@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/runner/image.d.ts

@@ -1,22 +1,12 @@
 import type { ImageContent } from "../../internal/llm.js";
+import { type HostFloor } from "../host-floor.js";
 import type { ImageInput } from "../types.js";
 /**
- * Block obviously-internal hosts (loopback / private ranges / link-local incl. cloud metadata / CGNAT / IPv6
- * ULA, site-local, unspecified, IPv4-mapped, NAT64). Classifies with `net.isIP` rather than a string-prefix
- * regex — the old regex both UNDER-matched (IPv4-mapped `::ffff:`, NAT64, CGNAT 100.64/10, `::`) and
- * OVER-matched (any DNS name starting `fc`/`fd`, e.g. `fdpartners.com`). Numeric IPv4 forms (decimal/octal/hex)
- * are normalized to dotted-decimal by `URL` before this is called, so they're already covered.
- * Note: this checks the LITERAL host; it does NOT resolve DNS, so a hostname resolving to a private IP is not
- * caught here (documented limitation — a deployment needing that supplies its own resolve-and-pin guard).
+ * The guard of a remote image URL: https only, then the one egress hop judge with the private-network floor (`hopRefusal`,
+ * host-floor.ts) — the deployment's host floor (`RunnerDeps.hostFloor`, `floor`) must admit the host, and a private host is
+ * reachable only when the floor's `only` list names it — so an end-user-supplied `images[].url` can't make the server fetch
+ * `169.254.169.254` or a private box. The host is read literally (no DNS resolution). Throws on a refused URL.
  */
-export declare function isPrivateHost(host: string): boolean;
-/**
- * Default SSRF guard for a remote image URL: https only, and no internal/reserved hosts (so an
- * end-user-supplied `images[].url` can't make the server fetch `169.254.169.254` or a private box).
- * Note: this checks the URL host literally — it does not resolve DNS, so a hostname that resolves to
- * a private IP is not caught here; a deployment needing that should supply `RunnerDeps.allowImageUrl`
- * (e.g. a CDN allowlist or a resolve-and-pin check). Throws on a disallowed URL.
- */
-export declare function defaultImageUrlGuard(raw: string): void;
+export declare function defaultImageUrlGuard(raw: string, floor?: HostFloor): void;
 /** Resolve an {@link ImageInput} (inline base64 or a URL to fetch) into a vendored `ImageContent` block. */
-export declare function toImageContent(img: ImageInput, allowUrl?: (url: string) => boolean): Promise<ImageContent>;
+export declare function toImageContent(img: ImageInput, floor: HostFloor | undefined): Promise<ImageContent>;

package/dist/core/runner/image.js

@@ -1,55 +1,10 @@
-import { isIP } from "node:net";
+import { hopRefusal } from "../host-floor.js";
 import { ADMITTED_IMAGE_MIME_TYPES, imageMagicMatches } from "../image-admission.js";
 import { admitInlineImage } from "./inline-image.js";
 function sniffImageMime(bytes) {
     return ADMITTED_IMAGE_MIME_TYPES.find((mime) => imageMagicMatches(bytes, mime));
 }
-function isPrivateV4(ip) {
-    const o = ip.split(".").map(Number);
-    if (o.length !== 4 || o.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
-        return true;
-    const [a, b] = o;
-    return (a === 127 ||
-        a === 10 ||
-        a === 0 ||
-        (a === 172 && b >= 16 && b <= 31) ||
-        (a === 192 && b === 168) ||
-        (a === 169 && b === 254) ||
-        (a === 100 && b >= 64 && b <= 127));
-}
-function embeddedV4(h) {
-    const fromHex = (hi, lo) => {
-        const a = parseInt(hi, 16), c = parseInt(lo, 16);
-        return `${(a >> 8) & 255}.${a & 255}.${(c >> 8) & 255}.${c & 255}`;
-    };
-    let m = /^(?:::ffff:|64:ff9b::)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(h);
-    if (m)
-        return m[1];
-    m = /^(?:::ffff:|64:ff9b::)([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(h);
-    if (m)
-        return fromHex(m[1], m[2]);
-    return undefined;
-}
-export function isPrivateHost(host) {
-    const h = host
-        .replace(/^\[|\]$/g, "")
-        .replace(/\.+$/, "")
-        .toLowerCase();
-    if (h === "localhost")
-        return true;
-    const fam = isIP(h);
-    if (fam === 0)
-        return false;
-    if (fam === 4)
-        return isPrivateV4(h);
-    const v4 = embeddedV4(h);
-    if (v4)
-        return isPrivateV4(v4);
-    if (h === "::1" || h === "::")
-        return true;
-    return /^fe[89ab]/.test(h) || /^f[cd]/.test(h) || /^fe[c-f]/.test(h);
-}
-export function defaultImageUrlGuard(raw) {
+export function defaultImageUrlGuard(raw, floor) {
     let u;
     try {
         u = new URL(raw);
@@ -60,9 +15,9 @@ export function defaultImageUrlGuard(raw) {
     if (u.protocol !== "https:") {
         throw new Error(`image url must be https (got "${u.protocol}")`);
     }
-    if (isPrivateHost(u.hostname)) {
-        throw new Error(`image url host not allowed (private/reserved): ${u.hostname}`);
-    }
+    const refused = hopRefusal(u, floor, true);
+    if (refused !== undefined)
+        throw new Error(`image url not fetched — ${refused}`);
 }
 const IMAGE_FETCH_TIMEOUT_MS = 30_000;
 const IMAGE_MAX_BYTES = 20 * 1024 * 1024;
@@ -112,17 +67,11 @@ async function fetchImageCapped(url) {
     }
     return { buf, mimeType: sniffed };
 }
-export async function toImageContent(img, allowUrl) {
+export async function toImageContent(img, floor) {
     if ("url" in img) {
-        if (allowUrl) {
-            if (!allowUrl(img.url)) {
-                throw new Error(`image url rejected by policy: ${img.url}`);
-            }
-        }
-        else {
-            defaultImageUrlGuard(img.url);
-        }
-        const { buf, mimeType } = await fetchImageCapped(img.url);
+        const url = img.url;
+        defaultImageUrlGuard(url, floor);
+        const { buf, mimeType } = await fetchImageCapped(url);
         return { type: "image", data: buf.toString("base64"), mimeType };
     }
     return admitInlineImage(img);

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -121,7 +121,7 @@ export interface PermissionRuleLanes {
  *  `onDegraded` receives the snapshot's degraded line ({@link describeUnreadableOrgRows}) on every adjudication over a
  *  snapshot carrying a row this layer cannot read. */
 export declare function orgRuleLane(cfg: {
-    read: (toolCallId: string) => Promise<Pick<EffectivePermissionRules, "org">>;
+    read: (toolCallId: string, judged: unknown) => Promise<Pick<EffectivePermissionRules, "org">>;
     questionToolMounted: boolean;
     questionToolName: string;
     onRevisionDefect: (message: string) => void;
@@ -177,10 +177,10 @@ export declare function createPermissionRuleLanes(cfg: {
     onRevisionDefect: (message: string) => void;
     /** Sink for a judgment against the rows that threw, and for the org lane's degraded-snapshot line. */
     onDisclosure: (message: string) => void;
-    /** The run's one reader of the person's rules: the call's ONE read, pinned, that the read station, the org lane and the
-     *  personal lane all take (the lanes consume a reader; they do not make one). */
+    /** The run's one reader of the person's rules: the call's ONE read of the bytes judged, pinned, that the read station, the
+     *  org lane and the personal lane all take (the lanes consume a reader; they do not make one). */
     rows: {
-        pin(toolCallId: string): Promise<PersonRowsRead>;
+        pin(toolCallId: string, judged?: unknown): Promise<PersonRowsRead>;
     };
     /** The allow layer's auto strip over a stored ALLOW row (true ⇒ out of this call's table BEFORE the coverage is chosen). */
     stripsAllow?: (rule: PersistedRule, req: ToolCallRequest) => boolean;

package/dist/core/runner/permission-rule-lanes.js

@@ -1,6 +1,6 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, escapeForDisclosure, faceRowsSpeakFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForHost, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
+import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, eligiblePersisted, escapeForDisclosure, faceRowsSpeakFor, parseRuleText, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForHost, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
 import { callHostTargetOf } from "../host-target.js";
 import { callTargetViewsOf, validatePath } from "../effective-path-target.js";
 import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
@@ -8,6 +8,7 @@ import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
 import { describeUnreadableOrgRows, readOrgRules, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { ownerStoreOf } from "../permission-rule-provider.js";
+import { readPrincipal } from "../principal-name.js";
 import { thrownText } from "../thrown-value.js";
 import { strongestAnswer } from "../persisted-rule-arms.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
@@ -59,7 +60,7 @@ export function orgRuleLane(cfg) {
                 return { status: "available" };
             let resolution;
             try {
-                resolution = (await cfg.read(req.toolCallId)).org;
+                resolution = (await cfg.read(req.toolCallId, req.args)).org;
             }
             catch (err) {
                 return { status: "unavailable", disclosures: [`the permission-rule store threw while resolving the org partition: ${thrownText(err)}`] };
@@ -106,10 +107,10 @@ export function createPermissionRuleLanes(cfg) {
     }
     if (provider === undefined)
         return { personal: undefined, org: undefined };
-    const anonymous = cfg.principal === undefined || cfg.principal === "";
+    const anonymous = readPrincipal(cfg.principal).kind === "absent";
     const reader = cfg.rows;
-    const orgViewOf = async (toolCallId) => {
-        const read = await reader.pin(toolCallId);
+    const orgViewOf = async (toolCallId, judged) => {
+        const read = await reader.pin(toolCallId, judged);
         if (read.org === undefined)
             throw new Error(read.unreadable ?? "the store did not answer");
         return { org: read.org };
@@ -121,14 +122,24 @@ export function createPermissionRuleLanes(cfg) {
         const judged = laneToolNamesOf(req).map((n) => [n, ruleToolGrammarOf(n)]);
         if (!judged.some(([, g]) => g === "path") && faceRowsSpeakFor(callPathFaceOf(req)))
             judged.push([req.toolName, "path"]);
-        const view = await reader.pin(req.toolCallId);
+        const view = await reader.pin(req.toolCallId, req.args);
         if (judged.length === 0)
             return view.unreadable !== undefined ? { unreadable: true } : undefined;
         try {
-            const table = view.rules.filter((r) => r.behavior !== "allow" || cfg.stripsAllow?.(r, req) !== true);
-            const leads = judged.some(([, g]) => g === "path") ? await cfg.leads.resolve(bindPathRules(table.filter((r) => r.match === "path" || r.match === "subpath").map((r) => ({ parsed: r, ruleText: r.rule, rule: r })), (spec) => anchorsOf(spec.rule))) : NO_LEADS;
+            const stripped = view.rules.filter((r) => r.behavior !== "allow" || cfg.stripsAllow?.(r, req) !== true);
+            const judgesPath = judged.some(([, g]) => g === "path");
+            const noRule = [];
+            const table = stripped.filter((r) => {
+                const read = judged.some(([n]) => n === r.tool) || (judgesPath && (r.match === "path" || r.match === "subpath")) ? parseRuleText(r.rule, r.behavior) : undefined;
+                if (read !== undefined && "reject" in read)
+                    noRule.push({ row: r, why: read.reject.message });
+                return read === undefined || !("reject" in read) || r.behavior !== "allow";
+            });
+            const leads = judgesPath ? await cfg.leads.resolve(bindPathRules(table.filter((r) => r.match === "path" || r.match === "subpath").map((r) => ({ parsed: r, ruleText: r.rule, rule: r })), (spec) => anchorsOf(spec.rule))) : NO_LEADS;
             const scopeIdentity = await projectScopeIdentity(table, cfg.rootCanonical, cfg.leads);
-            const answer = strongestAnswer(judged.map(([n, grammar]) => judgeAgainst(table, { ...req, toolName: n }, grammar, leads, scopeIdentity)));
+            const judgedAnswer = strongestAnswer(judged.map(([n, grammar]) => judgeAgainst(table, { ...req, toolName: n }, grammar, leads, scopeIdentity)));
+            const unjudged = noRule.find(({ row }) => (row.behavior === "deny" || row.behavior === "ask") && eligiblePersisted(row, { tool: row.tool, cwd: cfg.root, sessionId: cfg.sessionId, ...(scopeIdentity !== undefined ? { scopeIdentity } : {}) }, row.behavior));
+            const answer = unjudged !== undefined && !(judgedAnswer !== undefined && "behavior" in judgedAnswer && judgedAnswer.behavior === "deny") ? unjudgedRowAnswer(unjudged.row, unjudged.why, req.toolName) : judgedAnswer;
             const stands = answer !== undefined && (("behavior" in answer && answer.behavior === "deny") || "unreadable" in answer);
             return view.unreadable !== undefined && !stands ? { unreadable: true } : answer;
         }
@@ -138,6 +149,11 @@ export function createPermissionRuleLanes(cfg) {
             return { unreadable: true, reason: why };
         }
     };
+    const unjudgedRowAnswer = (row, refusal, tool) => {
+        const why = `the stored ${row.behavior} rule ${escapeForDisclosure(row.rule)} is no rule this engine reads (${refusal})`;
+        cfg.onDisclosure(`the persisted rule lane could not judge a ${tool} call against the rows it read — ${why}`);
+        return { unreadable: true, reason: why };
+    };
     const anchorsOf = (rule) => persistedRowAnchors(rule.scope, cfg.chainTop);
     const judgeAgainst = (table, req, grammar, leads, scopeIdentity) => {
         const liveCwd = cfg.liveCwd();
@@ -167,7 +183,7 @@ export function createRuleOffersOf(cfg) {
         const grammar = ruleToolGrammarOf(toolName);
         if (!cfg.laneArmed || (toolName !== PERSISTED_RULE_TOOL && grammar !== "name" && grammar !== "domain"))
             return {};
-        if ((cfg.principal === undefined || cfg.principal === "") && !cfg.localOwnerDeclared)
+        if (readPrincipal(cfg.principal).kind === "absent" && !cfg.localOwnerDeclared)
             return {};
         const tierSeat = seatOf("offer.marks", cfg.irreversibilityTier, call);
         const closedDoor = ruleClearanceOf(ask, {

package/dist/core/runner/person-path-rows.d.ts

@@ -1,12 +1,13 @@
 /**
  * The person's persisted rules as ONE run reads them.
  *
- * ## One read per adjudicated call
+ * ## One read per judgment of a call's bytes
  *
- * A call is judged against ONE read of the store, pinned to its `toolCallId` ({@link PersonPathRows.pin}): whichever of the
- * call's consumers asks first — the read station's judgment, the org layer, the personal rule lane — takes the read, the
- * others are handed the same answer, and the tables the call's tool judges with when it executes are compiled from it
- * ({@link PathTablesFacade.forCall}). A call is an attempt the leg's occurrence table holds; the pin is released when the
+ * A call's bytes are judged against ONE read of the store, pinned to its `toolCallId` ({@link PersonPathRows.pin}): whichever
+ * of the consumers judging those bytes asks first — the read station's judgment, the org layer, the personal rule lane —
+ * takes the read, the others are handed the same answer, and the tables the call's tool judges with when it executes are
+ * compiled from it ({@link PathTablesFacade.forCall}). Judging other bytes of the same call (an approved edit) is another
+ * judgment: it takes a new read, which the call then holds — a rule written while a person decided binds their edit. A call is an attempt the leg's occurrence table holds; the pin is released when the
  * table no longer holds that attempt. A judgment that is no call of the leg (a visibility probe's fixed id, a gate with no
  * leg) keeps nothing: its rule lanes take a read of their own, its read station the run's latest tables.
  *
@@ -106,10 +107,12 @@ export interface PersonPathRows {
     readonly holdsPersonRows: boolean;
     /** The prepare read — the unit's first write. `undefined`, synchronously, when there is no person's rows to read. */
     prime(): Promise<void> | undefined;
-    /** The rows of a call's one read — a call the leg's occurrence table holds: taken by its first consumer, handed to every
-     *  other until the table no longer holds that attempt; any other judgment (no leg, or an id the table does not hold — a
-     *  visibility probe) takes a read of its own, kept by nobody. Bounded ({@link PERSON_READ_BOUND_MS}); never rejects. */
-    pin(toolCallId: string): Promise<PersonRowsRead>;
+    /** The rows of a call's one read of the bytes it judges (`judged`) — a call the leg's occurrence table holds: taken by its
+     *  first consumer, handed to every other that judges the same bytes (or names none) until the table no longer holds that
+     *  attempt; a judgment of OTHER bytes of the call (an approved edit, its outlet form) takes a new read, which the call then
+     *  holds — a judgment reads the store, as the session rules' does. Any other judgment (no leg, or an id the table does not
+     *  hold — a visibility probe) takes a read of its own, kept by nobody. Bounded ({@link PERSON_READ_BOUND_MS}); never rejects. */
+    pin(toolCallId: string, judged?: unknown): Promise<PersonRowsRead>;
     /** Settles once the tables a reader takes are compiled: a pinned call's own; any other reader's (no id, or a call holding
      *  no pin), the unit's newest — through every change that lands meanwhile, within {@link PATH_TABLES_READY_BOUND_MS} —
      *  or at `signal` or the run's cut ({@link PersonPathRowsConfig.signal}). Never rejects: a reader whose wait was cut

package/dist/core/runner/person-path-rows.js

@@ -1,5 +1,7 @@
 import { ownerStoreOf } from "../permission-rule-provider.js";
+import { readPrincipal } from "../principal-name.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
+import { canonicalize } from "../canonical-json.js";
 import { PATH_RULE_FACES, READ_RULE_TOOL, eligiblePersisted, noticeRuleText } from "../permission-rule-model.js";
 import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
@@ -21,7 +23,7 @@ const COMPILED_TABLES_KEPT = 8;
 export const EMPTY_READ_ROOTS = Object.assign(() => [], { forCall: () => () => [], ready: () => Promise.resolve() });
 export function createPersonPathRows(cfg) {
     const provider = cfg.provider;
-    const anonymous = cfg.principal === undefined || cfg.principal === "";
+    const anonymous = readPrincipal(cfg.principal).kind === "absent";
     const holdsPersonRows = provider !== undefined && provider.partitions.durable && (!anonymous || cfg.localOwnerDeclared);
     const partitions = PARTITIONS.filter((p) => (p === "durable" ? provider?.partitions.durable === true : provider?.partitions.session === true));
     const unit = { durable: { failedSeq: 0 }, session: { failedSeq: 0 } };
@@ -186,20 +188,29 @@ export function createPersonPathRows(cfg) {
         pins.delete(toolCallId);
         return undefined;
     };
-    const enter = (toolCallId, attempt) => {
+    const enter = (toolCallId, attempt, judged) => {
         const rows = readOnce("call").then((read) => (entry.read = read));
-        const entry = { attempt, rows, tables: holdsPersonRows ? rows.then((read) => settleTables(entry, read)) : Promise.resolve(), ...(holdsPersonRows ? {} : { settled: {} }) };
+        const entry = { attempt, rows, tables: holdsPersonRows ? rows.then((read) => settleTables(entry, read)) : Promise.resolve(), ...(holdsPersonRows ? {} : { settled: {} }), ...(judged !== undefined ? { judged: { value: judged } } : {}) };
         pins.set(toolCallId, entry);
         return entry;
     };
-    const pin = (toolCallId) => {
+    const serves = (p, judged) => {
+        if (judged === undefined || p.judged === undefined || p.judged.value === judged)
+            return true;
+        p.judged.canonical ??= canonicalize(p.judged.value);
+        return p.judged.canonical === canonicalize(judged);
+    };
+    const pin = (toolCallId, judged) => {
         for (const id of [...pins.keys()])
             pinOf(id);
         const known = pinOf(toolCallId);
-        if (known !== undefined)
+        if (known !== undefined && serves(known, judged)) {
+            if (judged !== undefined)
+                known.judged ??= { value: judged };
             return known.rows;
+        }
         const attempt = cfg.occurrences?.get(toolCallId);
-        return attempt === undefined ? readOnce("call") : enter(toolCallId, attempt).rows;
+        return attempt === undefined ? readOnce("call") : enter(toolCallId, attempt, judged).rows;
     };
     const settleTables = async (entry, read) => {
         try {
@@ -317,7 +328,7 @@ export function onPinnedRead(rows, stations) {
             const id = callOpts.toolCallId;
             if (readStationMemberOf(call, members) === undefined)
                 return check.judge(call, args, cwd, signal, callOpts);
-            const ready = id !== undefined && rows.holds(id) ? rows.pin(id).then(() => rows.tablesReady(id)) : rows.tablesReady(undefined, signal);
+            const ready = id !== undefined && rows.holds(id) ? rows.pin(id, args).then(() => rows.tablesReady(id)) : rows.tablesReady(undefined, signal);
             return ready.then(() => check.judge(call, args, cwd, signal, callOpts) ?? VOUCHED);
         },
         unanswered: (call, cause) => check.unanswered(call, cause),

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -38,8 +38,8 @@ export interface PrepareAskLaneInput {
     advertisedWritableDirs: Pick<AdvertisedWritableDirs, "roots"> | undefined;
     /** borrowed-readonly — the leg's ONE exempt root, stamped on every request a policy judges (`ToolCallRequest.exemptRoots`). */
     exemptRoots: readonly string[];
-    /** borrowed-readonly — the shared mount roster; read at RUN time by the approval-preview projection (alias-aware
-     *  lookup over whatever the roster holds when the ask is minted). Never mutated here. */
+    /** borrowed-readonly — the shared mount roster; read at RUN time by the approval-preview projection (the dispatcher's
+     *  resolution over whatever the roster holds when the ask is minted). Never mutated here. */
     tools: readonly AgentTool[];
     /** borrowed-mutable — the inherited-unavailable marker set. Writer here: `resolveAskBound` consumes (`delete`) a
      *  marked call at its fail-closed intercept; the policy-chain phase records, the gate station sweeps. */

package/dist/core/runner/prepare-ask-lane.js

@@ -6,9 +6,11 @@ import { exactBoundInputHashOf } from "../canonical-json.js";
 import { composeCallSignal, raceSettlementAgainstSignal } from "./abort-race.js";
 import { failedJudgmentDeny, policyCheckAbortedDeny } from "./policy-throw.js";
 import { askMandateMember } from "../ask-origin.js";
-import { approvalCardMemberOf } from "../tool-roster.js";
+import { approvalCardMemberOf, survivorsByName } from "../tool-roster.js";
+import { toolNameIndex } from "../../internal/llm.js";
 import { gateAskCarry, lateAskSettlementObserver } from "./denial-limit-arms.js";
 import { consumeInheritedAskGrant } from "./inherited-ask-grants.js";
+import { requesterOf } from "../mods/extension-call.js";
 import { settleReadRootGrant } from "./read-root-grant.js";
 function createDenyObserverNotifier(bus, signal) {
     if (bus === undefined || !bus.hasHandlers("classic.PermissionDenied"))
@@ -32,7 +34,7 @@ const sanitizePreview = (node, depth = 0) => {
     return out;
 };
 function resolveApprovalPreview(tools, toolName, args) {
-    const t = tools.find((x) => x.name === toolName || (x.aliases?.includes(toolName) ?? false));
+    const t = toolNameIndex([...survivorsByName(tools).values()])(toolName);
     if (t?.approvalPreview === undefined)
         return {};
     try {
@@ -106,6 +108,7 @@ export function prepareAskLane(input) {
             ...askSourceIdentity(),
             ...riskAxesOf(req),
             ...approvalCardMemberOf(req),
+            ...requesterOf(modBus, req.toolCallId),
             ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(decision.action === "ask" ? askMandateMember(decision) : {}),
             ...(decision.action === "ask" ? gateAskCarry(decision, isLiveApproverSeat(onAsk), autoModeDenialTracking.current) : {}),

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -36,7 +36,7 @@ import type { AssertAllKeysHandled } from "../ask-origin.js";
 import { type ChildClampSource } from "../child-clamp-seats.js";
 import type { InheritedGate, Prepared, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 import { type BlockedRef } from "./synthetic-tools.js";
-import { RosterBuilder, type RosterAxisTables } from "../tool-roster.js";
+import { RosterBuilder } from "../tool-roster.js";
 import type { ParentSpecSeat } from "../parent-spec-seat.js";
 import { type RosterSpec } from "./caller-roster.js";
 export interface PrepareCapsAndWorkflowInput {
@@ -56,7 +56,7 @@ export interface PrepareCapsAndWorkflowInput {
     /** borrowed-readonly — the trusted spawn-side channel; the Workflow mount forwards `rootSessionId`, `placementRoot`,
      *  `onTaskNotification`, `workflowDepth`, the capture-floor getter reads `memoryCaptureAncestors`, and the arming reads
      *  the chain's auto-mode face (`inheritedGate.autoModeFace`). */
-    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume" | "questionFaceStripped" | "inheritedGate"> | undefined;
+    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume" | "holder" | "questionFaceStripped" | "inheritedGate"> | undefined;
     /** borrowed-readonly — the tree's cross-boundary token (inherited or minted), which the Workflow mount hands to its children. */ crossBoundaryTree: import("../cross-boundary-taint.js").CrossBoundaryTreeToken;
     /** borrowed-readonly — the acquired session; the classifier leg rebuilds its transcript window from `buildContext`. */
     session: Pick<StoredSession, "buildContext">;
@@ -78,12 +78,10 @@ export interface PrepareCapsAndWorkflowInput {
     lockedPreflight: Pick<LockedPreflight, "mcp">;
     /** borrowed-mutable — the effect collection (`Prepared.toolEffects`): the safety scan's caller entries, then the mounts' writes. */
     toolEffects: Prepared["toolEffects"];
-    /** borrowed-mutable — the scan's axis tables, so the builder moves an alias's axes with its member (a phase test may omit them). */
-    safetyAxes?: RosterAxisTables;
     /** borrowed-readonly — the frozen tool-face snapshot the Workflow mount forwards (exclude / defer / alwaysLoad / restoreGated). */
     toolFaceSnapshot: ToolFaceSnapshot;
-    /** borrowed-readonly — the resolved prompt profile (the Workflow mount's parentPromptProfile). */
-    promptProfile: ToolExecuteContext["promptProfile"];
+    /** borrowed-readonly — the task-level lean switch (the Workflow mount's parentPromptLean; absent ⇒ no key). */
+    promptLean: ToolExecuteContext["promptLean"];
     /** borrowed-readonly — the resolved interaction posture (the Workflow mount's parentInteractionPosture; absent ⇒ no key). */
     resolvedInteractionPosture: ToolExecuteContext["interactionPosture"];
     /** borrowed-readonly — the harness seat; the Workflow mount's parentModel / parentThinking getters read it call-time. */

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -117,8 +117,8 @@ function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, safetyAxes, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, askSeat, runClampSource, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, delegated, sideCallBookRef } = input;
-    const roster = new RosterBuilder(toolEffects, safetyAxes);
+    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptLean, resolvedInteractionPosture, harnessRef, askSeat, runClampSource, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, delegated, sideCallBookRef } = input;
+    const roster = new RosterBuilder(toolEffects);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
         roster.mount(mounted, { source: callerMountSource(mounted), mountedBy: "scenario" });
@@ -317,7 +317,7 @@ export async function prepareCapsAndWorkflow(input) {
             parentDeferTools: toolFaceSnapshot.defer,
             parentAlwaysLoadTools: toolFaceSnapshot.alwaysLoad,
             ...(toolFaceSnapshot.restoreGated !== undefined ? { parentRestoreGatedTools: toolFaceSnapshot.restoreGated } : {}),
-            parentPromptProfile: promptProfile,
+            ...(promptLean !== undefined ? { parentPromptLean: promptLean } : {}),
             models: deps.models,
             agents: deps.agents,
             builtinAgents: deps.builtinAgents,
@@ -352,6 +352,7 @@ export async function prepareCapsAndWorkflow(input) {
                         return mine.length > 0 ? mine : undefined;
                     } }
                 : {}),
+            ...(internals?.holder !== undefined ? { holder: internals.holder } : {}),
             parentSpecSeat, ...(internals?.questionFaceStripped === true ? { parentQuestionFaceStripped: true } : {}),
             ...(resolvedInteractionPosture !== undefined ? { parentInteractionPosture: resolvedInteractionPosture } : {}),
             parentMemoryCaptureState: () => {

package/dist/core/runner/prepare-config-doors.d.ts

@@ -23,6 +23,7 @@ import type { Model } from "../../internal/llm.js";
 import type { ThinkingLevel } from "../../internal/harness.js";
 import { type MicroCompactMachine } from "../context-edit.js";
 import { type CrossBoundaryPosture } from "../cross-boundary-taint.js";
+import { type HostFloor } from "../host-floor.js";
 import { recordedModeSeed } from "../checkpoint-store.js";
 import { type ConfigDoorEntry, type LockedPreflight } from "../locked-config.js";
 import { type ResolvedRole } from "../roles.js";
@@ -33,10 +34,18 @@ import { type UsageWindow } from "../usage-window-store.js";
 import { type AskSeat } from "../wiring-manifest.js";
 import type { PrepareResume, RunInternals, ToolFaceLists } from "./contracts.js";
 import { resolveHost } from "../../prompt-assembly/select.js";
+import type { PromptTraitName } from "../../prompt-assembly/catalog/schema.js";
 import { type RosterSpec } from "./caller-roster.js";
 export declare function limitConfigError(code: string, message: string): Error & {
     code?: string;
 };
+/**
+ * `TaskSpec.principal`: absent (omitted, or the empty string the engine has always read as no principal) or a principal name. A
+ * principal that was PROVIDED and is no name (white space, an invisible or control character, a non-string) is refused at the task, on
+ * every leg a resume's re-supplied config included — read as "no principal" it would reach the unauthenticated floor, or, on a
+ * deployment that declared local-owner rules, the machine owner's standing approvals.
+ */
+export declare function assertPrincipalValue(raw: unknown): void;
 /**
  * Validate `TaskSpec.limits` at the door and return it unchanged.
  *
@@ -52,8 +61,9 @@ export declare function limitConfigError(code: string, message: string): Error &
  */
 export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskLimits | undefined;
 /**
- * Validate the MODE-VALUED members of `TaskSpec.attachments` at the same door, and return the
- * config unchanged. Today that is exactly one member, `totalTokensReminderMode`.
+ * Validate the members of `TaskSpec.attachments` that refuse a value they cannot read at the same door, and return the
+ * config unchanged. Today that is two: the mode-valued `totalTokensReminderMode` and the boolean switch `mcpUnavailable`
+ * (read by its own reader, `mcpUnavailableOn`, which the leg asks as well).
  *
  * WHY A DOOR AT ALL (坏值响亮度律): a knob whose bad value silently folds to the default is a knob the
  * deployment believes is armed. `totalTokensReminderMode: "padded_countdown"` (underscore) or
@@ -86,36 +96,13 @@ export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskL
  */
 export declare function resolveAttachmentsConfig(attachments: TaskSpec["attachments"]): TaskSpec["attachments"];
 /**
- * R2 双形轴(追加令 2026-07-18): the reference's fable-variant prompt gate (
- * `fable_5_mitigations` capability / claude-mythos-5), ORTHOGONAL to the simple/classic profile.
- * sema is BYOM, so the id may carry provider prefixes ("anthropic/claude-fable-5",
- * "openrouter/anthropic/claude-fable-5"): BOUNDARY-AWARE family match on the last path segment
- * (raw substring classified "vendor/not-claude-fable-5" and "claude-mythos-50"
- * as fable), case-normalized. Recognition set = CC's _Nr (startsWith "claude-fable-") + b9e
- * (mythos-5). R3 system sections fork on the resulting fact.
- */
-export declare function isFableFamilyModelId(id: string): boolean;
-/**
- * The SINGLE decision point for the two prompt-shape axes.
- * Both were resolved in separate places with different mechanisms — `promptProfile` off a TaskSpec field,
- * `fableMitigations` off a raw model-id prefix test — so "which shape does this task speak" had no one
- * place to read. The reference's counterpart is a model-registry `capabilities` array (one table drives
- * `lean_prompt` + `fable_5_mitigations` alike).
- *
- * sema stays BYOM: we cannot key off a capability table for arbitrary model ids, so the RESOLUTION RULES
- * are unchanged — profile: spec > inherited internals > "simple"; mitigations: model family. This is a
- * consolidation, not a behavior change (the axes stay ORTHOGONAL: neither rewrites the other).
+ * The run's prompt traits — the one place prepare forms them: the model's declared set (`Model.promptTraits`, read
+ * through the model door: a retired `promptGuidance` or a name that is no trait refuses the task by name) with the
+ * task's switch on `lean_prompt` (`promptLean`, as the spec writes it — an engine-built child's spec carries its
+ * parent's), bundles expanded ({@link effectiveTraitsOf}). The reference's counterpart is a model registry's capability list; sema is
+ * BYOM, so the model entry carries the list and no model id is read.
  */
-export declare function resolveModelPromptTraits(model: {
-    id: string;
-}, spec: {
-    promptProfile?: "simple" | "classic";
-}, internals?: {
-    promptProfile?: "simple" | "classic";
-}): {
-    promptProfile: "simple" | "classic";
-    fableMitigations: boolean;
-};
+export declare function resolvePromptTraits(model: Model, promptLean: boolean | undefined): ReadonlySet<PromptTraitName>;
 export interface PrepareConfigDoorsInput {
     /** borrowed-readonly — the snapshot spec (its roster is faces). NEVER mutated here: the per-task agents rebind returns a
      *  SHALLOW COPY on {@link PrepareConfigDoorsResult.spec} (only `tools` replaced, each rebuilt entry through the snapshot). */
@@ -130,7 +117,7 @@ export interface PrepareConfigDoorsInput {
     /** borrowed-readonly — presence gates the resumeAt-conflict door and exempts the empty-objective
      *  door (a checkpoint resume passes `objective: ""` by design). */
     resume?: PrepareResume | undefined;
-    /** borrowed-readonly — trusted engine channel: prompt-profile inheritance, the spawning run's
+    /** borrowed-readonly — trusted engine channel: the spawning run's
      *  interaction posture, the engine question-strip flag. */
     internals?: RunInternals | undefined;
 }
@@ -142,8 +129,12 @@ export interface PrepareConfigDoorsResult {
     /** owned — the frozen task-start copies of the caller's tool-face control arrays; the driver compiles the leg's selector
      *  from them, and the selector (with the disclosure lists) is the ONLY thing later face reads consult. Frozen-immutable. */
     toolFaceLists: ToolFaceLists;
-    /** owned — the profile half of the single decision point (model-independent by contract). */
-    promptProfile: "simple" | "classic";
+    /** owned — the task-level switch on the lean shape (`TaskSpec.promptLean`, validated; an engine-built child's spec
+     *  carries its parent's): what the run hands its children and workflow agents, never its effective traits. */
+    promptLean: boolean | undefined;
+    /** owned, frozen-by-contract — the run's effective prompt traits ({@link resolvePromptTraits}): the catalog's
+     *  variants, every overlay's `when.traits` and each tool's description variants select on them. */
+    promptTraits: ReadonlySet<PromptTraitName>;
     /** owned — the host selector values (`TaskSpec.promptRole` / `TaskSpec.promptForm`, validated) the assembly selects on. */
     promptHost: ReturnType<typeof resolveHost>;
     /** owned — the run's binding (`TaskSpec.promptBinding`, validated): the selector value every overlay's `when.binding` reads. */
@@ -170,8 +161,6 @@ export interface PrepareConfigDoorsResult {
     /** owned — the compaction model: explicit wins, else the `summarize` role, else undefined (main
      *  model fallback inside maybeCompact). NOT derivable from {@link resolvedRole}. */
     compModel: Model | undefined;
-    /** owned — the mitigations half of the decision point (model-family fact). */
-    fableMitigations: boolean;
     /** owned, frozen — model-gate DISCLOSURE data (the application itself already
      *  happened on {@link spec}: its `tools` is the survivor rebind when anything was removed).
      *  prepareTask emits the notices from this after the doors return (the onNotice station);
@@ -214,6 +203,7 @@ export interface PrepareConfigDoorsResult {
     /** owned — the screened cross-boundary posture: the deps seat read ONCE, a bad value refused; absent stays `undefined` (undeclared is its own fact). */
     crossBoundaryPosture: CrossBoundaryPosture | undefined;
     advisorTool: "disabled" | undefined;
+    hostFloor: HostFloor | undefined;
 }
 /** The microCompact knob door (坏值响亮度默认律, the sibling knob doors' form:
  *  interactionPosture / toolModelGate / staleToolResultOffload). Placement is load-bearing:
@@ -238,7 +228,7 @@ export declare const checkpointStoreSeat: (spec: {
 export declare function assertResumeConfigRecord(config: unknown): void;
 /** The spec the value doors read: a prepare's (its roster is faces) or a resume's re-supplied config (no objective, no session id). */
 type ValueDoorSpec = Omit<TaskSpec, "tools" | "objective" | "sessionId" | "userAttachments"> & Partial<Pick<TaskSpec, "objective" | "sessionId">>;
-type ConfigValueDoorsResult = Pick<PrepareConfigDoorsResult, "toolFaceLists" | "promptHost" | "promptBinding" | "lockedPreflight" | "microCompactKnob" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "usageWindows" | "brainCallGuardrailMs" | "crossBoundaryPosture" | "advisorTool"> & {
+type ConfigValueDoorsResult = Pick<PrepareConfigDoorsResult, "toolFaceLists" | "promptHost" | "promptBinding" | "lockedPreflight" | "microCompactKnob" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "usageWindows" | "brainCallGuardrailMs" | "crossBoundaryPosture" | "advisorTool" | "promptLean" | "hostFloor"> & {
     skillListingSeats: {
         fraction: unknown;
         maxDescChars: unknown;
@@ -259,6 +249,7 @@ export declare function configValueDoors(input: {
     deps: RunnerDeps;
     resumeLeg: boolean;
     sessions: SessionStore;
+    holder?: string | undefined;
 }, enter?: ConfigDoorEntry): ConfigValueDoorsResult;
 /**
  * The doors a RESUMED leg's prepare refuses at, run as one screen BEFORE the claim — prepare's own functions, so a refusal carries
@@ -273,6 +264,6 @@ export declare function configValueDoors(input: {
  * corrected resume redeems the same token. A throw that is none of prepare's codes leaves as it was thrown. Returns the config the
  * leg is handed: the caller's, its MCP servers and A2A peers the frozen entries the lock layer judged (read once, dialed as judged).
  */
-export declare function refuseResumeDoors<C extends ValueDoorSpec & Pick<TaskSpec, "userAttachments">>(config: C, recordedGate: Parameters<typeof recordedModeSeed>[0], deps: RunnerDeps, sessions: SessionStore): C;
+export declare function refuseResumeDoors<C extends ValueDoorSpec & Pick<TaskSpec, "userAttachments">>(config: C, recordedGate: Parameters<typeof recordedModeSeed>[0], deps: RunnerDeps, sessions: SessionStore, holder?: string): C;
 export declare function prepareConfigDoors(input: PrepareConfigDoorsInput): PrepareConfigDoorsResult;
 export {};