@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/gate-fold.js

@@ -2,6 +2,8 @@ import { inlineUntrusted } from "./untrusted-text.js";
 import { markTightenMessage } from "./safety-axis-vocab.js";
 import { PROBE_REASON_MAX, normalizeProbeCause } from "./checkpoint-store.js";
 import { normalizeReadRootCandidate } from "./read-root-candidate.js";
+import { engineFailClosedExit, hookDenyExit } from "./runner/gate-exit.js";
+import { readRejudge, screenRewrite } from "./rewrite-rejudge.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
 import { writeProtectionMandated, writeProtectionTightenDecision } from "./write-protect.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, gateWaitFailureOf, withGateTimeout } from "./gate-bounded-await.js";
@@ -26,7 +28,7 @@ export async function runGateFold(pass) {
     catch (error) {
         unread = { error };
     }
-    pass.decision = unread !== undefined ? failedJudgmentDeny(unread.error, callSignal ?? input.abortSignal, (e) => traceHookCrash(input, e, notifier), "the call's target reading", { toolName, toolCallId }) : adjudicate ? refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(pass.req, callSignal) : adjudicate(pass.req))) : { action: "allow" };
+    pass.decision = unread !== undefined ? failedJudgmentDeny(unread.error, callSignal ?? input.abortSignal, (e) => traceHookCrash(input, e, notifier), "the call's target reading", { toolName, toolCallId }) : adjudicate ? refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(pass.req, callSignal) : adjudicate(pass.req)), { call: pass.req }) : { action: "allow" };
     {
         const read = ledger.fromDecision(pass.decision);
         pass.decision = read.decision;
@@ -38,6 +40,18 @@ export async function runGateFold(pass) {
         if (attributed !== undefined)
             pass.classifierRound = attributed;
     }
+    const rewritten = pass.screening !== undefined && pass.decision.action !== "deny" ? readRejudge(pass.req, pass.currentInput, pass.decision) : undefined;
+    if (pass.screening !== undefined && rewritten?.kind === "rewritten") {
+        const second = await screenRewrite(pass.screening, pass.req, rewritten.form, `the rewritten call to "${toolName}"`);
+        if (second.kind === "refused") {
+            pass.currentInput = rewritten.form;
+            return second.by === "hook" ? hookDenyExit(pass, second.reason) : await engineFailClosedExit(pass, second.reason);
+        }
+        if (second.answer?.additionalContext)
+            pass.preToolContext.push(second.answer.additionalContext);
+        pass.hookAsk = second.answer?.action === "ask" ? second.answer : undefined;
+        pass.hookAllowedBy = second.answer?.action === "allow" ? (second.answeredBy !== undefined ? [second.answeredBy] : []) : undefined;
+    }
     if ((pass.decision.action === "allow" || pass.decision.action === "ask") && pass.decision.updatedInput !== undefined) {
         pass.policyRewrite = argsAsTheToolReads(pass.req, pass.decision.updatedInput);
     }
@@ -124,7 +138,7 @@ export async function runGateFold(pass) {
         if (tighten) {
             pass.decision = {
                 action: "ask",
-                message: markTightenMessage(toolName, "irreversible"),
+                message: markTightenMessage(toolName, input.irreversibility === "always" ? "irreversible" : "unproven"),
                 decisionReason: "safety",
                 ...(probeReason !== undefined ? { probeReason } : {}),
                 ...(probeCause !== undefined ? { probeCause } : {}),
@@ -219,19 +233,18 @@ function applyShellReadVerdict(pass, answer, toolName, shellGated) {
                 pass.shellReadDetails = verdict.details;
             if (pass.decision.action !== "allow") {
                 if (pass.decision.action === "ask")
-                    pass.decision = { ...withProbeMandate(pass.decision, account), ...silencedBy(verdict, pass.decision) };
+                    pass.decision = silencedBy(withProbeMandate(pass.decision, account), verdict, pass.req);
                 return;
             }
             const candidate = normalizeReadRootCandidate(verdict.readRootCandidate);
-            pass.decision = {
+            pass.decision = silencedBy({
                 action: "ask",
                 message: shellReadAskMessage(toolName, verdict),
                 decisionReason: "safety",
                 probeMandated: true,
-                ...silencedBy(verdict, {}),
                 ...(account !== undefined ? { probeReason: account } : {}),
                 ...(candidate !== undefined ? { probeReadRootCandidate: candidate } : {}),
-            };
+            }, verdict, pass.req);
             if (candidate !== undefined)
                 pass.shellReadOffer = true;
             pass.tightenedBy = shellGated ? "shell_gate" : "safety";
@@ -242,17 +255,16 @@ function applyShellReadVerdict(pass, answer, toolName, shellGated) {
             if (verdict.details !== undefined)
                 pass.shellReadDetails = verdict.details;
             if (pass.decision.action === "ask")
-                pass.decision = { ...pass.decision, ...silencedBy(verdict, pass.decision) };
+                pass.decision = silencedBy(pass.decision, verdict, pass.req);
             if (pass.decision.action === "allow") {
                 const candidate = normalizeReadRootCandidate(verdict.readRootCandidate);
-                pass.decision = {
+                pass.decision = silencedBy({
                     action: "ask",
                     message: shellReadAskMessage(toolName, verdict),
                     decisionReason: "safety",
-                    ...silencedBy(verdict, {}),
                     ...(account !== undefined ? { probeReason: account } : {}),
                     ...(candidate !== undefined ? { probeReadRootCandidate: candidate } : {}),
-                };
+                }, verdict, pass.req);
                 if (candidate !== undefined)
                     pass.shellReadOffer = true;
                 pass.tightenedBy = shellGated ? "shell_gate" : "safety";

package/dist/core/gate-lanes.js

@@ -1,22 +1,23 @@
 import { argsAsTheToolReads, withArgsReading } from "./effective-path-target.js";
-import { attest, attestationOf, bindableArgsOf, decisionText, foldHookAsk, mergeAttestation, refusalOf, refuseOutOfContractDecision, withAttestation } from "./tool-policy.js";
+import { attest, attestationOf, bindableArgsOf, decisionText, foldHookAsk, refusalOf, refuseOutOfContractDecision } from "./tool-policy.js";
+import { outletAsk, readRejudge, rewriteChasedSentence, screenRewrite } from "./rewrite-rejudge.js";
 import { arbitrateByMode, classifyAsk, decisionAskClassesOf, dontAskRefusalMessage, fileCommandOptionsSentence, persistedRuleMandateOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
 import { classifierParseFailureDenyMessage, denialLimitFallbackMessage, rungDidNotRule, unarmedWindow } from "./auto-mode.js";
 import { classifierNoRulingArm, settleNoRulingAsk } from "./classifier-unavailable-arm.js";
 import { SETTLEMENT_NOBODY_JUDGED } from "./gate-outcome.js";
 import { inlineUntrusted } from "./untrusted-text.js";
-import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
-import { toolFace } from "./tool-catalog-entries.js";
+import { ASK_USER_QUESTION_TOOL_NAME, isEngineQuestionFace } from "./ask-question.js";
+import { engineMountedAs } from "./tool-catalog-entries.js";
 import { applyPersistedTightening, disclosedRuleSet } from "./persisted-rule-arms.js";
 import { skillAllowDecision, skillRowRefusal } from "./skill-grant.js";
-import { allowRuleShadowOf } from "./allow-entry.js";
+import { allowRuleShadowOf, withAllowRuleShadow } from "./allow-entry.js";
 import { CD_GIT_COMPOUND_SENTENCE, changesDirectoryBeforeGit, readOnlyShellVerdict } from "./read-only-shell.js";
 import { readShellCommand } from "./shell-run-candidates.js";
 import { COMMAND_RULE_TOOL, ruleShapeOf } from "./permission-rule-model.js";
 import { catalogRuleFaceOf, isProtectedWrite } from "./tool-registry.js";
 import { callFaceSeat } from "./tool-roster.js";
-import { heldBy, wireOf } from "./tool-name-readings.js";
-import { asksUnstated, modeAcceptsFileCommand, permissionSeatAt, unstatedAskMessage } from "./mode-policy.js";
+import { wireOf } from "./tool-name-readings.js";
+import { modeAcceptsFileCommand } from "./mode-policy.js";
 import { ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, orgUnreadableClause } from "./permission-rule-org.js";
 import { exitGate, passAskFace, untakenValueExit } from "./runner/gate-exit.js";
 import { readOrgRuleLane, readPersistedRuleLane } from "./rule-lane-reads.js";
@@ -24,11 +25,9 @@ import { traceHookCrash } from "./gate-crash-trace.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, withGateTimeout } from "./gate-bounded-await.js";
 import { readStationAnswer } from "./shell-read-silence.js";
 import { agentIdOf, judgedInputOf, raiseToolCheck } from "./mods/stations.js";
-import { readToolChecks } from "./tool-check-reading.js";
+import { extensionAllowOf, readToolChecks } from "./tool-check-reading.js";
 import { policyThrowLine, reportPolicyThrow } from "./runner/policy-throw.js";
-const QUESTION_TOOL_NAMES = new Set([ASK_USER_QUESTION_TOOL_NAME]);
-const CONTENT_ROUTING_CONTRACTS = new Set(["ask-user-question", "structured-output", "report-blocked"].map((id) => toolFace(id).contract.contractId));
-const routesContent = (f) => f?.engineMounted === true && CONTENT_ROUTING_CONTRACTS.has(f.contractId);
+const routesContent = engineMountedAs(["ask-user-question", "structured-output", "report-blocked"]);
 function parkWith(suspendAsk, parkArgs, carry) {
     return suspendAsk(...parkArgs, carry);
 }
@@ -83,7 +82,8 @@ export async function runGateLanes(pass) {
     });
     const readFaceNow = input.readFace?.();
     const askOriginFacts = (org, lane) => ({
-        contentQuestion: heldBy("lanes.contentQuestionClass", QUESTION_TOOL_NAMES, pass.req),
+        call: { toolCallId: pass.req.toolCallId, toolName: pass.req.toolName },
+        contentQuestion: isEngineQuestionFace(pass.req.face),
         markedUnresolvable: markedUnresolvable(),
         org,
         ...(ruleCallUnreadableOf(lane) ? { ruleCallUnreadable: true } : {}),
@@ -232,7 +232,7 @@ export async function runGateLanes(pass) {
         if (laneAnswer?.unreadable === true)
             personalEvidence = { dotsAbsent: "unavailable" };
         let laneCoverage;
-        const questionTool = wireOf("lanes.allowLayerQuestionSkip", pass.req) === ASK_USER_QUESTION_TOOL_NAME;
+        const questionTool = originFacts.contentQuestion;
         const laneIsProvenance = orgAnswer.org === undefined &&
             pass.decision.action === "ask" &&
             pass.decision.requiresRealApproval !== true &&
@@ -272,7 +272,7 @@ export async function runGateLanes(pass) {
         });
         const storedAllows = laneAnswer?.hit?.behavior === "allow" ? laneAnswer.hit.rules : undefined;
         const members = [
-            ["hook", () => (pass.hookAllowedBy !== undefined && pass.policyRewrite === undefined ? { entries: pass.hookAllowedBy, clear: () => ({ action: "allow", message: "a PreToolUse hook allowed this call", decisionReason: "hook" }), afterClear: async () => undefined } : undefined)],
+            ["hook", () => (pass.hookAllowedBy !== undefined ? { entries: pass.hookAllowedBy, clear: () => extensionAllowOf(pass.hookAllowedBy ?? [], pass.policyRewrite), afterClear: async () => undefined } : undefined)],
             ["deployment", () => {
                     const hit = input.deploymentAllows?.allowing(pass.req, mode);
                     return hit && { entries: hit.entries, ...(hit.positions !== undefined ? { positions: hit.positions } : {}), clear: () => listAllow("deployment_rule", "the deployment's", hit.entries), afterClear: () => notifier.notifyAsync(() => input.deploymentAllows?.onAllowed?.({ toolName: pass.req.toolName, toolCallId, entries: hit.entries }), "toolGate.allowedToolsResolved") };
@@ -292,7 +292,15 @@ export async function runGateLanes(pass) {
                     return hit && { entries: hit.entries, ...(hit.positions !== undefined ? { positions: hit.positions } : {}), clear: () => listAllow("request_rule", "this run's", hit.entries), afterClear: () => notifier.notifyAsync(() => input.requestAllows?.onAllowed?.({ toolName: pass.req.toolName, toolCallId, entries: hit.entries }), "toolGate.allowedToolsResolved") };
                 }],
         ];
-        const shadows = [];
+        const clearAs = async (member, hit) => {
+            const cleared = hit.clear();
+            pass.clearedBy = { ...allowRuleShadowOf(member, hit.entries), ...(hit.positions !== undefined ? { positions: hit.positions } : {}) };
+            await hit.afterClear();
+            if (member !== "hook")
+                afterRuleClear();
+            return cleared;
+        };
+        let shadows = [];
         if (!questionTool) {
             for (const [member, match] of members) {
                 if (pass.decision.action !== "ask")
@@ -301,14 +309,10 @@ export async function runGateLanes(pass) {
                 if (hit === undefined)
                     continue;
                 if (allowMayClear()) {
-                    pass.decision = hit.clear();
-                    pass.clearedBy = { ...allowRuleShadowOf(member, hit.entries), ...(hit.positions !== undefined ? { positions: hit.positions } : {}) };
-                    await hit.afterClear();
-                    if (member !== "hook")
-                        afterRuleClear();
+                    pass.decision = await clearAs(member, hit);
                     break;
                 }
-                shadows.push(allowRuleShadowOf(member, hit.entries));
+                shadows = withAllowRuleShadow(shadows, allowRuleShadowOf(member, hit.entries));
                 hit.shadowed?.();
             }
         }
@@ -351,7 +355,7 @@ export async function runGateLanes(pass) {
             if (read?.kind === "denied")
                 refuseByExtension(read.deny);
             else if (read?.kind === "cleared")
-                pass.decision = read.allow;
+                pass.decision = await clearAs("hook", { entries: read.entries, clear: () => read.allow, afterClear: async () => undefined });
             else if (read?.kind === "asked") {
                 const asked = read.minted ? { ...read.ask, ruleEvidence: mintRuleEvidence(personalEvidence) } : read.ask;
                 if (read.marked === true)
@@ -360,7 +364,7 @@ export async function runGateLanes(pass) {
                 pass.decision = stampAskOrigin(asked, facts, classifyStanding(asked, facts));
             }
             else if (read?.kind === "shadowed" && pass.decision.action === "ask")
-                pass.decision = { ...pass.decision, allowRuleShadowed: [...(pass.decision.allowRuleShadowed ?? []), ...read.shadows] };
+                pass.decision = { ...pass.decision, allowRuleShadowed: read.shadows.reduce(withAllowRuleShadow, [...(pass.decision.allowRuleShadowed ?? [])]) };
             else if (read?.kind === "approved")
                 takeApprovedEdit(read);
         }
@@ -417,7 +421,6 @@ export async function runGateLanes(pass) {
         }
         if (input.sandboxAdmission !== undefined &&
             pass.decision.action === "ask" &&
-            wireOf("lanes.sandboxQuestionSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME &&
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true &&
             pass.decision.requiresRealApproval !== true &&
             pass.decision.decisionReason !== "hook" &&
@@ -484,7 +487,7 @@ export async function runGateLanes(pass) {
             if (parked)
                 return parked;
         }
-        if (pass.decision.action === "ask" && wireOf("lanes.contentAskRoute", pass.req) === ASK_USER_QUESTION_TOOL_NAME) {
+        if (pass.decision.action === "ask" && originFacts.contentQuestion) {
             const outcome = input.resolveContentAsk !== undefined ? await (callSignal !== undefined ? input.resolveContentAsk(pass.req, callSignal) : input.resolveContentAsk(pass.req)) : { kind: "unavailable", parkDeclined: false };
             if (outcome.kind === "answered") {
                 pass.decision = { action: "allow" };
@@ -552,7 +555,6 @@ export async function runGateLanes(pass) {
     if (approvedWithArgs && pass.decision.action === "allow" && pass.decision.updatedInput !== undefined) {
         let editArgs = pass.decision.updatedInput;
         let editDenied;
-        let editRewrittenSinceHuman = false;
         let editAnswer = pass.decision;
         let unanswered;
         const refusedAtResolution = (d) => { editDenied = d; pass.deniedBy = "ask_resolution"; };
@@ -575,6 +577,7 @@ export async function runGateLanes(pass) {
                 break;
             }
             let editHookAsk;
+            let rewrittenEdit = false;
             if (screening !== undefined) {
                 const screened = await screening.screen(editArgs, `the approved edit for "${toolName}"`);
                 if (screened.kind === "refused") {
@@ -595,9 +598,10 @@ export async function runGateLanes(pass) {
                         const { updatedInput: _adopted, ...ask } = hr;
                         editHookAsk = ask;
                     }
-                    if (hr.updatedInput !== undefined) {
-                        editArgs = argsAsTheToolReads(pass.req, hr.updatedInput);
-                        editRewrittenSinceHuman = true;
+                    const hookRead = readRejudge(pass.req, editArgs, hr);
+                    if (hookRead.kind === "rewritten") {
+                        editArgs = hookRead.form;
+                        rewrittenEdit = true;
                     }
                 }
             }
@@ -605,7 +609,7 @@ export async function runGateLanes(pass) {
             if (adjudicate) {
                 try {
                     const editReq = Object.freeze({ toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
-                    recheck = refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(editReq, callSignal) : adjudicate(editReq)));
+                    recheck = refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(editReq, callSignal) : adjudicate(editReq)), { call: editReq });
                 }
                 catch (err) {
                     reportPolicyThrow((e) => traceHookCrash(input, e, notifier), "the tool policy's re-check of the approved edit", { toolName, toolCallId }, err, callSignal ?? input.abortSignal);
@@ -628,9 +632,30 @@ export async function runGateLanes(pass) {
                     break;
                 }
             }
-            if (recheck.updatedInput !== undefined) {
-                editArgs = argsAsTheToolReads(pass.req, recheck.updatedInput);
-                editRewrittenSinceHuman = true;
+            const policyRead = recheck.action !== "deny" ? readRejudge(pass.req, editArgs, recheck) : undefined;
+            if (recheck.action !== "deny" && recheck.updatedInput !== undefined) {
+                const { updatedInput: _form, ...verdict } = recheck;
+                recheck = verdict;
+            }
+            if (policyRead?.kind === "rewritten") {
+                if (rewrittenEdit) {
+                    editDenied = { action: "deny", message: rewriteChasedSentence(toolName) };
+                    pass.deniedBy = "policy";
+                    break;
+                }
+                editArgs = policyRead.form;
+                rewrittenEdit = true;
+                const second = screening !== undefined ? await screenRewrite(screening, pass.req, editArgs, `the rewritten edit for "${toolName}"`) : undefined;
+                if (second?.kind === "refused") {
+                    editDenied = { action: "deny", message: second.reason };
+                    pass.deniedBy = "hook";
+                    break;
+                }
+                if (second?.kind === "stands") {
+                    if (second.answer?.additionalContext)
+                        pass.preToolContext.push(second.answer.additionalContext);
+                    editHookAsk = second.answer?.action === "ask" ? second.answer : undefined;
+                }
             }
             const editOrg = await applyOrgLayer(recheck, editArgs);
             recheck = editOrg.decision;
@@ -657,21 +682,17 @@ export async function runGateLanes(pass) {
                 pass.deniedBy = "policy";
                 break;
             }
-            if (recheck.action === "allow") {
-                if (recheck.updatedInput !== undefined) {
-                    editArgs = argsAsTheToolReads(pass.req, recheck.updatedInput);
-                    editRewrittenSinceHuman = true;
-                }
-                const answeredRecheck = withAttestation(recheck, mergeAttestation(pass.req, attestationOf(editAnswer, pass.req), attestationOf(recheck, pass.req), "answer"));
-                if (asksUnstated(answeredRecheck, pass.req, editArgs, permissionSeatAt(input, editArgs)?.seat, input.permissionMode?.())) {
-                    recheck = { action: "ask", message: permissionSeatAt(input, editArgs)?.question ?? unstatedAskMessage(toolName) };
-                    pass.tightenedBy = "unstated";
+            if (rewrittenEdit && input.writeProtectionCheck !== undefined) {
+                const check = input.writeProtectionCheck;
+                const verdict = await awaitWriteProtectionJudgment((deadline) => check(toolName, editArgs, pass.req.face, input.trackedCwd?.(), deadline), boundedAwaitDeadlineMs, callSignal ?? input.abortSignal);
+                if (verdict !== undefined && verdict.kind !== "clear") {
+                    editDenied = { action: "deny", message: verdict.kind === "hit" ? `the approved edit for "${toolName}" was rewritten by the restriction chain onto a write-protected path (table entry "${verdict.hit.name}") that no approval covers — denied fail-closed; re-submit the edited action directly` : `the approved edit for "${toolName}" was rewritten by the restriction chain onto a target whose destination could not be determined (target_unresolved: ${verdict.cause}) — denied fail-closed; re-submit the edited action directly` };
+                    pass.deniedBy = "write_protection";
+                    break;
                 }
             }
-            if (recheck.updatedInput !== undefined) {
-                editArgs = argsAsTheToolReads(pass.req, recheck.updatedInput);
-                editRewrittenSinceHuman = true;
-            }
+            if (rewrittenEdit)
+                recheck = outletAsk(recheck, toolName, editArgs);
             let editFacts;
             const stampEditAsk = (ask) => {
                 const editAskSnapshot = { ...ask, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
@@ -687,7 +708,9 @@ export async function runGateLanes(pass) {
             if (carriedOwnAsk !== undefined) {
                 const { updatedInput: _theOriginalBytes, ...carried } = carriedOwnAsk;
                 const rra = carried.requiresRealApproval === true ? { requiresRealApproval: true } : {};
-                editDecision = stampEditAsk(editDecision.action === "ask" ? { ...editDecision, foldedAskClasses: [...(editDecision.foldedAskClasses ?? []), ...decisionAskClassesOf(carried), ...(carried.classes ?? [])], ...rra } : carried);
+                const call = { toolCallId, toolName };
+                const folded = new Set([...(editDecision.action === "ask" ? (attestationOf(editDecision, call)?.foldedClasses ?? []) : []), ...decisionAskClassesOf(carried, call), ...(carried.classes ?? [])]);
+                editDecision = stampEditAsk(editDecision.action === "ask" ? attest({ ...editDecision, ...rra }, call, { foldedClasses: [...folded] }) : carried);
                 carriedOwnAsk = undefined;
             }
             const editRead = await checkTool(editDecision, editArgs, editOrg.org, undefined);
@@ -700,7 +723,6 @@ export async function runGateLanes(pass) {
                 carriedOwnAsk = editRead.outstanding ?? (editDecision.action === "ask" ? editDecision : undefined);
                 editArgs = editRead.allow.updatedInput;
                 editAnswer = editRead.allow;
-                editRewrittenSinceHuman = false;
                 continue;
             }
             if (editRead?.kind === "asked" && editRead.marked === true)
@@ -708,13 +730,13 @@ export async function runGateLanes(pass) {
             if (editRead?.kind === "asked")
                 editDecision = stampEditAsk(editRead.ask);
             else if (editRead?.kind === "shadowed" && editDecision.action === "ask")
-                editDecision = { ...editDecision, allowRuleShadowed: [...(editDecision.allowRuleShadowed ?? []), ...editRead.shadows] };
+                editDecision = { ...editDecision, allowRuleShadowed: editRead.shadows.reduce(withAllowRuleShadow, [...(editDecision.allowRuleShadowed ?? [])]) };
             if (editDecision.action !== "ask")
                 break;
             const editAskDecision = editDecision;
             if (input.permissionMode !== undefined && pass.askClassification !== undefined) {
                 const editVerdict = arbitrateByMode(input.permissionMode(), pass.askClassification, { ...(editAskDecision.origin !== undefined ? { origin: editAskDecision.origin } : {}), ...(editAskDecision.mandate !== undefined ? { mandate: editAskDecision.mandate } : {}) });
-                if (editVerdict.kind === "released") {
+                if (editVerdict.kind === "released" && !rewrittenEdit) {
                     ledger.supersede();
                     pass.arbitration = editVerdict;
                     await notifier.notifyAsync(() => input.onModeReleased?.({ toolName, toolCallId, release: { mode: editVerdict.mode, askClass: editVerdict.askClass, classes: editVerdict.classes, ...(editVerdict.origin !== undefined ? { origin: editVerdict.origin } : {}), ...(editVerdict.mandate !== undefined ? { mandate: editVerdict.mandate } : {}), ...(editVerdict.reason !== undefined ? { reason: editVerdict.reason } : {}) }, ...(pass.shellReadUnestablished === true ? { readUnestablished: true } : {}) }), "toolGate.onModeReleased");
@@ -736,34 +758,21 @@ export async function runGateLanes(pass) {
             const rr = ledger.fromResolved(await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq)), editAskDecision, editAskReq);
             if (rr.action !== "allow") {
                 refusedAtResolution(rr);
+                if (rewrittenEdit)
+                    pass.denyDetails = { editRewritten: { acceptableForm: editArgs } };
                 if (rr.approverUnavailable === true)
                     unanswered = { ask: editAskDecision, req: editAskReq, org: editOrg.org, deny: rr };
                 break;
             }
             if (rr.updatedInput === undefined) {
-                editRewrittenSinceHuman = false;
                 break;
             }
             editArgs = rr.updatedInput;
             editAnswer = rr;
             if (editAskDecision.action === "ask")
                 editAskedOrigin = editAskDecision.origin;
-            editRewrittenSinceHuman = false;
         }
         const rejudged = () => editDenied === undefined || editDenied === unanswered?.deny;
-        if (rejudged() && editRewrittenSinceHuman && input.writeProtectionCheck !== undefined) {
-            const check = input.writeProtectionCheck;
-            const verdict = await awaitWriteProtectionJudgment((deadline) => check(toolName, editArgs, pass.req.face, input.trackedCwd?.(), deadline), boundedAwaitDeadlineMs, callSignal ?? input.abortSignal);
-            if (verdict !== undefined && verdict.kind !== "clear") {
-                editDenied = {
-                    action: "deny",
-                    message: verdict.kind === "hit"
-                        ? `the approved edit for "${toolName}" was rewritten by the restriction chain onto a write-protected path (table entry "${verdict.hit.name}") that no approval covers — denied fail-closed; re-submit the edited action directly`
-                        : `the approved edit for "${toolName}" was rewritten by the restriction chain onto a target whose destination could not be determined (target_unresolved: ${verdict.cause}) — denied fail-closed; re-submit the edited action directly`,
-                };
-                pass.deniedBy = "write_protection";
-            }
-        }
         if (rejudged() && input.shellReadCheck !== undefined) {
             const station = input.shellReadCheck;
             const judged = station.judge(pass.req, editArgs, input.trackedCwd?.(), callSignal ?? input.abortSignal, { seat: "rejudge", toolCallId });

package/dist/core/gate-outcome.d.ts

@@ -10,6 +10,7 @@
 import { type AskClass, type AskOrigin, type AssertAllKeysHandled, type ModeReleaseReason, type PermissionMode, type PersistedRuleMandate } from "./ask-origin.js";
 import { type AutoModeClassifierRound, type AutoModeFallbackCause } from "./auto-mode.js";
 import { type AllowRuleClearance } from "./allow-rule-shadow.js";
+import type { ResolvedOutcome } from "./checkpoint-store.js";
 /**
  * How the wait an ask was in ENDED — the closed set. One word per way a wait can end; the `who` on the
  * record says which party ended it and is fixed BY the word (see {@link Settlement}).
@@ -244,6 +245,18 @@ export declare const SETTLEMENT_NOBODY_JUDGED: {
 };
 /** Compile-time fence: `never` while every settlement kind has a nobody-judged row. */
 export type NobodyJudgedTableCoversEveryKind = AssertAllKeysHandled<Exclude<SettlementKind, keyof typeof SETTLEMENT_NOBODY_JUDGED>>;
+/** Which words of a durable row's winner ({@link ResolvedOutcome.decision}) are the ALLOW direction: a tool approval's `allow`, a plan
+ *  pause's `approve` / `edit`; the others refuse. Total over the winner's words — the fence below refuses a word without a row — so
+ *  invariant I11 compares directions by table lookup. */
+declare const WINNER_DECISION_ALLOWS: {
+    readonly allow: true;
+    readonly approve: true;
+    readonly edit: true;
+    readonly deny: false;
+    readonly reject: false;
+};
+/** Compile-time fence: `never` while every word a winner can hold has a direction row. */
+export type WinnerDecisionTableCoversEveryDecision = AssertAllKeysHandled<Exclude<ResolvedOutcome["decision"], keyof typeof WINNER_DECISION_ALLOWS>>;
 /**
  * WHO REFUSED a call — the layer whose verdict is the deny. The other question a deny raises, "who ASKED",
  * is answered by {@link GateOutcome.origin} (an {@link import("./ask-origin.js").AskOrigin}); the two used
@@ -353,8 +366,8 @@ export type CauseTableCoversEveryDeniedBy = AssertAllKeysHandled<Exclude<DeniedB
  *  handed the question to the approval seat, whose settlement then names the resolution that ask reached.
  *  Additive. Invariant I6 ({@link screenGateOutcome}) screens its shape.
  *
- *  `clearedBy` — the allow layer's account of a call it let run without asking: which member's allow rule cleared the ask
- *  (`hook` / `deployment` / `persisted` / `skill` / `request`) and the entries it stood on, sanitized and capped as a shadow
+ *  `clearedBy` — the allow layer's account of a call it let run without asking: which member cleared the ask (`hook`, an
+ *  extension's `classic.PreToolUse` or `tool.check` allow, / `deployment` / `persisted` / `skill` / `request`) and the entries it stood on, sanitized and capped as a shadow
  *  record is, with `positions` for a list member (the indices of those entries in the list the run received — a host maps them
  *  onto the declaration it sent for this run). Present exactly when an allow member cleared a standing ask and nobody answered
  *  it: absent on a call nothing asked about, a mode's release or acceptance, the read-only arm's, the classifier's or the
@@ -404,7 +417,7 @@ export interface ModeRefusal {
  * payload, the call's `tool_end` frame, and the durable row's resolved outcome. The three faces are the
  * same object graph, so they cannot tell different stories.
  *
- * The three members are orthogonal but bound by four invariants ({@link screenGateOutcome}):
+ * The three members are orthogonal but bound by the invariants ({@link screenGateOutcome}):
  *  I1  `settlement` present ⇔ `origin` present (they describe the same ask);
  *  I2  `disposition.deniedBy === "ask_resolution"` ⇒ `settlement` present and a refusal kind;
  *  I3  `settlement` an approval (a kind {@link SETTLEMENT_IS_REFUSAL} says is not a refusal) ∧
@@ -428,7 +441,11 @@ export interface ModeRefusal {
  *  I9  `disposition.clearedBy` present ⇒ `kind === "allowed"`, no settlement and no release (an allow member cleared the ask
  *      before anyone answered it), `member` one of the allow layer's members, `entries` a list of strings, `omitted` a positive
  *      whole number when present, and `positions` — only on a list member (`request`, `deployment`) — a list of non-negative
- *      whole numbers.
+ *      whole numbers;
+ *  I10 `settlement.when` present ⇒ a finite number (epoch ms — the moment the wait ended is a value a reader can order);
+ *  I11 a winner's `decision` stated beside the record (the caller reads a durable row: `winnerDecision`) ⇒ a word a winner holds,
+ *      and its direction (allow: `allow` / `approve` / `edit`; refusal: `deny` / `reject`) is the direction of the record's
+ *      settlement ({@link SETTLEMENT_IS_REFUSAL}) and of its disposition (`allowed` / `denied`) — one decision, one direction.
  * Nothing here is read out of an ABSENCE: an ordinary allow with no ask is `{ disposition: { kind: "allowed" } }`,
  * a direct policy deny is `{ disposition: { kind: "denied", deniedBy: "policy" } }`, and neither carries a
  * settlement because neither settled one.
@@ -506,7 +523,7 @@ type DenyOnlyMember = Exclude<keyof Extract<GateDisposition, {
 /** Compile-time fence: `never` while the list is exactly the denied arm's own members. */
 export type DenyOnlyMembersAreListed = AssertAllKeysHandled<Exclude<DenyOnlyMember, (typeof DENY_ONLY_MEMBERS)[number]> | Exclude<(typeof DENY_ONLY_MEMBERS)[number], DenyOnlyMember>>;
 /**
- * The one invariant screen for a {@link GateOutcome} (I1–I8 above, plus the closed-set word each member carries). Two readings:
+ * The one invariant screen for a {@link GateOutcome} (I1–I11 above, plus the closed-set word each member carries). Two readings:
  *  - `"archive"` (the default) — a record read back from where it was kept (a replay, a ledger, a durable row): its shape, with
  *    every closed set read as its live members plus {@link RETIRED_MEMBERS}. A record lawful when minted is not a defect later.
  *  - `"producer"` — a record THIS engine is composing or publishing now: the live sets alone, and the engine's release law
@@ -514,10 +531,14 @@ export type DenyOnlyMembersAreListed = AssertAllKeysHandled<Exclude<DenyOnlyMemb
  * The record is read as whatever it holds (`unknown`): a member that is not the shape the type names — `null`, an array, a
  * primitive where a record belongs, an object where a word belongs — is a defect naming its position, never an exception, and
  * every class, reason, origin and mandate word is read wherever the record carries it.
+ * A caller reading a durable row's winner ({@link ResolvedOutcome}) states the winner's `decision` beside the record it carries
+ * (`winnerDecision`, the key present whatever it holds, read as `reading` is read): invariant I11 then reads that word, so the decision and the record it filed
+ * cannot be read as two directions. Without the key there is no winner beside the record and I11 reads nothing.
  * Returns the defects as sentences (an empty list is a clean record); the caller decides the fail-loud form (report + withhold,
  * or refuse), never silently repairs the record. An options value that is not an object, or a reading outside the two, throws.
  */
 export declare function screenGateOutcome(g: unknown, opts?: {
     readonly reading?: "archive" | "producer";
+    readonly winnerDecision?: unknown;
 }): string[];
 export {};

package/dist/core/gate-outcome.js

@@ -75,6 +75,16 @@ export const SETTLEMENT_NOBODY_JUDGED = {
     policy_refused: true,
     task_aborted: false,
 };
+const WINNER_DECISION_ALLOWS = {
+    allow: true,
+    approve: true,
+    edit: true,
+    deny: false,
+    reject: false,
+};
+function isWinnerDecision(v) {
+    return typeof v === "string" && Object.hasOwn(WINNER_DECISION_ALLOWS, v);
+}
 export const DENIED_BY_VALUES = Object.freeze(["policy", "hook", "org", "persisted_rule", "classifier", "compliance", "write_protection", "ask_resolution", "read_boundary", "mode"]);
 const DENIED_BY_SET = new Set(DENIED_BY_VALUES);
 export function isDeniedBy(v) {
@@ -231,6 +241,8 @@ export function screenGateOutcome(g, opts) {
     const party = objectOf(s?.who)?.party;
     if (s !== undefined && !member("settlementParty", party))
         defects.push(outside("settlement.who.party", "settlementParty", party));
+    if (s !== undefined && !(typeof s.when === "number" && Number.isFinite(s.when)))
+        defects.push(`I10: settlement.when ${spelled(s.when)} is not a finite number (epoch ms)`);
     if (record.origin !== undefined && !member("askOrigin", record.origin))
         defects.push(outside("origin", "askOrigin", record.origin));
     if (settled !== (record.origin !== undefined))
@@ -317,6 +329,20 @@ export function screenGateOutcome(g, opts) {
             }
         }
     }
+    if (opts !== undefined && "winnerDecision" in opts) {
+        const decision = opts.winnerDecision;
+        if (!isWinnerDecision(decision))
+            defects.push(`I11: winnerDecision ${spelled(decision)} is none of the words a winner holds (${Object.keys(WINNER_DECISION_ALLOWS).join(", ")})`);
+        else {
+            const allows = WINNER_DECISION_ALLOWS[decision];
+            const says = allows ? "allow" : "refusal";
+            if (kind !== undefined && SETTLEMENT_IS_REFUSAL[kind] === allows)
+                defects.push(`I11: the winner's decision "${decision}" is the ${says} direction but the settlement kind ${kind} ended the wait as ${allows ? "a refusal" : "an approval"}`);
+            const recordAllows = allowed !== undefined ? true : denied !== undefined ? false : undefined;
+            if (recordAllows !== undefined && recordAllows !== allows)
+                defects.push(`I11: the winner's decision "${decision}" is the ${says} direction but the disposition reads ${recordAllows ? "allowed" : "denied"}`);
+        }
+    }
     if (producer)
         defects.push(...releasePolicyDefects(g));
     return defects;

package/dist/core/governance-codes.d.ts

@@ -145,7 +145,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.read_deny_swapped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.path_view_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.credential_not_withheld", "config.cross_boundary_posture_undeclared", "config.cross_boundary_record_unwritten", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "config.session_rules_earlier_grammar", "permission.allowed_tool_not_granted", "mods.registration_refused", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.seat_detached", "advisor.not_attached", "route.credential_origin_mismatch", "route.response_model_mismatch", "route.tool_call_id_folded", "route.finish_reason_unknown", "route.stream_end_ignored", "route.extra_body_reserved_dropped", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "tool_result.media_refused", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable", "permission.entry_mode_clamped"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.read_deny_swapped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.path_view_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "inherit_env.names_withheld", "config.credential_not_withheld", "config.cross_boundary_posture_undeclared", "config.cross_boundary_record_unwritten", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "config.session_rules_earlier_grammar", "permission.allowed_tool_not_granted", "mods.registration_refused", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.seat_detached", "advisor.not_attached", "route.credential_origin_mismatch", "route.response_model_mismatch", "route.tool_call_id_folded", "route.finish_reason_unknown", "route.stream_end_ignored", "route.extra_body_reserved_dropped", "model.capability_downgraded", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "tool_result.media_refused", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable", "permission.entry_mode_clamped"];
 /** A catalogued code (see {@link ENGINE_NOTICE_CODES}); {@link NOTICE_MINTER} says who mints it. NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */
@@ -201,6 +201,7 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "memory.capture_optout_unpersisted": "user";
     readonly "memory.consolidation_withheld": "operator";
     readonly "delegation.ask_unresolvable": "user";
+    readonly "inherit_env.names_withheld": "user";
     readonly "config.autocompact_window_clamped": "operator";
     readonly "config.env_timeout_discarded": "operator";
     readonly "config.materialize_env_discarded": "operator";
@@ -253,6 +254,7 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "route.response_model_mismatch": "operator";
     readonly "route.tool_call_id_folded": "operator";
     readonly "route.extra_body_reserved_dropped": "operator";
+    readonly "model.capability_downgraded": "user";
     readonly "context.tool_turn_repaired": "operator";
     readonly "skills.listing_truncated": "operator";
     readonly "agents.listing_truncated": "operator";
@@ -315,6 +317,7 @@ declare const NOTICE_MINTER_TABLE: {
     readonly "config.peer_admission_out_of_range": "engine";
     readonly "config.peer_lane_unmounted": "engine";
     readonly "config.secret_env_scrubbed": "engine";
+    readonly "inherit_env.names_withheld": "engine";
     readonly "config.credential_not_withheld": "engine";
     readonly "config.cross_boundary_posture_undeclared": "engine";
     readonly "config.cross_boundary_record_unwritten": "engine";
@@ -367,6 +370,7 @@ declare const NOTICE_MINTER_TABLE: {
     readonly "route.finish_reason_unknown": "engine";
     readonly "route.stream_end_ignored": "engine";
     readonly "route.extra_body_reserved_dropped": "engine";
+    readonly "model.capability_downgraded": "engine";
     readonly "context.tool_turn_repaired": "engine";
     readonly "task.user_steer_undrained": "engine";
     readonly "task.user_followup_undrained": "engine";