@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/tool-name-readings.d.ts

@@ -8,7 +8,8 @@
  *                 answers to ({@link heldBy}); a set-valued table is read as the union of its entries ({@link heldValues}).
  *  · `seat`     — a multi-key seat keyed on engine names: ONE name is chosen ({@link seatOf}) and every key of the seat is
  *                 read under it. `tier` = the name whose irreversibility tier is strictest (`never < maybe < always`, an
- *                 absent tier lowest, ties to the earlier name of the call); `member` = the first name the table holds.
+ *                 absent tier lowest; a tie goes to the call's wire name — the tool that runs judges its own call with its
+ *                 own probe — then to the earlier name of the call); `member` = the first name the table holds.
  *  · `wire`     — a GRANT or a ROUTING keyed on an engine name: the call's wire name only ({@link wireOf}).
  *  · `spelling` — a record of what the model said (stream frames, transcripts, counters): the harness event's own name;
  *                 no port — listed so the table is complete.
@@ -78,10 +79,6 @@ export declare const NAME_READINGS: {
         readonly rank: "member";
         readonly file: string;
     };
-    readonly "lanes.contentQuestionClass": {
-        readonly kind: "any";
-        readonly file: string;
-    };
     readonly "lanes.readOnlyShellAllow": {
         readonly kind: "wire";
         readonly file: string;
@@ -90,30 +87,10 @@ export declare const NAME_READINGS: {
         readonly kind: "wire";
         readonly file: string;
     };
-    readonly "lanes.contentAskRoute": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
     readonly "lanes.orgContentAskExemption": {
         readonly kind: "wire";
         readonly file: string;
     };
-    readonly "lanes.persistedEditSkip": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
-    readonly "lanes.persistedLaneSkip": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
-    readonly "lanes.allowLayerQuestionSkip": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
-    readonly "lanes.sandboxQuestionSkip": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
     readonly "policy.nameLists": {
         readonly kind: "any";
         readonly file: string;
@@ -150,10 +127,6 @@ export declare const NAME_READINGS: {
         readonly kind: "any";
         readonly file: string;
     };
-    readonly "policy.durableQuestion": {
-        readonly kind: "any";
-        readonly file: string;
-    };
     readonly "policy.sensitivePathGuardedByName": {
         readonly kind: "any";
         readonly file: string;
@@ -163,6 +136,11 @@ export declare const NAME_READINGS: {
         readonly rank: "member";
         readonly file: string;
     };
+    readonly "floor.protectiveHostTarget": {
+        readonly kind: "seat";
+        readonly rank: "member";
+        readonly file: string;
+    };
     readonly "mode.planRosterRow": {
         readonly kind: "wire";
         readonly file: string;
@@ -243,10 +221,6 @@ export declare const NAME_READINGS: {
         readonly kind: "spelling";
         readonly file: string;
     };
-    readonly "inherited.questionFloat": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
     readonly "inherited.askFace": {
         readonly kind: "wire";
         readonly file: string;
@@ -255,14 +229,6 @@ export declare const NAME_READINGS: {
         readonly kind: "wire";
         readonly file: string;
     };
-    readonly "resume.editRecheckQuestionSkip": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
-    readonly "resume.questionArgsShown": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
     readonly "budget.exemptResult": {
         readonly kind: "wire";
         readonly file: string;
@@ -350,8 +316,9 @@ export interface TierSeat extends Seat<IrreversibilityTierWord> {
     }): boolean;
 }
 /**
- * A `seat` site's read. A `tier` seat takes the irreversibility tier table and picks the name whose tier is strictest;
- * a `member` seat takes a table (a map, or a set whose value reads `true`) and picks the first name it holds.
+ * A `seat` site's read. A `tier` seat takes the irreversibility tier table and picks the name whose tier is strictest, a tie
+ * going to the call's wire name, then to its earlier name; a `member` seat takes a table (a map, or a set whose value reads
+ * `true`) and picks the first name it holds.
  */
 export declare function seatOf(site: TierSeatSite, tiers: {
     get(name: string): IrreversibilityTierWord | undefined;

package/dist/core/tool-name-readings.js

@@ -21,15 +21,9 @@ export const NAME_READINGS = {
     "gate.preToolUse": wire("src/core/hooks.ts"),
     "gate.askFace": wire("src/core/runner/gate-exit.ts"),
     "fold.readStation": seat("member", "src/tools/fs/shell-read-check.ts"),
-    "lanes.contentQuestionClass": any(LANES),
     "lanes.readOnlyShellAllow": wire(LANES),
     "lanes.modeFileCommand": wire(LANES),
-    "lanes.contentAskRoute": wire(LANES),
     "lanes.orgContentAskExemption": wire(LANES),
-    "lanes.persistedEditSkip": wire(LANES),
-    "lanes.persistedLaneSkip": wire(LANES),
-    "lanes.allowLayerQuestionSkip": wire(LANES),
-    "lanes.sandboxQuestionSkip": wire(LANES),
     "policy.nameLists": any(POLICY),
     "policy.shellToolsList": any(POLICY),
     "policy.projectionReplay": any(POLICY),
@@ -39,9 +33,9 @@ export const NAME_READINGS = {
     "gate.skillActivationSeat": wire(GATE),
     "policy.permissionRules": any("src/core/permission-rules.ts"),
     "policy.persistedGrammar": any("src/core/permission-rule-model.ts"),
-    "policy.durableQuestion": any("src/core/ask-question.ts"),
     "policy.sensitivePathGuardedByName": any("src/core/sensitive-path-policy.ts"),
     "floor.protectivePathTarget": seat("member", "src/core/tool-registry.ts"),
+    "floor.protectiveHostTarget": seat("member", "src/core/host-target.ts"),
     "mode.planRosterRow": wire("src/core/mode-policy.ts"),
     "offer.laneTool": wire(OFFER),
     "offer.orgQuestionExemption": wire(OFFER),
@@ -61,11 +55,8 @@ export const NAME_READINGS = {
     "stats.subagentToolCounter": spelling("src/agents/subagent.ts"),
     "activity.sink": spelling(HANDLERS),
     "reconcile.orphanEffect": spelling("src/core/session-reconcile.ts"),
-    "inherited.questionFloat": wire(CHAIN),
     "inherited.askFace": wire(CHAIN),
     "card.reserved": wire("src/core/tool-roster.ts"),
-    "resume.editRecheckQuestionSkip": wire("src/core/runner/resume-apply.ts"),
-    "resume.questionArgsShown": wire("src/core/runner/run-leg.ts"),
     "budget.exemptResult": wire("src/core/tool-result-budget.ts"),
     "compaction.compactableResult": wire("src/core/context-edit.ts"),
 };
@@ -113,7 +104,7 @@ export function seatOf(site, table, call) {
     const valueAt = (n) => (typeof table.get === "function" ? table.get(n) : table.has(n) ? true : undefined);
     if (r.kind === "seat" && r.rank === "tier") {
         let best;
-        for (const n of names) {
+        for (const n of [call.toolName, ...names.filter((name) => name !== call.toolName)]) {
             const v = valueAt(n);
             if (v === undefined)
                 continue;

package/dist/core/tool-policy.d.ts

@@ -1,10 +1,12 @@
 import { type AskOrigin, type AssertAllKeysHandled } from "./ask-origin.js";
+import { type EngineAttestation } from "./engine-attestation.js";
 import { type ReadRootGrantScreen } from "./read-root-grant-screen.js";
 import { type Settlement } from "./gate-outcome.js";
 export { policyCannotAnswer, rowDemandsAPerson } from "./real-approval.js";
 import { type BindingFault } from "./canonical-json.js";
 import { type DecisionReason } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
+import { type RuleBehavior } from "./permission-rule-model.js";
 import { type RemovalGuardSeat } from "../tools/fs/removal-targets.js";
 /** A tool call presented to a policy before it executes. */
 /** design/388 B6 — the per-call face (see {@link ToolCallRequest.face}). */
@@ -16,6 +18,14 @@ export interface ToolCallFace {
     names?: readonly string[];
     family: import("./tool-face.js").ToolFamily;
     pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
+    /** The URL slot a host rule of the tool's name is read on (`callHostTargetOf`), as the tool declared it — absent when it
+     *  declares none, so no allow by host reaches the call (a deny or an ask still reads the catalog's slot for the name). */
+    hostTarget?: import("./tool-face.js").ToolHostTarget;
+    /** The values the mounted tool takes for the argument its name rules are read against (`ToolRuleFace.nameValues`, off the
+     *  roster row — the delegation tool's offered agent types): a name rule of such a tool resolves its value and the call's against
+     *  them (`nameRuleReach`). Absent where the tool declares none, and on a face rebuilt from a park row: a rule that needs them
+     *  then cannot be read against the call (a deny refuses, an ask asks a person, an allow grants nothing). */
+    nameValues?: readonly string[];
     capabilityId: string;
     contractId: string;
     shapeDigest: string;
@@ -25,6 +35,11 @@ export interface ToolCallFace {
      *  ask, the parked gate and the pending row, so no reader recovers the card from a name. Absent on a face rebuilt
      *  from a park row (a re-judgment reads no card). */
     approvalCard?: import("./tool-face.js").ToolApprovalCard;
+    /** Present (`true`) iff one of the ENGINE's own mount sites mounted the tool the call dispatches to — a built-in or synthetic tool
+     *  the engine minted for the leg, never a caller's `TaskSpec.tools` entry or a protocol peer's tool (`engineMountedRow`). The one
+     *  identity a caller cannot wear: a name and a contract id can be declared. A face rebuilt from a park row carries it when the row does
+     *  (the member the park wrote off the roster entry); absent on a row minted before the member. */
+    engineMounted?: true;
 }
 export interface ToolCallRequest {
     /** The tool's wire name — the Runner's gate resolves a call made under an alias to the wire name of the tool it
@@ -214,81 +229,7 @@ export declare function exemptRootsSeat(exemptRoots: readonly string[]): {
 /** Declared beside the receipt's list (decision-receipt.ts) — a new member added to either side is a compile error rather
  *  than a silent drift between the type and the screen; re-exported here, the module every consumer of the decision reads. */
 export type { DecisionReason };
-/**
- * The engine's ATTESTATION record — the one carrier of what an engine station knows about a decision and a policy cannot
- * state: WHO settled the call's wait and WHICH question that answered (the settlement, the ask's origin word and class set,
- * the digest of the arguments the answer licenses), and the facts the classifier stations, the in-fold unresolvable arms
- * and the policy fold record. It rides the decision as its `attestation` member and is read through {@link attestationOf}
- * alone; the decision object's identity carries nothing.
- *
- * Minted only by {@link mintAttestation} and combined only by {@link mergeAttestation}: both freeze the record and enter it
- * in a module-private brand set, so a value a caller composed — a literal, a copy, a structured clone — is not a record, and
- * the receipt refuses a decision carrying one. A record is bound to the call it was minted for (`toolCallId` + `toolName`):
- * handed back for another call it reads as absent. A spread of a decision keeps its record, and the record still says only
- * what the engine minted — a refusal record on an allow is a contradiction the gate's exit refuses, and a resolution's
- * answer binds the arguments it licensed (`inputDigest`).
- */
-export interface EngineAttestation {
-    readonly toolCallId: string;
-    readonly toolName: string;
-    /** What ended the call's wait. The answer group — `settlement`, `origin`, `classes`, `inputDigest` — travels as one. */
-    readonly settlement?: Settlement;
-    /** The settled ask's origin word. */
-    readonly origin?: AskOrigin;
-    /** The settled ask's class set (`ASK_CLASSES` order), when the minting station held one. */
-    readonly classes?: readonly import("./ask-origin.js").AskClass[];
-    /** `exactBoundInputHashOf` of the arguments the settlement licenses (an approver's edit, the snapshot shown, or the asked
-     *  args); absent when they have none (outside the bindable domain) — such a record licenses no bytes. */
-    readonly inputDigest?: string;
-    /** The FORM of a classifier round that did not rule (a classifier deny's cause). */
-    readonly classifierCause?: import("./gate-outcome.js").ClassifierDenyCause;
-    /** WHICH model answered a classification, on either arm. */
-    readonly classifierRound?: import("./auto-mode.js").AutoModeClassifierRound;
-    /** Why an in-fold deny refused an ask nobody could resolve. */
-    readonly unresolvableCause?: import("./ask-unresolvable-notice.js").AskUnresolvableCause;
-    /** The classes of the asks a policy fold collapsed — the proof behind a decision's `foldedAskClasses`. */
-    readonly foldedClasses?: readonly import("./ask-origin.js").AskClass[];
-    /** Where a path deny row refused the call — the row, the view of the target it met, the face the call is on. The gate's
-     *  exit mints the refusal's card from it; the judge that found the row is its only writer. */
-    readonly pathDenial?: import("../tools/fs/safety.js").PathDenialEvidence;
-    /** A seat refused the call's arguments because no approval can be bound to them ({@link bindableArgsOf}): the refusal's
-     *  sentence, carried by the refusal itself — the gate's deny exit reads it (the remedy it gives) instead of judging again. */
-    readonly bindingRefusal?: string;
-}
-/** The members a station attests — everything but the call binding. */
-export type AttestationMembers = Omit<EngineAttestation, "toolCallId" | "toolName">;
-/** Mint a record for `call`. Engine stations only: not re-exported from `src/index.ts`. The values are DETACHED snapshots, so a
- *  caller that later mutates the settlement object it was handed cannot rewrite what the engine attests. */
-export declare function mintAttestation(call: {
-    toolCallId: string;
-    toolName: string;
-}, members: AttestationMembers): EngineAttestation;
-/** Is `v` a record the engine minted (the brand alone — no binding)? The receipt's test. */
-export declare function isEngineAttestation(v: unknown): v is EngineAttestation;
-/** THE read: the record `d` carries FOR `call` — a branded record bound to that call, else `undefined` (a record bound to
- *  another call is a replayed one and reads as absent). Read off the own data member, never through an accessor. */
-export declare function attestationOf(d: unknown, call: {
-    toolCallId: string;
-    toolName: string;
-}): EngineAttestation | undefined;
-/**
- * Combine two records for `call`, member GROUP by group: the later record's group stands where it has one, the earlier's
- * fills a group the later lacks. A record not bound to `call` contributes nothing. `answer` scope is the veto's merge: the
- * earlier record contributes ONLY its answer, and only when the later carries none — a person's yes rides a later layer's
- * deny (invariant I3) while the refusing station's own facts stay its own.
- */
-export declare function mergeAttestation(call: {
-    toolCallId: string;
-    toolName: string;
-}, earlier: EngineAttestation | undefined, later: EngineAttestation | undefined, scope?: "all" | "answer"): EngineAttestation | undefined;
-/** `d` with `members` attested for `call`, merged over the record it already carries for that call (the new members' groups
- *  win). Always a fresh object — the receipt hands out frozen ones. */
-export declare function attest<T extends object>(d: T, call: {
-    toolCallId: string;
-    toolName: string;
-}, members: AttestationMembers): T;
-/** `d` carrying `record` (a fresh object), or `d` itself when there is no record to put on it. */
-export declare function withAttestation<T extends object>(d: T, record: EngineAttestation | undefined): T;
+export { attest, attestationOf, isEngineAttestation, mergeAttestation, mintAttestation, withAttestation, type AttestationMembers, type EngineAttestation } from "./engine-attestation.js";
 /** The `no_approver`-attested deny an engine policy answers on a request that states nobody can be asked about it
  *  ({@link ToolCallRequest.approvalReach}) instead of reaching a seat — read by a probe as "would ask an approver". */
 export declare function noApproverSeatDeny(req: {
@@ -336,7 +277,7 @@ export declare function screenApproverAttribution(v: unknown): {
     approver?: string;
     defect?: string;
 };
-/** An integrity guard an ask stands on ({@link PermissionResult}'s `guards`). */
+/** An integrity guard an ask stands on — an engine finding, carried on the ask's record ({@link EngineAttestation.guards}). */
 export type AskGuard = "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "artifact_shared_read";
 /**
  * A three-state permission decision for a tool call (design/37). Upgrades the old two-state
@@ -384,7 +325,7 @@ export type PermissionResult = {
     decisionReason?: DecisionReason;
     requiresRealApproval?: boolean;
     /** This ask is the classifier DENIAL-LIMIT fallback — the block that reached a
-     *  bound (CC 2.1.250 `FO`, count-then-judge) handed to a person instead of being denied.
+     *  bound (count-then-judge) handed to a person instead of being denied.
      *  ENGINE-STAMPED beside `requiresRealApproval: true` and `decisionReason: "classifier"` at the
      *  classifier block sites (the gate's own and the inherited-lane arms); carries the COUNTS ONLY —
      *  the auto-deny window is a fact of the ask's ROUTE, so this type has no member to hold one
@@ -403,17 +344,24 @@ export type PermissionResult = {
     classifierNoRuling?: import("./auto-mode.js").AutoModeFallbackCause;
     /** The allow layer's DISCLOSURE: the members that MATCHED this call and could not clear the ask (it is a class
      *  no allow rule clears — a mandated, governance, hook, ask-rule or mode question — or the call reached the layer
-     *  marked), one record per member ({@link AllowRuleShadow}). ENGINE-STAMPED by the allow layer, overwriting a
-     *  policy's own value; a DISPLAY member: the approval card and the park row render it, nothing reads it to
-     *  decide, and the classifier never sees it (it is not part of `message`). Absent ⇒ no member matched. */
+     *  marked), one record per member ({@link AllowRuleShadow}). Written by the allow layer alone (a STAMP member: a
+     *  decision that states it is refused at the receipt); a DISPLAY member: the approval card and the park row render it,
+     *  nothing reads it to decide, and the classifier never sees it (it is not part of `message`). Absent ⇒ no member matched. */
     allowRuleShadowed?: readonly import("./allow-rule-shadow.js").AllowRuleShadow[];
     /** backlog #239 disclosure (additive): WHY the reversibility probe did not clear this call, in the
      *  probe's own words. ENGINE-STAMPED at the irreversibility tighten (which constructs this decision
      *  wholesale), already neutralized + capped there; a `"maybe"` tier whose probe supplied no cause,
-     *  and the `"always"` tier (which runs no probe), leave it absent. Same DISPLAY-ONLY posture as
+     *  and the `"always"` tier (which runs no probe), leave it absent. Also stamped beside a mandate merged onto an
+     *  ask another layer raised (the read station's account of its finding): it is the one sentence that says why
+     *  a matching allow rule did not clear a `probe_mandate` ask, on the card and in the parked row alike. Same DISPLAY-ONLY posture as
      *  {@link allowRuleShadowed}: a policy that self-declares it can only put its own prose on its
      *  own card — nothing reads this member to decide anything, so it is not an authority channel. */
     probeReason?: string;
+    /** This ask puts a person's edit back to the person: the restriction chain would not run it as written and accepts it
+     *  only as {@link import("./rewrite-rejudge.js").EditRewritten.acceptableForm}, the bytes this ask presents. ENGINE-MINTED by
+     *  the approved-edit pass (a policy's self-declared value is a display claim about its own card); carried onto the
+     *  approval request as {@link AskRequest.editRewritten}. */
+    editRewritten?: import("./rewrite-rejudge.js").EditRewritten;
     /** backlog #239 disclosure (additive): the STRUCTURED cause, for a probe whose verdict this engine
      *  understands (see {@link import("./checkpoint-store.js").ProbeCause}). Engine-stamped and
      *  validated at the irreversibility tighten; same display-only posture as the prose sibling. */
@@ -442,8 +390,8 @@ export type PermissionResult = {
      *  set, and a policy self-declaring it only opts its own ask OUT of automatic answering. Carried
      *  onto the approval request as {@link AskRequest.mandated}. */
     mandated?: true;
-    /** The TABLE WORD the {@link mandated} bit stands on — see {@link AskRequest.mandate}. ENGINE-STAMPED at
-     *  the same origin stamp as the bit; a policy's self-declared value is dropped there. */
+    /** The TABLE WORD the {@link mandated} bit stands on — see {@link AskRequest.mandate}. A STAMP member, written at the
+     *  same origin stamp as the bit. */
     mandate?: import("./ask-origin.js").PersistedRuleMandate;
     /** The probe named a directory that would clear this ask
      *  ({@link import("./types.js").ReversibilityVerdict.readRootCandidate}). Display metadata like the two
@@ -464,47 +412,33 @@ export type PermissionResult = {
      *  list) that leaves it unset gets `policy` there, indistinguishable from hesitation. */
     matchedAskRule?: string;
     /** design/252 G-2 (additive): the RULE-PROVENANCE evidence behind this ask — see
-     *  {@link AskRuleEvidence}. ENGINE-STAMPED inside the gate, once, after the org layer and the
-     *  persisted-rule lane have both spoken; a policy that self-declares it is overwritten there
-     *  (the member is a record of what the ENGINE's own governance layers did, so a layer's claim
-     *  about itself is not evidence). Carried onto the approval request by the gate's own ask mint
-     *  site. Display/reconciliation metadata, never adjudication input. */
+     *  {@link AskRuleEvidence}. A STAMP member, written inside the gate once, after the org layer and the
+     *  persisted-rule lane have both spoken (the member is a record of what the ENGINE's own governance layers
+     *  did, so a layer's claim about itself is not evidence). Carried onto the approval request by the gate's own
+     *  ask mint site. Display/reconciliation metadata, never adjudication input. */
     ruleEvidence?: AskRuleEvidence;
     /** design/375 §5.2②: the per-segment coverage table behind this surviving ask — which segments
      *  of a compound an eligible persisted rule already admits, read off the SAME store read that
-     *  adjudicated the call (snapshot = adjudication snapshot). ENGINE-STAMPED at the gate's one
-     *  stamp point whenever the persisted-rule lane reported one (overwriting a policy's claim);
-     *  consumed only by the offer factory, which puts on the batch offer exactly the segments this
-     *  table calls uncovered. Absent ⇒ all segments read as uncovered (over-offer, the safe way).
-     *  Same display-only posture as {@link allowRuleShadowed}: never adjudication input, and a
-     *  value nobody stamps over can only shrink or annotate the card's ADVISORY offers — every
-     *  offered rule still passes the validator at redemption. */
+     *  adjudicated the call (snapshot = adjudication snapshot). A STAMP member, written at the gate's one
+     *  stamp point when the persisted-rule lane reported one; consumed only by the offer factory, which puts on
+     *  the batch offer exactly the segments this table calls uncovered. Absent ⇒ all segments read as uncovered
+     *  (over-offer, the safe way). */
     segmentCoverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
     /** WHICH AUTHORITY raised this ask — one word from the closed {@link import("./ask-origin.js").AskOrigin}
      *  set (org rule / org unavailable / hook / explicit ask rule / the classifier's denial-limit
-     *  fallback / the reserved question tool / a marked call / plain policy). ENGINE-STAMPED inside the
+     *  fallback / the reserved question tool / a marked call / plain policy). A STAMP member, written inside the
      *  gate at the same single stamp point as `ruleEvidence`, derived from what the gate's own layers
-     *  did ({@link import("./ask-origin.js").askOriginOf}) — a policy that self-declares it is overwritten
-     *  there, so the member is never a channel a policy can loosen through. A DISCLOSURE word: the lanes
-     *  read the ask's class set ({@link import("./ask-origin.js").classifyAsk}), an approval surface may
-     *  render the card by it. Optional on the TYPE only because a decision is caller-composable; every ask
-     *  the gate hands to its resolver carries it. */
+     *  did ({@link import("./ask-origin.js").askOriginOf}). A DISCLOSURE word: the lanes read the ask's class set
+     *  ({@link import("./ask-origin.js").classifyAsk}), an approval surface may render the card by it. Optional on the
+     *  TYPE only because the gate writes it after a policy answers; every ask the gate hands to its resolver carries it. */
     origin?: import("./ask-origin.js").AskOrigin;
-    /** The ask's CLASS — the first member of {@link classes} (see {@link AskRequest.askClass}). ENGINE-STAMPED at the
-     *  same single stamp as {@link origin}, from the class set the gate's lanes read; a policy that self-declares it is
-     *  overwritten there, and no lane reads it back (they read the classification itself). */
+    /** The ask's CLASS — the first member of {@link classes} (see {@link AskRequest.askClass}). A STAMP member, written at
+     *  the same single stamp as {@link origin}, from the class set the gate's lanes read; no lane reads it back (they read
+     *  the classification itself). */
     askClass?: import("./ask-origin.js").AskClass;
     /** The ask's whole class set, in {@link import("./ask-origin.js").ASK_CLASSES} order (see
      *  {@link AskRequest.classes}). Stamped beside {@link askClass}, under the same rule. */
     classes?: readonly import("./ask-origin.js").AskClass[];
-    /** WHICH integrity guards stand behind this ask — a removal of a protected location, an unverifiable recursive delete,
-     *  shell text the engine cannot read (or an environment that did not answer the read station), the session-transcript
-     *  write. A set: one ask may stand on several, and each keeps its class. ENGINE-STAMPED by the guard policies and the
-     *  gate fold; a fold-internal fact the class derivation reads ({@link import("./ask-origin.js").classifyAsk}) so the
-     *  guards, which mint the same `requiresRealApproval` ask, are told apart by a fact and not by their prose. Never
-     *  copied onto the approval request or the park row. Replaces the one-word `guard`, which a decision no longer carries:
-     *  a decision that still does is refused by name ({@link RETIRED_DECISION_MEMBERS}). */
-    guards?: readonly AskGuard[];
     /** The call could not be READ against a rule that may reach it — a content-form deny row, a content-form
      *  ask row, a persisted-rule row (the lexer's word), or rows the shell read station's boundary stands on that
      *  could not be read (`persisted_rows`). ENGINE-STAMPED at the four unreadable mint sites;
@@ -518,13 +452,6 @@ export type PermissionResult = {
      *  every ask). Public: a host composing such a policy sets it; {@link combinePolicies} carries it onto the
      *  surviving ask (tighten-only). Not on the approval request — the card shows `origin` / `mandate`. */
     authoredBy?: "deployment";
-    /** The classes of the OTHER asks a policy fold collapsed into this one
-     *  ({@link import("./ask-origin.js").decisionAskClassesOf} per contributing ask, unioned), so a member the
-     *  fold does not copy — a guard mark, an unreadable-rule fact, a bare real-approval bit — is not lost behind
-     *  the ask that won the slot. ENGINE-WRITTEN by {@link combinePolicies}, which attests the list it wrote
-     *  ({@link EngineAttestation.foldedClasses}); the receipt refuses the member unless the decision's record carries that very
-     *  list (a policy's own, an edited list are refused). Fold-internal, never on the request. */
-    foldedAskClasses?: readonly import("./ask-origin.js").AskClass[];
     attestation?: EngineAttestation;
 } | {
     action: "deny";
@@ -766,36 +693,24 @@ export interface ToolPolicyProjection {
     readonly requiresLiveRemainder: boolean;
 }
 /**
- * The entries of a tool-NAME list whose reach is a set of names rather than one name — the covering
- * spellings (`<ns>__<peer>`, `<ns>__<peer>__<glob>`) of ANY protocol namespace, which CC's rule
- * matcher resolves and an exact-membership test silently cannot. Every name-keyed lane in this file
- * consults these ALONGSIDE its exact set: a covering spelling can never equal a minted tool name (`*`
- * is outside the minted charset and a minted name always carries a tool segment), so leaving it in the
- * exact set too costs nothing and keeps the projection/audit faces reporting the operator's own spelling.
+ * The entries of a tool-NAME list whose reach is a set of names rather than one name — the covering spellings
+ * ({@link isCoveringRuleName}): a `*` anywhere in the name on a list that restricts (`Re*d`, `mcp__*`, the lone `*` — every tool),
+ * only in the tool segment after a literal `<ns>__<peer>__` on one that grants, and a protocol peer (`<ns>__<peer>`) on either —
+ * which CC's rule matcher resolves and an exact-membership test silently cannot. Every name-keyed lane in this file consults these
+ * ALONGSIDE its exact set: a covering spelling can never equal a mounted tool name (no mounted name holds a `*`, and a minted name
+ * always carries a tool segment), so leaving it in the exact set too costs nothing and keeps the projection/audit faces reporting
+ * the operator's own spelling. The list is usually empty, which is why every call site tests it before scanning.
  *
- * Namespace-generic on purpose: the covering grammar is a property of the shared `<prefix><peer>__<tool>`
- * name shape, not of MCP, and keying it to one prefix made every sibling-namespace covering rule
- * (`a2a__<peer>__*`) compile clean and match nothing — inert in the deny half, and in an ALLOW list the
- * removal of that peer's whole tool set.
- *
- * The list is usually empty, which is why every call site tests it before scanning.
- *
- * Exported for the OTHER name-keyed lane in this engine — the persisted session/ancestor rules in
- * `session-rule-policy.ts`. Not part of the public API (`src/index.ts` re-exports by name and does not
- * list these two): every publisher of {@link ToolPolicyNameSets} must resolve a covering entry the same
- * way, because the prepare-time audit's exemption for these spellings speaks for ALL published name sets
- * at once — the four in-engine lanes do so by sharing this module's matcher. That premise is NOT
- * structural for an OUT-OF-ENGINE publisher (a host compiling its own settings into an exact-match ask
- * closure is fail-open on these spellings while the audit stays silent) — which is why the underlying
- * judgment predicates (`isNamespacedCoveringRuleName` / `namespacedRuleNameCovers`) ARE exported from
- * the package index: an external lane either compiles through `createPermissionRulePolicy` or
- * self-checks with those.
+ * `behavior` = what the list does with a call it reaches. Exported for the in-engine name-keyed lanes; an OUT-OF-ENGINE publisher
+ * of {@link ToolPolicyNameSets} compiles through `createPermissionRulePolicy` or self-checks with the root-exported predicates
+ * (`isCoveringRuleName` / `ruleNameCovers`) — the prepare-time audit's exemption for these spellings speaks for every published
+ * name set at once, so a lane keying them exactly is fail-open in the "tool runs unasked" direction while the audit stays silent.
  */
-export declare function namespacedCoveringEntries(entries: readonly string[] | undefined): readonly string[];
+export declare function coveringRuleEntries(entries: readonly string[] | undefined, behavior: RuleBehavior): readonly string[];
 /** Does any covering entry reach the call — under ANY name it answers to, the same reading the exact lists take through
  *  `nameListHolds` (a covering entry and an exact entry in one list are one rule: it reaches the call iff its name is on the
- *  list)? See {@link namespacedCoveringEntries}. */
-export declare function namespacedCoveringHit(covering: readonly string[], call: Pick<ToolCallRequest, "toolName" | "face">): boolean;
+ *  list)? See {@link coveringRuleEntries}. */
+export declare function coveringRuleHit(covering: readonly string[], call: Pick<ToolCallRequest, "toolName" | "face">): boolean;
 /**
  * The tool names a projection component is keyed on, and the member that holds them: a `tool_deny` / `tool_allowlist`'s
  * `names`, a `shell_command`'s `tools` (its `deny` / `allow` are command names, not tool names). A frozen chain holds them only
@@ -925,53 +840,12 @@ export declare function constraintChainDigest(chain: readonly ConstraintChainEnt
  *  present one must sit on an arm its row holds. Not re-exported from `src/index.ts`. */
 export type DecisionMember = PermissionResult extends infer U ? (U extends unknown ? keyof U : never) : never;
 export declare const DECISION_MEMBERS: readonly DecisionMember[];
-/**
- * The RECEIPT of a permission decision — the one point at which the engine takes a decision in from whoever composed it,
- * on every lane: each layer of {@link combinePolicies}' fold, the gate's adjudication entry and its approved-edit re-check,
- * the inherited lane's receipts of an ancestor policy's decision, the final-form re-check, the direct `check()` rechecks
- * (the resume edit, the park re-projection, the changed-files probe), and the PreToolUse hook's result seam (its own
- * reach, below). NOT re-exported from `src/index.ts`: an internal screen on inputs the engine receives.
- *
- * WHAT COMES BACK is the engine's own frozen copy, never the caller's object. A decision is caller-supplied data: a
- * stateful accessor, a Proxy, or a policy that keeps and mutates an object it returned could otherwise answer two
- * consumers with two values, and which consumer read which value would decide the call. So the caller's object is read
- * ONCE, here, and every station after the receipt (the fold's ranking, the origin stamp, the classifier's eligibility, the
- * mode arbitration, the approval request, the rewrite that executes) reads the copy; a copy handed to the screen again
- * comes back as it is, unread (so does the engine's own refusal, {@link isEngineRefusal}). In order: (1) the CARRIER's type — a decision that is not an object (a string, a function
- * holding the members) has no `action`; (2) the ONE READ — ONE function ({@link receiveContract}) for the decision and for the
- * records it nests (`receiveNestedRecords`, decision-receipt.ts), on an ORDINARY object (a Proxy, as the carrier or anywhere on its prototype
- * chain, is refused before a trap of its could run): each contract member absent or an own enumerable DATA property, its value
- * taken off the carrier's own descriptor (a member outside the contract is neither read nor carried — a policy's self-declared
- * record on another name finds no reader); any other spelling refused by name — an accessor (never invoked), a member the
- * prototype or a non-enumerable property supplies unless that descriptor spells absence (an `undefined` data value) — judged by
- * descriptor, never read; (3) a retired member ({@link RETIRED_DECISION_MEMBERS}: `reason`, `guard`) carried by the same presence law as a contract
- * member — own, held by an accessor, or supplied by the prototype — judged without a read (ignoring it silently dropped the policy's text or the ask's guard); (4) the VALUES, off the engine's
- * one-read record, never a second read of the caller's object — the retired window absent, `action` in
- * its closed set (`screenContractValues`, decision-receipt.ts — every closed-set member is held to its set there; a consumer ranks a decision by testing two of its words, so any other value used to rank as an
- * allow; a `canUseTool` result outside its set is a failure in CC) and `decisionReason` in {@link DECISION_REASONS} when
- * present (absence stays legal); (5) the DETACH —
- * the contract members' values structured-cloned ({@link tryCloneArgs}; one that cannot be, a function inside a rewrite,
- * is refused), the engine's `attestation` record re-attached by reference after its brand check, the copy frozen and
- * marked as this module's. A refusal is a deny in the screen's words, one code for every arm (`decisionReason: "rule"`),
- * carrying no `updatedInput` from the refused object (a rewrite from an EARLIER, contract-shaped layer still rides out of
- * {@link combinePolicies}' deny path). `null` / `undefined` carry nothing and take the carrier's refusal (the caller's own
- * read of `.action` would throw instead, and that throw was being reported as an aborted check).
- *
- * SCOPE: the receipt runs NONE of the carrier's code — a Proxy (its traps are the caller's code) is refused unread, and on an
- * ordinary object descriptor looks and `Object.getPrototypeOf` invoke nothing. What the receipt does not reach: code inside a
- * member's VALUE, run by the detach itself (an accessor inside a rewrite is invoked by the structured clone, and what it answers
- * there is what is cloned and what runs — one read, consistent) and by a refusal's rendering of a foreign word (`String(v)` on an
- * out-of-set `action`, after the deny is decided). Same-process JavaScript has no trust boundary a function can enforce.
- *
- * `reasonIsNonInput` (the HOOK seam): the same receipt, with the two differences the seam's consumers imply — a hook's
- * `decisionReason` is DISCARDED there (every mint point downstream re-stamps `"hook"`) and so is not held to its set, and a
- * hook result may leave `action` out (no opinion; the policy still adjudicates). `undefined`, `null` and `false` are no
- * opinion (what a hook body yields when it has nothing to say). A refusal the receipt mints at this seam is the ENGINE's
- * decision ({@link isEngineRefusal}) and exits through the engine's fail-closed arm (the deny observer), never as the hook's
- * own deny.
- */
 export declare function refuseOutOfContractDecision(d: PermissionResult, opts?: {
     reasonIsNonInput?: boolean;
+    call?: {
+        readonly toolCallId: string;
+        readonly toolName: string;
+    };
 }): PermissionResult;
 /** The raw tool-name lists a name-keyed policy was built from (audit feed, see block note above). */
 export interface ToolPolicyNameSets {
@@ -996,9 +870,9 @@ export declare function toolPolicyNameSets(p: ToolPolicy | undefined): readonly
  * mode's unstated question; consent is an allow entry (`RunnerDeps.allowedTools` / `TaskSpec.allowedTools`). Without
  * `allow`, everything not in `deny` gets no objection. Each entry is read by the rule
  * syntax (`ruleSpellingOf`): a name, or `Tool()` / `Tool(*)` — the bare `Tool`, as every list reader reads them, once however
- * many spellings write it; any other spelling is not a tool name (`onInvalidName`), and neither is the wildcard `*` (`*`,
- * `*()`, `*(*)`) in `deny`: it names no tool, and the entry would be kept and never match. In `allow` it is one entry no tool
- * carries — the list admits what else it names, and nothing for it.
+ * many spellings write it; any other spelling is not a tool name (`onInvalidName`). A `*` in a name is a glob over the whole
+ * name in `deny` (`Re*d`, `mcp__*`; the lone `*` denies every tool), and in `allow` only in the tool segment after a literal
+ * `<ns>__<peer>__` (`mcp__srv__get_*`) — any other `*` in `allow` names no scope it widens and is not a tool name either.
  * Carries {@link NamedToolPolicy.nameSets} (the names as read) so the host can audit the lists against the mounted
  * pool ([c209-E] advisory); enforcement semantics are unchanged.
  */
@@ -1007,7 +881,7 @@ export declare function createAllowDenyPolicy(opts: {
     deny?: string[];
     /**
      * What to do with an entry that is not a tool NAME: a rule CONTENT form (`Bash(ps:*)`, `Edit(src/**)`), a spelling
-     * the rule syntax reads no tool name in (`" Bash"`, `Bash\t(*)`, `-deploy`), or the wildcard `*` in the deny list.
+     * the rule syntax reads no tool name in (`" Bash"`, `Bash\t(*)`, `-deploy`), or a `*` the allow list does not read (`*`, `Re*d`, `mcp__*`).
      * `"throw"` (default, matching {@link createPermissionRulePolicy}'s posture toward a rule it cannot
      * compile) refuses at construction; `"skip"` drops the entry and reports it. Under BOTH, the entry never
      * silently narrows the allowlist.
@@ -1094,6 +968,13 @@ export declare function createApprovalPolicy(opts: {
  * no longer covers what runs. For a tool whose permission seat is `passthrough` the gate puts the mode's question to a
  * combined allow unless an answer covers the bytes that run ({@link answeredFor}) — the allow layer answers it there.
  *
+ * **A rewrite is judged by every layer that judged earlier bytes.** A layer's `updatedInput` cascades into the layers after
+ * it; the layers BEFORE the latest rewrite judged other bytes, so each is asked once more about the bytes that run, and that
+ * answer is its verdict (a deny there refuses the call; a different form handed back there refuses it too — a rewrite is
+ * judged once, never chased). The latest rewriter is not asked again: its verdict is bound to its own output. An `updatedInput`
+ * that reads as the bytes it was handed is no rewrite; and a layer's rewrite that is a person's edit (its own approver's,
+ * licensed by that person's yes) is not replaced by a later layer — that layer's rewrite refuses the call.
+ *
  * **Idempotency requirement:** because the fold continues past an `ask` to look for a later `deny`, a
  * policy's `check()` can be invoked even after an earlier policy returned `ask`. `check()` MUST be
  * idempotent — repeated calls with the same {@link ToolCallRequest} return the same decision and
@@ -1162,7 +1043,7 @@ export declare function createCoarseCommandNamePolicy(opts: {
     tools?: string[];
 }): ToolPolicy;
 /**
- * CC 220 "Unverifiable Deletion Target" parity (auto-mode rule; its text is in 220–245, gone from 2.1.250 on): ASK on a recursive+forced delete whose
+ * "Unverifiable Deletion Target" (auto-mode rule; since dropped upstream): ASK on a recursive+forced delete whose
  * target is a variable / substitution that cannot be resolved from the command itself — fail-closed in the
  * sense that with no live classifier/approver the ask degrades to deny (see {@link PermissionResult}'s
  * `ask` doc), never to allow. The guard reads ONE plan, the read station's (`removalReadingOf`,
@@ -1176,7 +1057,7 @@ export declare function createCoarseCommandNamePolicy(opts: {
  * RB-341 (2026-07-29) re-checked that citation against the 220 corpus and corrected it in BOTH directions.
  * The RB-203 note claimed the phrase "traces to the 206 bundle; it does not appear anywhere in the 220
  * corpus for THIS rule" — that sentence was wrong and is retracted. The phrase has 8 hits in 220, and two
- * of them are this exact rule's own message text: `pretty220` 461365 (the `rm -rf $UNSET/*`
+ * of them are this exact rule's own message text: (the `rm -rf $UNSET/*`
  * variable-expansion arm, verbatim «e.g. `rm -rf $UNSET/*` becomes `rm -rf /*`. This requires explicit
  * approval and cannot be auto-allowed by permission rules.») and 461444 (its command-substitution twin).
  * Five more are the sibling deterministic `rm`/`rmdir` arms (457337/457364/457379/457387/457402) and one is
@@ -1293,6 +1174,10 @@ export interface AskRequest {
      *  `RiskDescriptor.probeReason`. Neutralized + length-capped by the gate. UNTRUSTED-for-display,
      *  never adjudication input. */
     readonly probeReason?: string;
+    /** Present ⇔ this card puts a person's edit back to them: the restriction chain would not run the edit as written and
+     *  accepts it only as `acceptableForm` — the `args` this card presents. Approving as it stands runs exactly those bytes;
+     *  editing again starts a new pass; a no refuses. Engine-minted; display and outlet only, never adjudication input. */
+    readonly editRewritten?: import("./rewrite-rejudge.js").EditRewritten;
     /** The STRUCTURED cause behind the tighten — a machine-readable code plus the operand
      *  families as arrays with honest totals, so this surface renders its OWN sentence rather than one the
      *  engine had to write before the check's edge cases were known. See
@@ -1319,6 +1204,10 @@ export interface AskRequest {
      *  RECONCILIATION metadata, never adjudication input. */
     readonly ruleEvidence?: AskRuleEvidence;
     toolCallId: string;
+    /** An extension's own call (`$.tool.call`): who asked for it, for the card's line of origin ("extension X wants to run …").
+     *  A display fact — the ask is the run's, put to the run's approver and judged exactly as a model's call is; absent for a
+     *  call a model message carried. Minted by the engine at the ask's mint; never adjudication input. */
+    readonly requestedBy?: import("./task-event.js").ExtensionRequester;
     /** The (post-rewrite) args the tool would run with. */
     args: unknown;
     /** the tool's approval display projection of {@link args} (AgentTool.approvalPreview),