage count decayed by recency of last use, and additionally
+     *  Why declaration order: the reference takes a priority function and is called with
+     *  a usage count decayed by recency of last use, and additionally
      *  pins every `bundled` skill's description unconditionally. Core has NEITHER axis — no cross-session
      *  skill-usage store, and no bundled/user distinction (every skill arrives through the same
      *  caller-supplied `TaskSpec.skills`). Declaration order is the one priority statement the deployment
@@ -140,7 +143,7 @@ export declare function buildSkillsBlock(skills: ReadonlyArray<SkillListingEntry
 /** Render the `<skills>` disclosure block (metadata only — bodies stay behind the tool).
  *  [c209-C] REVERSAL: no longer composed into the stable system prompt — this is now the RENDERER for
  *  the `skills_listing` initial frame (first-user-turn reminder / boundary re-announce), so the
- *  cached prefix carries zero skill bytes (design/C §2.3; CC 209 classic ships the same listing as a
+ *  cached prefix carries zero skill bytes (design/C §2.3; the reference ships the same listing as a
  *  first-turn reminder). `budget` absent ⇒ the seat reader's no-knob answer ({@link SKILL_LISTING_DEFAULT_BUDGET}).
  *
  *  The fence and its four header lines are this lane's frame; the budget arithmetic and the three
@@ -157,7 +160,7 @@ export declare function renderSkillsBlock(skills: ReadonlyArray<SkillListingEntr
  * reader resolved (`@contract skills.listing_budget_enforced_as_declared`), which is the frame's whole
  * bound: the listing is an intact-class attachment, so no delivery lane measures it a second time.
  *
- * Tier B follows CC 220 `sbs` @317547-317586 (reserve the marker + every name-only line, then spend
+ * Tier B follows the reference (reserve the marker + every name-only line, then spend
  * the slack on descriptions in {@link SkillListingEntry.declaredRank} order); tier C closes with an
  * honest `(… +N more skills …)` count line — the tool still serves all of them.
  */

package/dist/core/runner/synthetic-tools.js

@@ -3,11 +3,10 @@ import { defineTool } from "../tools.js";
 import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { SKILL_LISTING_DEFAULT_BUDGET, SKILL_LISTING_DESC_MAX_CHARS_DEFAULT } from "../skill-listing-budget.js";
 import { readSkillTable, skillNamedBy } from "../skill-grant.js";
-import { toolFace } from "../tool-catalog-entries.js";
-import { substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
+import { OUTPUT_TOOL_NAME, mountRuleFace, toolFace } from "../tool-catalog-entries.js";
+import { skillLoadReading, substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
 import { readSkillsSeat } from "./skills-seat.js";
 import { foldListingWithin } from "./listing-fold.js";
-export const OUTPUT_TOOL_NAME = "StructuredOutput";
 export const REPORT_BLOCKED_TOOL_NAME = "ReportBlocked";
 export const REPORT_FINDINGS_TOOL_NAME = "ReportFindings";
 export const OUTPUT_DEFAULT_RETRIES = 2;
@@ -36,6 +35,7 @@ export function createReportBlockedTool(ref) {
     return defineTool({
         name: REPORT_BLOCKED_TOOL_NAME,
         ...toolFace("report-blocked"),
+        ruleFace: mountRuleFace("report-blocked"),
         description: "Call this ONLY when you cannot complete the task — missing information, missing permission/credentials, or an ambiguous request you cannot resolve. Provide a concise reason that an external system or operator can act on. Calling this ends the task.",
         parameters: Type.Object({ reason: Type.String() }),
         execute: (args) => {
@@ -64,6 +64,7 @@ export function createReportFindingsTool() {
     return defineTool({
         name: REPORT_FINDINGS_TOOL_NAME,
         ...toolFace("report-findings"),
+        ruleFace: mountRuleFace("report-findings"),
         description: "Report code-review findings as a typed list so the host UI can render them. Use this only when the " +
             "active code-review instructions tell you to report findings with this tool; otherwise follow whatever " +
             "output format those instructions specify. When reporting a review's results, call it once with the " +
@@ -89,6 +90,9 @@ export function createReportFindingsTool() {
 }
 export const SKILL_TOOL_NAME = "Skill";
 export const SKILL_CONTENT_MAX_CHARS = 1024 * 1024;
+export function skillsThatLoad(skills) {
+    return (skills ?? []).filter((s) => skillLoadReading(s, SKILL_CONTENT_MAX_CHARS).loads);
+}
 export const SKILL_ATTACHMENTS_MAX_CHARS = 50_000;
 export const SKILL_ATTACHMENT_PATH_MAX_CHARS = 512;
 const SKILL_FILES_LIST_MAX_CHARS = 200;
@@ -155,6 +159,7 @@ export function createSkillTool(skills, grants) {
     return defineTool({
         name: SKILL_TOOL_NAME,
         ...toolFace("skill"),
+        ruleFace: mountRuleFace("skill"),
         executionMode: "sequential",
         description: `Invoke a skill.\n\n` +
             `A skill is a packaged set of instructions the user or project has set up for a particular kind of task (deploy steps, a review checklist, a repo-specific workflow). ` +

package/dist/core/runner/tool-disclosure.d.ts

@@ -64,20 +64,18 @@ export declare function buildDeferredRegistry(deferred: ReadonlySet<string>, too
  * validation, not activation state: a call whose arguments validate against the REAL tool's
  * declared schema runs the real tool directly (activation is only about whether the model has
  * been SHOWN the schema, never an execution gate). Governance cannot be laundered through this
- * lane: policy/effect/irreversibility gates key on the tool NAME maps built from the real
- * declarations, and the engine's approval pipeline runs before any execute — the placeholder
- * object on the harness list plays no part in adjudication.
+ * lane: the gate judges the call before any execute, and the call runs the one mounted instance its
+ * placeholder stands for — the harness resolves a call to its placeholder before the gate, as it
+ * resolves any call to its tool, so what runs is fixed before anything is judged.
  */
 export interface PlaceholderDirectCall {
     /**
-     * Resolve the real tool AT CALL TIME, never from a prepare-time snapshot. The mounted
-     * roster is a LIVE array: an MCP refresh splices a server's name domain out and pushes freshly
-     * materialized tool objects back in, so a Map captured when the placeholder was built would hand
-     * this lane the WITHDRAWN object (stale schema shape gate, stale transport client) long after the
-     * roster moved on. Returns `undefined` when the name no longer resolves — a withdrawn name has no
-     * direct lane, and the caller falls back to the teaching rejection.
+     * The mounted instance this placeholder stands for, bound when the placeholder is minted for it (one
+     * placeholder per instance; a refresh that replaces the instance mints a new placeholder for the new
+     * one). Never re-resolved by name: a call the gate judged while a refresh landed runs the instance it
+     * was resolved to, whose own checks answer a declaration that changed meanwhile.
      */
-    resolveReal: () => PlaceholderDirectTarget | undefined;
+    real: PlaceholderDirectTarget;
     /**
      * The scheduling declaration this placeholder carries while it stands in for the real
      * tool. Mirrors the REAL tool's own `executionMode` (see the mirror rationale in
@@ -91,7 +89,7 @@ export interface PlaceholderDirectCall {
      * schema it hands back actually lives (this result only, versus this result AND every later
      * request's tools block). Absent ⇒ the swap posture.
      *
-   * A FUNCTION, evaluated per call, for the same reason `resolveReal` is: the answer is not
+   * A FUNCTION, evaluated per call: the answer is not
      * a prepare-time constant. The run-wide strategy is, but the per-tool exemption on top of it reads
      * the LIVE roster — an MCP refresh can replace a tool with a declaration that no longer fits the
      * result-text carrier (or one that now does), and a boolean captured when the placeholder was built
@@ -113,7 +111,7 @@ export interface PlaceholderDirectCall {
      */
     activate: () => Promise<string | undefined>;
 }
-/** The live view of the real tool behind a placeholder, resolved per call (see {@link PlaceholderDirectCall.resolveReal}). */
+/** The real tool behind a placeholder (see {@link PlaceholderDirectCall.real}). */
 export interface PlaceholderDirectTarget {
     /** The REAL tool's declared parameter schema — the shape gate for a direct call. */
     parameters: TSchema;

package/dist/core/runner/tool-disclosure.js

@@ -2,7 +2,7 @@ import { Type } from "typebox";
 import { Value } from "typebox/value";
 import { defineTool, errorResult } from "../tools.js";
 import { formatZodValidationError, truncateError } from "../tool-errors.js";
-import { toolFace } from "../tool-catalog-entries.js";
+import { mountRuleFace, toolFace } from "../tool-catalog-entries.js";
 export const TOOL_SEARCH_NAME = "ToolSearch";
 export const TOOL_SEARCH_DEFAULT_MAX_RESULTS = 5;
 const MAX_QUERY_RESULTS = 25;
@@ -93,9 +93,7 @@ export function createPlaceholderTool(info, direct) {
             parameters: EMPTY_PARAMS,
             ...(direct.executionMode !== undefined ? { executionMode: direct.executionMode } : {}),
             execute: async (toolCallId, params, signal, onUpdate) => {
-                const real = direct.resolveReal();
-                if (real === undefined)
-                    return teachingRejection();
+                const { real } = direct;
                 if (Value.Check(real.parameters, params)) {
                     lastFailureShape = undefined;
                     repeats = 0;
@@ -262,6 +260,7 @@ export function createToolSearchTool(opts) {
     return defineTool({
         name: TOOL_SEARCH_NAME,
         ...toolFace("tool-search"),
+        ruleFace: mountRuleFace("tool-search"),
         description: "Discover and activate deferred tools. " +
             activationPosture +
             "Query forms: " +

package/dist/core/runner/tool-end-body.d.ts

@@ -95,7 +95,7 @@ export interface SettledOccurrence extends Pick<OccurrenceEnd, "notExecuted"> {
  * The END projection — the ONE mint of `tool_end`, for every station that closes a call: the live loop's
  * `tool_execution_end`, the resumed leg's resolution, an interrupted run's reconcile and the reconcile replayed at
  * the next process start. It reads the occurrence and nothing else: `gate` is its latest gate record, `isError` is
- * the tool's bit or the refusal that record names, and `notExecuted` rides on positive evidence only: the station's own or `refusedBeforeRelease` (returned for the rows).
+ * the tool's bit or the refusal that record names, and `notExecuted` rides on positive evidence only: the station's own or `neverExecuted` (returned for the rows).
  *
  * A call whose start never went out on this stream (a call the loop never reached, a call announced by a dead
  * process) gets its start minted here first, marked `recovered` and carrying the input the closing station holds —