@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/persisted-rule-arms.js

@@ -1,6 +1,6 @@
-import { attest } from "./tool-policy.js";
+import { attest, attestationOf } from "./tool-policy.js";
 import { callPathFaceOf } from "./permission-rule-model.js";
-import { decisionAskClassesOf } from "./ask-origin.js";
+import { ownAskClassesOf } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export function strongestAnswer(answers) {
     const rank = (a) => (a === undefined ? 0 : "unreadable" in a ? 4 : "behavior" in a ? { deny: 5, ask: 3, allow: 2 }[a.behavior] : 1);
@@ -20,15 +20,13 @@ export function applyPersistedTightening(decision, read, call) {
             ? `this call could not be read against the person's standing deny/ask rules (${read.reason}) — whether one of them forbids it is unknown, so it needs a real approval`
             : "the person's standing permission rules could not be read — whether one of them forbids this call is unknown, so it needs a real approval";
         const unreadableCall = callForm ? { ruleUnreadable: "persisted_call" } : {};
-        const standingFence = decision.action === "ask" && decisionAskClassesOf({ ...decision, foldedAskClasses: undefined }).has("policy_rra")
-            ? { foldedAskClasses: [...(decision.foldedAskClasses ?? []), "policy_rra"] }
-            : {};
-        return {
-            decision: decision.action === "allow"
-                ? { action: "ask", message, decisionReason: "persisted_rule", requiresRealApproval: true, ...unreadableCall, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) }
-                : { ...decision, requiresRealApproval: true, ...unreadableCall, ...standingFence, message: `${decision.message !== undefined ? `${decision.message} ` : ""}(${message})` },
-            tightened: callForm ? "unreadable" : "store_unreadable",
-        };
+        const tightened = callForm ? "unreadable" : "store_unreadable";
+        if (decision.action === "allow") {
+            return { decision: { action: "ask", message, decisionReason: "persisted_rule", requiresRealApproval: true, ...unreadableCall, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) }, tightened };
+        }
+        const record = attestationOf(decision, call);
+        const asked = { ...decision, requiresRealApproval: true, ...unreadableCall, message: `${decision.message !== undefined ? `${decision.message} ` : ""}(${message})` };
+        return { decision: ownAskClassesOf(decision, record).has("policy_rra") ? attest(asked, call, { foldedClasses: [...new Set([...(record?.foldedClasses ?? []), "policy_rra"])] }) : asked, tightened };
     }
     const hit = read?.hit;
     if (hit === undefined || hit.behavior === "allow")
@@ -36,7 +34,7 @@ export function applyPersistedTightening(decision, read, call) {
     const shown = disclosedRuleSet(hit.rules);
     if (hit.behavior === "deny") {
         const denied = { action: "deny", message: `a persisted deny rule (${shown}) refuses this call`, decisionReason: "persisted_rule" };
-        const attested = hit.denial !== undefined && call !== undefined && hit.denial.face === callPathFaceOf(call);
+        const attested = hit.denial !== undefined && hit.denial.face === callPathFaceOf(call);
         return { decision: attested ? attest(denied, call, { pathDenial: hit.denial }) : denied, tightened: "deny" };
     }
     if (decision.action === "deny")

package/dist/core/principal-name.d.ts

@@ -0,0 +1,20 @@
+export declare function principalNameOf(raw: unknown): string | undefined;
+/** What a value offered as THE principal of a task or of a lookup is — read once, here, so no face decides it on its own. */
+export type PrincipalReading = {
+    readonly kind: "name";
+    readonly name: string;
+} | {
+    readonly kind: "absent";
+} | {
+    readonly kind: "invalid";
+    readonly fault: string;
+};
+/**
+ * A principal offered to a face that tolerates having none: `name` (a principal name), `absent` (no principal — `undefined`, and the
+ * empty string, which the task door and the bucket resolvers have always spelled the same), or `invalid` (it was PROVIDED and is not a name). Only absence reaches
+ * the unauthenticated floor, or the declared local owner's bucket; an invalid value is a bad value, refused where a principal is taken
+ * (never read as absence — a caller who appends one invisible character to a principal must not become the machine owner).
+ */
+export declare function readPrincipal(raw: unknown): PrincipalReading;
+/** Why a value is not a principal name, as a clause for a refusal sentence: the kind of string it is, or the type of the value. */
+export declare function principalNameFault(raw: unknown): string;

package/dist/core/principal-name.js

@@ -0,0 +1,22 @@
+const NOT_IN_A_NAME = /[\p{Cc}\p{Zl}\p{Zp}]|(?![\u200c\u200d])\p{Cf}/u;
+const NOT_VISIBLE = /[\s\p{Cf}]+/gu;
+export function principalNameOf(raw) {
+    return typeof raw === "string" && raw.replace(NOT_VISIBLE, "") !== "" && !NOT_IN_A_NAME.test(raw) ? raw : undefined;
+}
+export function readPrincipal(raw) {
+    if (raw === undefined || raw === "")
+        return { kind: "absent" };
+    const name = principalNameOf(raw);
+    return name !== undefined ? { kind: "name", name } : { kind: "invalid", fault: principalNameFault(raw) };
+}
+export function principalNameFault(raw) {
+    if (typeof raw !== "string")
+        return raw === null ? "null" : typeof raw;
+    if (raw === "")
+        return "an empty string";
+    if (raw.trim() === "")
+        return "a blank string";
+    if (raw.replace(NOT_VISIBLE, "") === "")
+        return "a string with no visible character";
+    return "a string holding a control, separator or format character";
+}

package/dist/core/prompt-section-seat.js

@@ -1,16 +1,14 @@
 import { bandOf } from "../prompt-assembly/bands.js";
-import { lockedTextIn, receivePromptData } from "../prompt-assembly/overlay.js";
+import { lockedTextIn } from "../prompt-assembly/overlay.js";
+import { isPlainRecord } from "./mods/kernel/receive.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { egressThrownText, extensionWords } from "./untrusted-egress.js";
 export const DISPOSABLE_PROMPT_SECTIONS = Object.freeze(["core/discovery.mcp-instructions"]);
 const DEFECT_MAX = 600;
 function readAnswer(answer, seat) {
-    if (typeof answer !== "object" || answer === null || Array.isArray(answer))
+    if (!isPlainRecord(answer))
         return `answered ${answer === null ? "null" : Array.isArray(answer) ? "an array" : typeof answer}; prompt.section takes { text: string | null }`;
-    const received = receivePromptData(answer);
-    if ("notData" in received)
-        return `a prompt.section answer is data (plain objects, arrays, strings, booleans); it holds ${received.notData}`;
-    const data = received.value;
+    const data = answer;
     const keys = Object.keys(data);
     const stray = keys.filter((k) => k !== "text");
     if (stray.length > 0)

package/dist/core/protocol-http-auth.d.ts

@@ -10,8 +10,8 @@
  * A declaration that breaks the rule is that peer's defect: the resolver throws inside the peer's own dial,
  * so the peer is skipped with a coded warning and its siblings still mount. The MCP transport binds its
  * endpoint by dialing only the declared URL with redirects not followed (`declaredEndpointFetch`); the A2A
- * peer, whose card may name another endpoint, is bound by {@link assertEndpointBound} and by
- * {@link redirectPolicy}.
+ * peer, whose card may name another endpoint, is bound by {@link assertEndpointBound} and by its follow law (a request carrying
+ * declared headers follows no redirect, {@link carriesDeclaredHeaders}).
  */
 import type { ProtocolId } from "./protocol-table.js";
 /** The per-peer HTTP auth declaration every protocol spec carries in the same two fields. */
@@ -35,10 +35,31 @@ export declare function resolveProtocolHttpHeaders(protocol: ProtocolId, t: Prot
 /** The engine's default request headers under the declared ones: a declared name, in any case, owns that header
  *  (the default of the same name is not sent beside it). */
 export declare function underDeclaredHeaders(defaults: Readonly<Record<string, string>>, declared: Record<string, string> | undefined): Record<string, string>;
-/** Whether a resolved header set carries anything the declaration bound to its endpoints. */
+/**
+ * Every header VALUE one HTTP peer's requests carry, whatever the header's NAME: each string value of the declaration's static
+ * `headers` and the principal the engine sends under `principalHeader`, as declared. The transport knows these; the credential vocabulary
+ * can only guess by name. How an endpoint can print one back — edges dropped, its credentials part, percent-encoded — is derived from
+ * each value by {@link requestEchoSpellings}, once, and nowhere else.
+ * Total: a declaration whose members cannot be read yields what could be read, because it is called on a failure path.
+ */
+export declare function declaredHeaderValues(transport: unknown, principal?: string): readonly string[];
+/**
+ * A peer's error text with what the peer was SENT taken out of it. Both kinds of removal are found on the ORIGINAL text (so no marker is
+ * rescanned and no replacement can disturb what another one reads) and the ranges they take are merged, one marker per merged range: every
+ * occurrence of a declared value in any spelling {@link requestEchoSpellings} derives from it (as declared and as sent, its credentials
+ * part, JSON-escaped with or without `\/`, percent-encoded, form-urlencoded, `+` for a space), in any letter case, longest first, and every `Cookie` / `Set-Cookie` member
+ * whole — a header line to its end, a record member's string, array or object to its close. The two never disarm each other: a declared
+ * value that lies wholly inside a Cookie member's NAME leaves the name (and the member's value is still taken); one that overlaps the name
+ * from outside takes its own range and the member's value goes with it. A declared value that is also an ordinary word or number (`en`, `1`,
+ * `application/json`) goes wherever it occurs in the remote's words, in any case — a legibility cost, never a leak; the failure's closed
+ * fields (code, status, delivery) are not text. A declaration too large for one matcher (tens of thousands of characters, which no header
+ * carries) makes the whole text the marker: the pass never throws and never shows what it could not match. Run BEFORE the credential
+ * vocabulary: that pass rewrites parts of a value, after which the value no longer matches whole.
+ */
+export declare function scrubRequestEcho(text: string, declared: readonly string[]): string;
+/** Whether a resolved header set carries anything the declaration bound to its endpoints — a request that does follows no redirect (the
+ *  next hop is not a declared endpoint; A2A's follow law reads this). */
 export declare function carriesDeclaredHeaders(headers: Record<string, string> | undefined): boolean;
-/** A request carrying declared headers does not follow a redirect (the next hop is not a declared endpoint). */
-export declare function redirectPolicy(headers: Record<string, string> | undefined): "manual" | "follow";
 /**
  * Refuse an endpoint a peer advertised (an A2A card's interface URL) when it lies outside every origin the
  * declaration names and the peer's requests carry declared headers: `config.protocol_endpoint_unbound`.

package/dist/core/protocol-http-auth.js

@@ -1,4 +1,5 @@
-import { credentialHeaderValues, holdOwnCredentialValues } from "./secret-env.js";
+import { authSchemeCredentials, credentialHeaderValues, holdOwnCredentialValues } from "./secret-env.js";
+import { readMember } from "./thrown-value.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export function headerOwnershipCollision(t) {
     const owners = new Map();
@@ -30,12 +31,144 @@ export function underDeclaredHeaders(defaults, declared) {
     const owned = new Set(Object.keys(declared ?? {}).map((k) => k.toLowerCase()));
     return { ...Object.fromEntries(Object.entries(defaults).filter(([k]) => !owned.has(k.toLowerCase()))), ...declared };
 }
+const httpTrimmed = (value) => value.replace(/^[\t\n\r ]+|[\t\n\r ]+$/g, "");
+export function declaredHeaderValues(transport, principal) {
+    const out = new Set();
+    try {
+        const headers = readMember(transport, "headers");
+        if (typeof headers === "object" && headers !== null) {
+            for (const value of Object.values(headers))
+                if (typeof value === "string")
+                    out.add(value);
+        }
+    }
+    catch {
+    }
+    const principalHeader = readMember(transport, "principalHeader");
+    if (typeof principalHeader === "string" && principalHeader !== "" && principal !== undefined)
+        out.add(principal);
+    out.delete("");
+    return [...out];
+}
+function percentEncoded(value) {
+    try {
+        return encodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+const formEncoded = (value) => new URLSearchParams([["v", value]]).toString().slice(2);
+function requestEchoSpellings(value) {
+    const sent = httpTrimmed(value);
+    const rest = authSchemeCredentials(sent);
+    const spellings = new Set();
+    for (const base of rest === undefined ? [value, sent] : [value, sent, rest]) {
+        const json = JSON.stringify(base).slice(1, -1);
+        const component = percentEncoded(base);
+        const form = formEncoded(base);
+        for (const spelling of [base, json, json.replace(/\//g, "\\/"), base.replace(/ /g, "+"), component, component.replace(/%20/g, "+"), form.replace(/\+/g, "%20"), form])
+            spellings.add(spelling);
+    }
+    return [...spellings];
+}
+const ECHO_MARKER = "[redacted]";
+const COOKIE_START = String.raw `(?<![\w-])(?<cookie>(?:[Ss][Ee][Tt]-)?[Cc][Oo][Oo][Kk][Ii][Ee])(?<quote>["']?)[ \t]*:`;
+function stringEnd(text, at) {
+    for (let i = at + 1; i < text.length; i++) {
+        if (text[i] === "\\")
+            i++;
+        else if (text[i] === text[at])
+            return i + 1;
+    }
+    return text.length;
+}
+function structuredEnd(text, at) {
+    const c = text[at];
+    if (c === '"' || c === "'")
+        return stringEnd(text, at);
+    if (c !== "[" && c !== "{") {
+        let i = at;
+        while (i < text.length && !",}]\r\n".includes(text[i]))
+            i++;
+        return i;
+    }
+    let depth = 0;
+    for (let i = at; i < text.length; i++) {
+        const d = text[i];
+        if (d === '"' || d === "'")
+            i = stringEnd(text, i) - 1;
+        else if (d === "[" || d === "{")
+            depth++;
+        else if ((d === "]" || d === "}") && --depth === 0)
+            return i + 1;
+    }
+    return text.length;
+}
+export function scrubRequestEcho(text, declared) {
+    const forms = new Set();
+    for (const value of declared)
+        for (const spelling of requestEchoSpellings(value))
+            forms.add(spelling);
+    forms.delete("");
+    const members = cookieMembers(text);
+    const removed = members.map(([, from, end]) => [from, end]);
+    for (const hit of valueHits(text, [...forms])) {
+        if (!members.some(([name, from]) => hit[0] >= name && hit[1] <= from))
+            removed.push(hit);
+    }
+    if (removed.length === 0)
+        return text;
+    removed.sort((a, b) => a[0] - b[0] || b[1] - a[1]);
+    let out = "";
+    let kept = 0;
+    for (const [start, end] of removed) {
+        if (start < kept) {
+            kept = Math.max(kept, end);
+            continue;
+        }
+        out += text.slice(kept, start) + ECHO_MARKER;
+        kept = end;
+    }
+    return out + text.slice(kept);
+}
+function cookieMembers(text) {
+    const members = [];
+    const pattern = new RegExp(COOKIE_START, "g");
+    for (let m = pattern.exec(text); m !== null; m = pattern.exec(text)) {
+        const structured = m.groups?.quote !== "";
+        let from = pattern.lastIndex;
+        while (from < text.length && (structured ? /\s/ : /[ \t]/).test(text[from]))
+            from++;
+        let end = from;
+        if (structured)
+            end = structuredEnd(text, from);
+        else
+            while (end < text.length && text[end] !== "\r" && text[end] !== "\n")
+                end++;
+        members.push([m.index, from, end]);
+        pattern.lastIndex = end;
+    }
+    return members;
+}
+function valueHits(text, forms) {
+    if (forms.length === 0 || text === "")
+        return [];
+    const alternatives = [...forms].sort((a, b) => b.length - a.length).map((f) => f.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+    const hits = [];
+    try {
+        const pattern = new RegExp(alternatives.join("|"), "gi");
+        for (let m = pattern.exec(text); m !== null; m = pattern.exec(text))
+            hits.push([m.index, pattern.lastIndex]);
+    }
+    catch {
+        return [[0, text.length]];
+    }
+    return hits;
+}
 export function carriesDeclaredHeaders(headers) {
     return headers !== undefined && Object.keys(headers).length > 0;
 }
-export function redirectPolicy(headers) {
-    return carriesDeclaredHeaders(headers) ? "manual" : "follow";
-}
 export function assertEndpointBound(protocol, peer, endpoint, declared, headers) {
     if (!carriesDeclaredHeaders(headers))
         return;

package/dist/core/retired-keys.d.ts

@@ -20,6 +20,14 @@ export declare function retiredKeyOf(bag: object, table: Readonly<Record<string,
  * `RunWorkflowToolDeps`, `TaskSpec`).
  */
 export declare function assertNoRetiredKeys(bag: object, table: Readonly<Record<string, string>>, owner: string): void;
+/** The refusal {@link assertNoRetiredKeys} throws for a hit — the one sentence and code, for a caller that has to read the bag
+ *  itself (to tell a refusal from a member that cannot be read) and must not read it a second time. */
+export declare function retiredKeyRefusal(hit: {
+    key: string;
+    replacement: string;
+}, owner: string): Error & {
+    code: string;
+};
 /** What replaced the `hooks` record, on a deps bag and on a `TaskSpec` alike: one seat name, one sentence, quoted by both
  *  tables (this one and `runner/retired-runner-deps.ts`). The record's callbacks never run, so a deny one carried would pass
  *  unseen — the key is refused by name instead. */
@@ -29,6 +37,14 @@ export declare const RETIRED_HOOKS_REPLACEMENT = "the callback seats are `mods`
  *  (`config.spec_retired_key`), never read as absence: a mode a caller believes it declared must not silently run
  *  as another. */
 export declare const RETIRED_TASK_SPEC_KEYS: Readonly<Record<string, string>>;
+/** The RETIRED `ToolSpec` members — a spec still carrying one is refused by name (`config.deps_retired_key`) where the
+ *  factory reads the spec, never dropped unseen: a description the author wrote for one prompt shape would silently
+ *  never be shown. */
+export declare const RETIRED_TOOL_SPEC_KEYS: Readonly<Record<string, string>>;
+/** The RETIRED {@link import("../engine/llm/types.js").Model} members — a model still carrying one is refused by name
+ *  (`config.deps_retired_key`) at the model door, never read as absence: text a deployment believes it appended would
+ *  silently not reach the model. */
+export declare const RETIRED_MODEL_KEYS: Readonly<Record<string, string>>;
 /** The RETIRED `ToolPolicy` members — a policy still carrying one is refused by name (`config.deps_retired_key`) wherever
  *  the engine reads a policy's members: the intake of the caller's policy (prepare, and a resume before its claim), the
  *  by-name member reader the wrap and the path-rule installation share, and `combinePolicies`. A member the policy no

package/dist/core/retired-keys.js

@@ -18,11 +18,13 @@ export function retiredKeyOf(bag, table) {
 }
 export function assertNoRetiredKeys(bag, table, owner) {
     const hit = retiredKeyOf(bag, table);
-    if (hit === undefined)
-        return;
+    if (hit !== undefined)
+        throw retiredKeyRefusal(hit, owner);
+}
+export function retiredKeyRefusal(hit, owner) {
     const e = new Error(`${owner}.${hit.key} is retired and is not read by this engine — ${hit.replacement}. Refused rather than ignored: a seat that is silently dropped reads to the deployment as wired.`);
     e.code = owner === "TaskSpec" ? "config.spec_retired_key" : "config.deps_retired_key";
-    throw e;
+    return e;
 }
 export const RETIRED_HOOKS_REPLACEMENT = 'the callback seats are `mods` registrations now — register the extension on `RunnerDeps.mods` (a deployment\'s) or `TaskSpec.mods` (a task\'s), hung on the `classic.*` events (`classic.PreToolUse`, `classic.PostToolUse`, `classic.PostToolBatch`, `classic.UserPromptSubmit`, `classic.Stop`, `classic.SubagentStop`, …); a callback that denied is a handler answering `{ action: "deny", message }`';
 export const RETIRED_TASK_SPEC_KEYS = Object.freeze({
@@ -32,6 +34,13 @@ export const RETIRED_TASK_SPEC_KEYS = Object.freeze({
     "attachments.planModeReminder": "the read-only planning posture is stated whenever the leg's mode is `plan` (first turn, every 5 turns, and an exit frame when it ends) — drop the key",
     "skills[].manifest": "a skill's tools are its `allowedTools` / `disallowedTools` now — an allow-rule and a deny-rule source for the run the skill is activated in, never a fence; move `manifest.allowTools` to `allowedTools`. To fence tools write deny rules (or a delegated agent definition's `allowTools`); to fence write paths use session `allowDirs`",
     promptProvider: "a task changes prompt text through overlays: its role text is `systemPrompt` (it replaces the role base `promptRole` selects), its added block `appendSystemPrompt`, the minimal form `promptForm: \"minimal\"`; anything else is a `prompt.compose` registration on the task's own `mods` answering `{ overlays }` (an already-assembled prompt is refused, never passed through)",
+    promptProfile: 'the prompt\'s shape is the `lean_prompt` trait now — write `promptLean: false` for the long (classic) shape, `promptLean: true` (or nothing, on a model that declares `lean_prompt`) for the lean one',
+});
+export const RETIRED_TOOL_SPEC_KEYS = Object.freeze({
+    descriptionClassic: 'a description\'s other forms are `descriptionVariants` now — the long form is `{ id: "classic", traits: { noneOf: ["lean_prompt"] }, text }`, chosen at mount by the run\'s prompt traits',
+});
+export const RETIRED_MODEL_KEYS = Object.freeze({
+    promptGuidance: "a model selects prompt text by its traits now — declare them in `Model.promptTraits` (the reference's capability names, or a deployment's own `x-<namespace>-<name>`); text meant for one model is an overlay (a center artifact's `add` to the `behavior` band, or a `prompt.compose` registration) whose `when.traits.allOf` names that trait",
 });
 export const RETIRED_TOOL_POLICY_KEYS = Object.freeze({
     writeTargetGuard: "the guarded write targets are stated as rows now — `ToolPolicy.writeGuardRows`, an async provider of the one path table's `PathGuardRow`s the leg's ONE write judgment reads for every writer the policy cannot see as a call (the shell's file commands). A wrapper carries it through `wrapToolPolicy`, which reads every member a policy declares",
@@ -40,9 +49,12 @@ export const RETIRED_SHELL_READ_BOUNDARY_KEYS = Object.freeze({
     writeProtectionJudge: 'the station asks ONE write judgment, `ShellReadBoundary.writeTargetJudge`, over the write-protection table and the deployment\'s guarded write rows together — it answers `"protected"`, `"guarded"` or `undefined`, not a boolean',
     writeTargetGuard: 'the deployment\'s guarded write rows join the same one judgment, `ShellReadBoundary.writeTargetJudge` (`"guarded"` for a target a `ToolPolicy.writeGuardRows` row covers) — the boundary has no second write seat',
 });
+const GUARDS_ARE_ENGINE_FINDINGS = "state `requiresRealApproval: true` for a person's confirmation — the integrity guards are the engine's findings, carried on its attestation record (install the engine's guard policy for one)";
 export const RETIRED_DECISION_MEMBERS = Object.freeze({
     reason: 'rename it to "message" (the one text field a decision carries)',
-    guard: 'write `guards: ["<word>"]` instead (the same five words, as a list: one ask may stand on several integrity guards)',
+    guard: GUARDS_ARE_ENGINE_FINDINGS,
+    guards: GUARDS_ARE_ENGINE_FINDINGS,
+    foldedAskClasses: "the classes of the asks a policy fold collapsed ride the engine's attestation record that combinePolicies writes (a spread of its answer keeps the record); a policy does not state them",
 });
 export function assertNoRetiredToolPolicyKeys(policy) {
     if (policy === undefined || policy === null)

package/dist/core/rewrite-rejudge.d.ts

@@ -0,0 +1,60 @@
+import type { PreToolUseResult } from "./hooks.js";
+import type { PermissionResult } from "./tool-policy.js";
+import type { PreToolUseScreening } from "./runner/gate-exit.js";
+/** What a judge did with the bytes it was handed: kept them (`as_is`), or handed back another form. */
+export type RejudgeReading = {
+    readonly kind: "as_is";
+} | {
+    readonly kind: "rewritten";
+    readonly form: unknown;
+};
+/** Do `a` and `b` read as the same bytes for the call `req` — each as the tool reads it? */
+export declare function sameBytes(req: {
+    readonly face?: object | undefined;
+}, a: unknown, b: unknown): boolean;
+/** The one reading of a judge's answer about the bytes it was handed (`given`): its `updatedInput` is a rewrite only when it
+ *  reads as other bytes; the form is returned as the tool reads it. */
+export declare function readRejudge(req: {
+    readonly face?: object | undefined;
+}, given: unknown, answer: {
+    readonly updatedInput?: unknown;
+} | undefined): RejudgeReading;
+/** What the PreToolUse screening said on its one second look at bytes rewritten after it judged: its verdict on them
+ *  (`stands` — no opinion, an allow, an ask; never a rewrite), or a refusal — the hook's own deny, or the engine's
+ *  (the screening failed, or it handed back yet another form). */
+export type ScreeningRejudge = {
+    readonly kind: "stands";
+    readonly answer: PreToolUseResult | undefined;
+    readonly answeredBy?: string;
+} | {
+    readonly kind: "refused";
+    readonly reason: string;
+    readonly by: "hook" | "engine";
+};
+/** The screening's second look at rewritten `bytes` (the gate's fold after a policy rewrite; the approved-edit pass). */
+export declare function screenRewrite(screening: PreToolUseScreening, req: {
+    readonly face?: object | undefined;
+    readonly toolName: string;
+}, bytes: unknown, subject: string): Promise<ScreeningRejudge>;
+/**
+ * A person's edit the restriction chain accepts only in another form: that form, as the tool reads it. Machine-readable, so
+ * a surface can offer "approve this form" — approving it as it stands runs exactly these bytes (they are the chain's own
+ * answer, so re-judging them changes nothing). Present on the approval request of the question that puts the form to the person,
+ * on a durable resume's refusal (`detail.editRewritten`), and on a refusal's details where nobody is left to ask.
+ */
+export interface EditRewritten {
+    readonly acceptableForm: unknown;
+}
+/** The question that puts a person's edit back to them, over the pass's standing verdict on the form: an allow becomes
+ *  this question; an ask keeps its own words after the outlet sentence (and every member it carries). It goes to the
+ *  approver whose edit it answers; its classes are the pass's, read by the one ladder like any of its questions. */
+export declare function outletAsk(standing: Exclude<PermissionResult, {
+    action: "deny";
+}>, toolName: string, form: unknown): Extract<PermissionResult, {
+    action: "ask";
+}>;
+/** The one sentence of a person's edit that a judge accepts only rewritten; each lane adds its outlet (approve the form shown /
+ *  decide again with it / re-issue the call). */
+export declare function editRewrittenSentence(toolName: string): string;
+/** The one sentence of a rewrite a judge would rewrite again on its one second look. */
+export declare function rewriteChasedSentence(toolName: string): string;

package/dist/core/rewrite-rejudge.js

@@ -0,0 +1,36 @@
+import { canonicalize } from "./canonical-json.js";
+import { argsAsTheToolReads } from "./effective-path-target.js";
+export function sameBytes(req, a, b) {
+    return a === b || canonicalize(argsAsTheToolReads(req, a)) === canonicalize(argsAsTheToolReads(req, b));
+}
+export function readRejudge(req, given, answer) {
+    const rewrite = answer?.updatedInput;
+    return rewrite === undefined || sameBytes(req, given, rewrite) ? { kind: "as_is" } : { kind: "rewritten", form: argsAsTheToolReads(req, rewrite) };
+}
+export async function screenRewrite(screening, req, bytes, subject) {
+    const screened = await screening.screen(bytes, subject);
+    if (screened.kind === "refused")
+        return { kind: "refused", reason: screened.reason, by: "engine" };
+    const r = screened.answer;
+    if (r?.action === "deny")
+        return { kind: "refused", reason: screening.deniedReason(r), by: "hook" };
+    if (readRejudge(req, bytes, r).kind === "rewritten")
+        return { kind: "refused", reason: rewriteChasedSentence(req.toolName), by: "engine" };
+    if (r === undefined)
+        return { kind: "stands", answer: undefined, ...(screened.answeredBy !== undefined ? { answeredBy: screened.answeredBy } : {}) };
+    const { updatedInput: _sameBytes, ...answer } = r;
+    return { kind: "stands", answer, ...(screened.answeredBy !== undefined ? { answeredBy: screened.answeredBy } : {}) };
+}
+export function outletAsk(standing, toolName, form) {
+    const editRewritten = { acceptableForm: form };
+    const sentence = `${editRewrittenSentence(toolName)}, shown here — approve that form as it stands, or edit again`;
+    if (standing.action === "allow")
+        return { action: "ask", message: sentence, editRewritten };
+    return { ...standing, message: standing.message !== undefined ? `${sentence}\n${standing.message}` : sentence, editRewritten };
+}
+export function editRewrittenSentence(toolName) {
+    return `the edit to "${toolName}" was not run as written: the restriction chain accepts it only in a rewritten form (acceptableForm)`;
+}
+export function rewriteChasedSentence(toolName) {
+    return `the arguments of "${toolName}" were rewritten, and a judge that saw them before the rewrite asks for yet another form — denied fail-closed (a rewrite is judged once, never chased)`;
+}

package/dist/core/roles.d.ts

@@ -1,5 +1,7 @@
 import type { ThinkingLevel } from "../internal/harness-types.js";
 import type { Model } from "../internal/llm.js";
+import type { HostRole } from "../prompt-assembly/catalog/schema.js";
+import { type RoleBaseDeclaration } from "../prompt-assembly/role-base.js";
 import { type ModelRef, type ModelRole, type ModelRoles, type RoleSpec } from "./types.js";
 export type { ModelRole, RoleSpec, ModelRoles } from "./types.js";
 export { MODEL_ROLES } from "./types.js";
@@ -106,6 +108,16 @@ export declare const ROLE_TIER_DEFAULTS: Readonly<Partial<Record<ModelRole, stri
  * preset-only role does not disable the relative pick. One reader, the same parts {@link specParts} reads.
  */
 export declare function roleSpecNamesModel(spec: RoleSpec | undefined): boolean;
+/** Merge two role maps, field-aware per role (task `over` wins). Every key and every value of both maps is judged first: a value that is no binding
+ *  (`null`, a number, a boolean, a word the catalog does not hold) is refused at its own seat before the merge reads it (the merge would otherwise read a
+ *  number as a record, or let a task's bad value vanish into the base); a list or a function written at a role seat still reads as an empty record (#2223 ⑦). */
+/**
+ * One role map's door — every key a role word, every entry a binding whose parts are each in their domain (its role word
+ * included) and whose named model has a binding's shape. `field` names the map (`RunnerDeps.roles` / `TaskSpec.roles`).
+ * Every entry is judged, read or not: a resume's screen calls it before the claim, and the merge below calls it on both
+ * maps, so an entry no task of this leg selects still refuses loudly.
+ */
+export declare function screenRoleMap(roles: ModelRoles | undefined, field: "RunnerDeps.roles" | "TaskSpec.roles"): void;
 export interface ResolvedRole {
     model: Model;
     /**
@@ -123,9 +135,24 @@ export interface ResolvedRole {
     modelRef: ModelRef;
     /** The effective thinking level: explicit `spec.thinking` wins, else the role's default. */
     thinking?: ThinkingLevel;
-    /** The requested role's preset system prompt, if it set one (independent of model fallback). */
+    /** The requested role's role-base statement, if it made one (independent of model fallback): its word (the host role
+     *  and the catalog variant it selects) and its text (which replaces that base) — the second source of the role-base
+     *  decision, after the task's own (`src/prompt-assembly/role-base.ts`). */
+    promptRole?: HostRole;
     systemPrompt?: string;
 }
+/**
+ * The requested role's role-base statement as the task path reads it — the chain-head role over the merged maps, its
+ * word and its text whole (the role-base decision's second source, `src/prompt-assembly/role-base.ts`); `undefined` ⇒
+ * the preset names none. For a station that must write the preset onto a child's own seat before prepare (the
+ * workflow lane's persona frame) — it reads exactly what prepare will, and refuses what prepare would.
+ */
+export declare function presetRoleBaseOf(spec: {
+    modelRole?: ModelRole;
+    roles?: ModelRoles;
+}, deps: {
+    roles?: ModelRoles;
+}): RoleBaseDeclaration | undefined;
 /**
  * Resolve the model (and default thinking) for a task. Explicit `spec.model` wins; otherwise walk the
  * `modelRole`'s fallback chain over the merged roles (task overrides runner) and use the first role