@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/runner/prepare-memory-engine-session.js

@@ -7,7 +7,7 @@ import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { fileArgPath } from "../tool-registry.js";
 import { RosterBuilder } from "../tool-roster.js";
-import { isNotStartedDelegationResult } from "../../agents/subagent.js";
+import { isNotStartedDelegationResult } from "../delegation-not-started.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareMemoryEngineSession(input) {
     const { memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mountedMcp, sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef } = input;

package/dist/core/runner/prepare-park-ask.js

@@ -2,7 +2,7 @@ import { callTargetReadingOf } from "../effective-path-target.js";
 import { approvalTargetsOf } from "../approval-object.js";
 import { uuidv7 } from "../../engine/session/uuid.js";
 import { Value } from "typebox/value";
-import { classifyQuestionOutcome, validateAskQuestions } from "../ask-question.js";
+import { classifyQuestionOutcome, isEngineQuestionFace, validateAskQuestions } from "../ask-question.js";
 import { hasBackgroundShell, sweepBackgroundShells, sweepRunBoundaryBackgroundShells } from "../background-shell.js";
 import { boundInputHashOf, exactBoundInputHashOf } from "../canonical-json.js";
 import { buildRiskDescriptor, debitLedger, encodeAtFidelity, mintCheckpointId, mintCheckpointToken, resolveDeclaredFidelity, } from "../checkpoint-store.js";
@@ -17,7 +17,7 @@ import { raceAbort, raceSettlementAgainstSignal } from "./abort-race.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { DEFAULT_UNATTENDED_APPROVAL_TTL_MS, publishCommittedSuspend, sanitizedTtlMs } from "./park-commit.js";
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
-import { approvalCardMemberOf, callFaceSeat, engineCardOf, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
+import { approvalCardMemberOf, callFaceSeat, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
 import { seatOf } from "../tool-name-readings.js";
 class ParkRefusal extends Error {
     constructor(message, options) {
@@ -112,7 +112,7 @@ export function prepareParkAsk(input) {
     };
     const suspendAsk = parkLaneArmed && checkpointStore !== undefined
         ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, allowRuleShadowed, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated, carry) => {
-            const contentAsk = engineCardOf(req) === "question";
+            const contentAsk = isEngineQuestionFace(req.face);
             const syncFirstEligible = contentAsk ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
             if (syncFirstEligible &&
                 runtimeCaps?.forceDurableGate !== true &&
@@ -179,7 +179,7 @@ export function prepareParkAsk(input) {
                         return undefined;
                     if (reprojectedRaced.tag === "threw")
                         throw reprojectedRaced.error;
-                    const reprojected = refuseOutOfContractDecision(reprojectedRaced.value);
+                    const reprojected = refuseOutOfContractDecision(reprojectedRaced.value, { call: req });
                     const filedAsHeld = ownArgs(parkedArgs);
                     const rewroteTheFiledValue = reprojected.updatedInput !== undefined && !(filedAsHeld.ok && samePlainValue(reprojected.updatedInput, filedAsHeld.value));
                     if (reprojected.action === "deny" || rewroteTheFiledValue) {
@@ -188,7 +188,7 @@ export function prepareParkAsk(input) {
                             `refusing to file a row whose executable form nothing adjudicated`);
                     }
                     if (reprojected.action === "ask")
-                        storedShapeFacts = ownedClearanceFacts(reprojected);
+                        storedShapeFacts = ownedClearanceFacts(reprojected, req);
                 }
                 const rowRealApproval = realApproval ?? (storedShapeFacts?.requiresRealApproval === true ? { origin: carry?.origin ?? wordlessDemand(req.toolName) } : undefined);
                 if (offloadStore && isVolatileOffloadStore(offloadStore) && !offloadStore.isEmpty()) {

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -6,8 +6,8 @@
  * inherited-unavailable marker channel, the grant record, the sandbox-admission mode's arming and its three
  * sideband maps, the source-identity and risk-axes factories, the two permission-rule lanes and the rule-offer
  * factory, the approved-edit re-check, the inherited-constraint wrappers (the same-instance adapter and the true
- * wrapper), the rewrite-emitter index and the instrumented chain, the integrity guards, the fold, and the final-form
- * re-check that is the effective policy. The advised-names dedupe pair only this section reads moved with it.
+ * wrapper), the instrumented chain, the integrity guards, the fold, and the same-instance arbitration refresh that is the
+ * effective policy. The advised-names dedupe pair only this section reads moved with it.
  * The interface is the dependency list the segment had implicitly.
  *
  * ASYNC PHASE: the stretch awaits the session-policy store (the task's own rules and each ancestor's live re-read)
@@ -42,7 +42,10 @@ import { type ModeGateSeats, type PermissionModeController } from "../mode-polic
 import { type InheritedAskGrant } from "./inherited-ask-grants.js";
 import { createRuleOffersOf, type PermissionRuleLanes } from "./permission-rule-lanes.js";
 import type { ToolCallLike } from "../tool-registry.js";
+import { type HostFloor } from "../host-floor.js";
 export interface PreparePolicyChainInput {
+    /** borrowed-readonly — the deployment's host floor as the config doors compiled it: the leading narrowing layer when declared. */
+    hostFloor: HostFloor | undefined;
     /** borrowed-readonly — the REBOUND spec. Read: `sessionId` / `principal` (the session-rule read and the lanes' identity),
      *  `durableApproval` / `checkpointStore` (the mandate-park facility test and the sandbox arming's park prerequisites), `taskId` (the late-ask observer's detail),
      *  `tools` (the names the caller mounted, for the name audit). Never mutated. */
@@ -202,7 +205,7 @@ export interface PreparePolicyChainResult {
     };
     /** owned — the caller-facing policy layers (the wiring manifest reads their COUNT). */
     policyLayers: ToolPolicy[];
-    /** owned — THE effective policy the gate station adjudicates with (the fold plus its final-form re-check), or undefined. */
+    /** owned — THE effective policy the gate station adjudicates with (the fold, plus the same-instance arbitration refresh), or undefined. */
     effectivePolicy: ToolPolicy | undefined;
     /** borrowed-mutable — the inherited-unavailable marker channel. Writers: the inherited arms here (mark); the gate station
      *  (the lifecycle-end sweep) and the park lane's consumers (delete on consumption). */

package/dist/core/runner/prepare-policy-chain.js

@@ -1,10 +1,11 @@
 import { argsAsTheToolReads, withArgsReading } from "../effective-path-target.js";
+import { outletAsk, readRejudge, rewriteChasedSentence, sameBytes } from "../rewrite-rejudge.js";
 import { policyAskClassOf } from "../ask-class.js";
-import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
+import { ASK_USER_QUESTION_TOOL_NAME, isEngineQuestionFace } from "../ask-question.js";
 import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { chainJudges, inheritedToolChecks, screeningInstallationsOf, standsInFor } from "../mods/stations.js";
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
+import { isCoveringRuleName, ruleNameCovers } from "../namespaced-rule-name.js";
 import { isIsolated } from "../remote-env.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 import { earlierGrammarNotice } from "../session-policy-store.js";
@@ -29,8 +30,9 @@ import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf
 import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-policy.js";
 import { policyThrowLine, reportPolicyThrow } from "./policy-throw.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
+import { hostFloorPolicy } from "../host-floor.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, pathRuleAnchors, headLeads, tools, harnessTools, selector, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, modBus, ownModChain, autoModeDecider, readFace, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, pathRuleAnchors, headLeads, tools, harnessTools, selector, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, modBus, ownModChain, autoModeDecider, readFace, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef, hostFloor } = input;
     const ancestorArbitrations = new Map();
     const arbitrateInherited = (ask, toolCallId, judged) => {
         const verdict = arbitrateByMode(permissionMode.current, judged.classification, { origin: judged.origin, ...askMandateMember(ancestorFacts(judged.ask.action === "ask" ? judged.ask : undefined)) });
@@ -85,7 +87,7 @@ export async function preparePolicyChain(input) {
                         }
                         if (known.has(n))
                             continue;
-                        if (isNamespacedCoveringRuleName(n, kind) && [...known].some((k) => namespacedRuleNameCovers(n, k)))
+                        if (isCoveringRuleName(n, kind) && [...known].some((k) => ruleNameCovers(n, k)))
                             continue;
                         unmatched.add(`"${n}" (${kind})`);
                     }
@@ -102,7 +104,7 @@ export async function preparePolicyChain(input) {
                 }
                 advisedPolicyNames.set(deps, advised);
                 try {
-                    const e = new Error(`toolPolicy name audit: ${[...unmatched].join(", ")} match(es) no tool mounted this run (primary or alias) — the rule cannot fire here. Often a typo or a self-report/wire name skew (e.g. TodoWrite vs the mounted TaskCreate family; "*" has no wildcard meaning in a name-keyed policy). Advisory only: enforcement is unchanged, and a name can be legitimate for another scenario or a per-spawn tool.`);
+                    const e = new Error(`toolPolicy name audit: ${[...unmatched].join(", ")} match(es) no tool mounted this run (primary or alias) — the rule cannot fire here. Often a typo or a self-report/wire name skew (e.g. TodoWrite vs the mounted TaskCreate family; a "*" on a deny or ask list reaches every name its pattern matches). Advisory only: enforcement is unchanged, and a name can be legitimate for another scenario or a per-spawn tool.`);
                     e.code = "config.toolpolicy.unmatched_names";
                     deps.onError?.(e, { phase: "config", sessionId });
                 }
@@ -159,7 +161,7 @@ export async function preparePolicyChain(input) {
         .map((entry) => ({
         check: (creq) => checkToolPolicyProjection(entry, creq) ?? { action: "allow" },
     }));
-    const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, ...frozenConstraintLayers].filter((p) => p !== undefined);
+    const narrowingLayers = [hostFloor !== undefined ? hostFloorPolicy(hostFloor) : undefined, sessionRulePolicy, ...ancestorRulePolicies, ...frozenConstraintLayers].filter((p) => p !== undefined);
     auditPolicyNames(sessionRulePolicy);
     for (const layer of ancestorRulePolicies)
         auditPolicyNames(layer, true);
@@ -169,6 +171,16 @@ export async function preparePolicyChain(input) {
     const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
     const sharedFirstDecision = new Map();
     const SHARED_FIRST_DECISION_CAP = 256;
+    const staleArbitrations = new Map();
+    const noteArbitration = (toolCallId, arbitrate, stale) => {
+        const rest = (staleArbitrations.get(toolCallId) ?? []).filter((a) => a !== arbitrate);
+        if (stale)
+            rest.push(arbitrate);
+        if (rest.length > 0)
+            staleArbitrations.set(toolCallId, rest);
+        else
+            staleArbitrations.delete(toolCallId);
+    };
     const inheritedUnavailableAsks = new Set();
     const INHERITED_UNAVAILABLE_CAP = 256;
     const markInheritedUnavailable = (toolCallId) => {
@@ -229,7 +241,7 @@ export async function preparePolicyChain(input) {
         list.push({ cls, layer });
         foldAskClasses.set(toolCallId, list);
     };
-    const isDelegatedQuestion = (creq) => wireOf("inherited.questionFloat", creq) === ASK_USER_QUESTION_TOOL_NAME;
+    const isDelegatedQuestion = (creq) => isEngineQuestionFace(creq.face);
     const sandboxBoundaryCapable = (call) => heldBy("gate.sandboxBoundary.egress", egressTools, call) || !envHandToolNames.has(wireOf("gate.sandboxBoundary.hand", call));
     const emitSandboxAdmitted = (info) => {
         emitTrace(deps.tracer, () => ({
@@ -255,8 +267,8 @@ export async function preparePolicyChain(input) {
     };
     const callerPolicyLayer = policy !== undefined && sameInstanceAncestorCount > 0
         ? wrapToolPolicy(policy, async (creq, csignal) => {
-            const decision = refuseOutOfContractDecision(await policy.check(creq, csignal ?? abortController.signal));
-            sharedFirstDecision.set(creq.toolCallId, decision);
+            const decision = refuseOutOfContractDecision(await policy.check(creq, csignal ?? abortController.signal), { call: creq });
+            sharedFirstDecision.set(creq.toolCallId, { decision, judged: creq.args });
             if (sharedFirstDecision.size > SHARED_FIRST_DECISION_CAP) {
                 const oldest = sharedFirstDecision.keys().next().value;
                 if (oldest !== undefined)
@@ -297,7 +309,7 @@ export async function preparePolicyChain(input) {
         const seat = seatMarksOf(call);
         const face = readFace();
         return {
-            ...INHERITED_STATION_FACTS,
+            ...INHERITED_STATION_FACTS, call: { toolCallId: call.toolCallId, toolName: call.toolName },
             mandateMarks: { egress: seat.egress, shellGated: false, ...(seat.tier === "always" && !seat.shellGated ? { irreversibility: "always" } : {}) },
             ...(seat.sources.size > 0 ? { toolMarkSources: seat.sources } : {}),
             ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}),
@@ -352,7 +364,7 @@ export async function preparePolicyChain(input) {
             }
             let re;
             try {
-                re = refuseOutOfContractDecision(await pol.check(await withArgsReading(creq, editArgs, csignal ?? abortController.signal), csignal ?? abortController.signal));
+                re = refuseOutOfContractDecision(await pol.check(await withArgsReading(creq, editArgs, csignal ?? abortController.signal), csignal ?? abortController.signal), { call: creq });
             }
             catch (err) {
                 reportPolicyThrow(notifyOwnHookCrash, "an inherited parent policy's re-check of the approved edit", creq, err, csignal ?? abortController.signal);
@@ -363,13 +375,16 @@ export async function preparePolicyChain(input) {
             }
             if (re.action === "deny")
                 return vetoed(re);
-            if (re.action === "allow") {
-                const stated = re.updatedInput === undefined ? "mode" : re.decisionReason;
-                return onApproval(withAttestation({ action: "allow", updatedInput: re.updatedInput !== undefined ? re.updatedInput : editArgs, ...(stated !== undefined ? { decisionReason: stated } : {}) }, re.attestation));
+            const read = readRejudge(creq, editArgs, re);
+            if (read.kind === "rewritten") {
+                editArgs = read.form;
+                const { updatedInput: _form, ...verdict } = re;
+                re = outletAsk(verdict, creq.toolName, editArgs);
             }
-            if (re.updatedInput !== undefined)
-                editArgs = argsAsTheToolReads(creq, re.updatedInput);
-            const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), route: frozenApproverRoute(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
+            else if (re.action === "allow") {
+                return onApproval(withAttestation({ action: "allow", updatedInput: editArgs, decisionReason: "mode" }, re.attestation));
+            }
+            const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: read.kind === "rewritten" ? undefined : ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), route: frozenApproverRoute(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
             if (judged.kind === "allow") {
                 return onApproval(judged.result);
             }
@@ -378,7 +393,10 @@ export async function preparePolicyChain(input) {
             const { ask: editAsk } = judged;
             re = editAsk;
             const editArbitrated = arbitrateInherited(re, creq.toolCallId, judged);
-            if (editArbitrated !== undefined) {
+            const outletReleased = read.kind === "rewritten" && editArbitrated?.action === "allow";
+            if (outletReleased)
+                ancestorArbitrations.delete(creq.toolCallId);
+            if (editArbitrated !== undefined && !outletReleased) {
                 return onApproval(editArbitrated.action === "allow" ? { action: "allow", updatedInput: editArgs, decisionReason: "mode" } : editArbitrated);
             }
             const { resolved: rr, judged: settled } = await resolveInheritedAsk(judged, (j) => resolveAsk({
@@ -469,8 +487,14 @@ export async function preparePolicyChain(input) {
         ? { check: () => ({ action: "allow" }) }
         : policy !== undefined && pc.policy === policy
             ? {
-                check: async (creq, csignal) => {
-                    const first = sharedFirstDecision.get(creq.toolCallId);
+                check: async function arbitrate(creq, csignal) {
+                    const recorded = sharedFirstDecision.get(creq.toolCallId);
+                    const first = recorded?.decision;
+                    const stale = recorded !== undefined && !sameBytes(creq, recorded.decision.updatedInput !== undefined ? recorded.decision.updatedInput : recorded.judged, creq.args);
+                    if (recorded !== undefined)
+                        noteArbitration(creq.toolCallId, arbitrate, stale);
+                    if (stale)
+                        return { action: "allow" };
                     if (first === undefined) {
                         return {
                             action: "deny",
@@ -546,7 +570,7 @@ export async function preparePolicyChain(input) {
             : wrapToolPolicy(pc.policy, async (creq, csignal) => {
                 let decision;
                 try {
-                    decision = refuseOutOfContractDecision(await pc.policy.check(creq, csignal ?? abortController.signal));
+                    decision = refuseOutOfContractDecision(await pc.policy.check(creq, csignal ?? abortController.signal), { call: creq });
                 }
                 catch (err) {
                     reportPolicyThrow(notifyOwnHookCrash, "an inherited parent policy", creq, err, csignal ?? abortController.signal);
@@ -575,88 +599,57 @@ export async function preparePolicyChain(input) {
         const settled = await settleInstallationAsk(pc, ask, creq, csignal);
         return settled.kind === "settled" ? settled.result : settled.resolved;
     });
-    const rewriteCapableLayers = policy !== undefined || parentConstraintWrappers.length > 0;
-    const rewriteEmitterIndex = new Map();
     const rewriteCapableChain = [
         ...(callerPolicyLayer !== undefined ? [callerPolicyLayer] : []),
         ...parentConstraintWrappers,
     ];
     const callerSlotOffset = callerPolicyLayer !== undefined ? 1 : 0;
-    const sameInstanceAdapterIndices = new Set();
-    (inheritedParentConstraints ?? []).forEach((pc, j) => {
-        if (policy !== undefined && pc.policy === policy)
-            sameInstanceAdapterIndices.add(j + callerSlotOffset);
-    });
     const instrumentedChain = rewriteCapableChain.map((layer, idx) => wrapToolPolicy(layer, async (creq, csignal) => {
-        const d = refuseOutOfContractDecision(await layer.check(creq, csignal));
-        if (d.updatedInput !== undefined)
-            rewriteEmitterIndex.set(creq.toolCallId, idx);
+        const d = refuseOutOfContractDecision(await layer.check(creq, csignal), { call: creq });
         if (d.action === "ask") {
             recordFoldAskClass(creq.toolCallId, idx < callerSlotOffset ? policyAskClassOf(policy) : "mandate", idx < callerSlotOffset ? "caller_policy" : "ancestor_constraint");
         }
         return d;
     }));
     const modeGateLayer = createModeGatePolicy(permissionMode, { env: executionEnv, rootPath: taskRootFinal, acceptDirs: [taskRootFinal, ...additionalRootsCanonical], roster: toolRosterDeltas, readOnlyDeclared: (name) => mountedToolDeclaresReadOnly(tools, name), ...(scratchpadDir !== undefined ? { exemptDirs: [scratchpadDir] } : {}) });
-    const policyLayers = [
-        ...narrowingLayers,
-        ...instrumentedChain,
-        ...(rewriteCapableLayers ? narrowingLayers : []),
-    ];
+    const policyLayers = [...narrowingLayers, ...instrumentedChain, ...(rewriteCapableChain.length > 0 ? narrowingLayers : [])];
     const integrityGuardLayers = [createTranscriptIntegrityPolicy(), createUnverifiableDeletePolicy({ removalSeat: { env: executionEnv, additionalRoots: () => additionalRootsCanonical } })];
-    const guardedPolicyLayers = rewriteCapableLayers
-        ? [...integrityGuardLayers, ...policyLayers, modeGateLayer, ...integrityGuardLayers]
-        : [...integrityGuardLayers, ...policyLayers, modeGateLayer];
+    const guardedPolicyLayers = [...integrityGuardLayers, ...policyLayers, modeGateLayer];
     const foldedPolicy = guardedPolicyLayers.length === 1 ? guardedPolicyLayers[0] : combinePolicies(...guardedPolicyLayers);
-    const effectivePolicy = foldedPolicy !== undefined && rewriteCapableLayers
+    const effectivePolicy = foldedPolicy !== undefined && sameInstanceAncestorCount > 0
         ? wrapToolPolicy(foldedPolicy, async (req, signal) => {
             let decision;
+            let stale;
             try {
                 decision = await foldedPolicy.check(req, signal);
             }
-            catch (err) {
-                rewriteEmitterIndex.delete(req.toolCallId);
-                throw err;
+            finally {
+                stale = staleArbitrations.get(req.toolCallId) ?? [];
+                staleArbitrations.delete(req.toolCallId);
             }
-            const emitterIdx = rewriteEmitterIndex.get(req.toolCallId);
-            rewriteEmitterIndex.delete(req.toolCallId);
-            if (decision.action === "deny" || decision.updatedInput === undefined)
+            if (decision.action === "deny" || stale.length === 0)
                 return decision;
-            const recheckPrefix = rewriteCapableChain.slice(0, emitterIdx ?? rewriteCapableChain.length);
-            const postEmitterSameInstanceAdapters = [];
-            if (emitterIdx !== undefined && emitterIdx > 0) {
-                for (let i = emitterIdx + 1; i < rewriteCapableChain.length; i++) {
-                    if (sameInstanceAdapterIndices.has(i))
-                        postEmitterSameInstanceAdapters.push(rewriteCapableChain[i]);
-                }
-            }
-            const recheckLayers = [...recheckPrefix, ...postEmitterSameInstanceAdapters];
-            const finalReq = await withArgsReading(req, decision.updatedInput, signal);
+            const finalReq = decision.updatedInput !== undefined ? await withArgsReading(req, decision.updatedInput, signal) : req;
+            const carried = decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {};
             let asked;
             let revalidated;
             try {
-                for (const layer of recheckLayers) {
-                    const d = refuseOutOfContractDecision(await layer.check(finalReq, signal));
-                    if (d.action === "deny") {
-                        return withAttestation({ ...d, updatedInput: decision.updatedInput }, mergeAttestation(req, attestationOf(decision, req), attestationOf(d, req), "answer"));
-                    }
-                    if (d.updatedInput !== undefined) {
-                        return {
-                            action: "deny",
-                            message: "policy required a rewrite during final-form re-check — the arguments that would execute were not accepted as-is (fail-closed; rewrite chains are not iterated to a fixpoint)",
-                            updatedInput: decision.updatedInput,
-                        };
-                    }
+                for (const arbitrate of stale) {
+                    const d = refuseOutOfContractDecision(await arbitrate(finalReq, signal), { call: finalReq });
+                    if (d.action === "deny")
+                        return withAttestation({ ...d, ...carried }, mergeAttestation(req, attestationOf(decision, req), attestationOf(d, req), "answer"));
+                    if (readRejudge(finalReq, finalReq.args, d).kind === "rewritten")
+                        return { action: "deny", message: rewriteChasedSentence(req.toolName), ...carried };
                     if (d.action === "ask" && asked === undefined)
                         asked = d;
                     revalidated = mergeAttestation(req, revalidated, d.attestation);
                 }
             }
             finally {
-                rewriteEmitterIndex.delete(req.toolCallId);
-            }
-            if (asked !== undefined && decision.action === "allow") {
-                return { ...asked, updatedInput: decision.updatedInput };
+                staleArbitrations.delete(req.toolCallId);
             }
+            if (asked !== undefined && decision.action === "allow")
+                return { ...asked, ...carried };
             if (decision.action === "allow")
                 return withAttestation(decision, mergeAttestation(req, attestationOf(decision, req), revalidated));
             return decision;

package/dist/core/runner/prepare-prompt-assembly.d.ts

@@ -3,7 +3,7 @@ import type { Model } from "../../internal/llm.js";
 import { assemblePrompt, type AssembledPrompt } from "../../prompt-assembly/assemble.js";
 import { type CenterAdoption } from "../../prompt-assembly/artifact.js";
 import { type RunPromptIdentity } from "../../prompt-assembly/epoch.js";
-import type { HostForm, HostRole } from "../../prompt-assembly/catalog/schema.js";
+import type { HostForm, HostRole, PromptTraitName } from "../../prompt-assembly/catalog/schema.js";
 import type { SourcedOverlay } from "../../prompt-assembly/overlay.js";
 import { type EnvironmentFacts } from "../../prompts/default.js";
 import { type LegModBus } from "../mods/stations.js";
@@ -47,15 +47,13 @@ export interface PreparePromptAssemblyInput {
     memoryBlock: string | undefined;
     /** borrowed-readonly — the environment facts; `date` is the assembly's date, the block builder re-renders on a date change. */
     envFacts: EnvironmentFacts;
-    /** borrowed-readonly — the resolved prompt profile (a runtime fact of the assembly). */
-    promptProfile: "simple" | "classic";
-    /** borrowed-readonly — the fable mitigations switch (a runtime fact of the assembly). */
-    fableMitigations: boolean;
+    /** borrowed-readonly — the run's effective prompt traits (a selector value of the assembly). */
+    promptTraits: ReadonlySet<PromptTraitName>;
     /** borrowed-readonly — the run's ONE tool roster, read only: the assembly receives DETACHED copies, the audit and the
      *  manifest read it in place. Never mutated here. */
     tools: readonly AgentTool[];
-    /** borrowed-readonly — the task model: `promptGuidance` (the model-guidance section) and `id` (the compose event's `model`). */
-    model: Pick<Model, "id" | "promptGuidance">;
+    /** borrowed-readonly — the task model: `id` (the compose event's `model`). */
+    model: Pick<Model, "id">;
     /** borrowed-readonly — the acquired session id (every operator line's attribution). */
     sessionId: string;
     /** borrowed-readonly — the once-per-session ledger's operator sink (the collision audit's two lines). */

package/dist/core/runner/prepare-prompt-assembly.js

@@ -15,19 +15,23 @@ import { protocolOf } from "../protocol-table.js";
 import { hasConversationContent } from "../session.js";
 import { PROMPT_HASH_SALT } from "./prompt-hash-salt.js";
 const CATALOG_DIGEST = catalogDigestOf(SEMA_DEFAULT_CATALOG);
-function taskLayerOf(task) {
+const TASK_TEXT_DIGEST_SCHEME = "sid-sha256:";
+function taskLayerDigestOf(sessionId, text) {
+    return `${TASK_TEXT_DIGEST_SCHEME}${createHash("sha256").update(sessionId).update("\u0000").update(text).digest("hex")}`;
+}
+function taskLayerOf(task, sessionId) {
     return task.map(({ overlay: o, origin }) => ({
         by: origin.by,
         id: o.id,
         op: o.op,
         target: o.target,
-        ...(o.text !== undefined ? { chars: o.text.length } : {}),
+        ...(o.text !== undefined ? { text: taskLayerDigestOf(sessionId, o.text) } : {}),
         ...(o.message !== undefined ? { message: o.message } : {}),
         ...(o.when !== undefined ? { when: o.when } : {}),
     }));
 }
 export async function preparePromptAssembly(input) {
-    const { session, deps, internals, resume, sugar, host, binding, modBus, featureFlags, mcpInstructionsBlock, memoryBlock, envFacts, promptProfile, fableMitigations, tools, model, sessionId, onceLedger } = input;
+    const { session, deps, internals, resume, sugar, host, binding, modBus, featureFlags, mcpInstructionsBlock, memoryBlock, envFacts, promptTraits, tools, model, sessionId, onceLedger } = input;
     const topLevel = internals?.parentTaskId === undefined && internals?.parentSessionId === undefined && internals?.parentCenterArtifactDigest === undefined;
     const stored = await session.getPromptEpoch();
     let centerAdoption;
@@ -82,10 +86,8 @@ export async function preparePromptAssembly(input) {
         ...featureFlags,
         orchestrationEnabled: featureFlags.orchestrationEnabled && tools.some((t) => t.name === "Workflow"),
         orchestrationDeferred: featureFlags.orchestrationDeferred && tools.some((t) => t.name === "Workflow"),
-        promptProfile,
-        fableMitigations,
     };
-    const selectorRecord = selectorRecordOf(selectorsOf(facts, host, binding));
+    const selectorRecord = selectorRecordOf(selectorsOf(facts, host, binding, promptTraits));
     const centerOverlays = centerOverlaysOf(centerAdoption);
     const lowerAdds = new Map();
     for (const { overlay } of [...sugar, ...centerOverlays])
@@ -105,6 +107,7 @@ export async function preparePromptAssembly(input) {
         deployOverlays: composed.deploy,
         host,
         ...(binding !== undefined ? { binding } : {}),
+        traits: promptTraits,
         tools,
         facts,
         ...(envFacts.cwd !== undefined ? { workspaceFolder: envFacts.cwd } : {}),
@@ -112,11 +115,10 @@ export async function preparePromptAssembly(input) {
         memoryBlock,
         buildEnvBlock: (date) => buildEnvironmentContext({ ...envFacts, date }) || undefined,
         date: envFacts.date,
-        ...(model.promptGuidance && model.promptGuidance.length > 0 ? { modelGuidance: model.promptGuidance.join("\n\n") } : {}),
         onWarn: (message, phase) => deps.onError?.(new Error(message), { phase, sessionId }),
     });
     const deployLayer = composed.deploy.length > 0 ? digestOf(composed.deploy.map(({ overlay, origin }) => ({ by: origin.by, overlay }))) : undefined;
-    const taskLayer = taskOverlays.length > 0 ? digestOf(taskLayerOf(taskOverlays)) : undefined;
+    const taskLayer = taskOverlays.length > 0 ? digestOf(taskLayerOf(taskOverlays, sessionId)) : undefined;
     const bindingLayer = digestOf(selectorRecord);
     const renderers = rendererVector();
     const identityFor = (center) => ({

package/dist/core/runner/prepare-prompt-inputs.d.ts

@@ -23,7 +23,8 @@ import type { LegModBus } from "../mods/stations.js";
 import type { ExecutionEnv, ThinkingLevel } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
 import { type EnvironmentFacts } from "../../prompts/default.js";
-import type { SourcedOverlay } from "../../prompt-assembly/overlay.js";
+import type { HostRole } from "../../prompt-assembly/catalog/schema.js";
+import { type RequestBodySugar } from "../../prompt-assembly/sugar.js";
 import type { ContainmentFace } from "../../tools/fs/index.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { MaterializedMcp } from "../mcp.js";
@@ -65,10 +66,6 @@ export interface PreparePromptInputsInput {
     /** borrowed-readonly — the frozen tool face; `defer` (the Workflow short-pointer flag) and `selector` (with the spec's whole-face
      *  switch, the valve's reading that decides which servers' instructions are taught). */
     toolFaceSnapshot: Pick<ToolFaceSnapshot, "defer" | "selector">;
-    /** borrowed-readonly — the resolved prompt profile (rides the flags to the legacy ctx). */
-    promptProfile: "simple" | "classic";
-    /** borrowed-readonly — the fable-mitigations profile axis (rides the flags with the profile). */
-    fableMitigations: boolean;
     /** borrowed-readonly — trusted internals: `goalMode` (goal flag), `isolation` (worktree flag),
      *  `defaultSystemPrompt` (the sugar's third source). `undefined` on a standalone prepare. */
     internals: Pick<RunInternals, "goalMode" | "isolation" | "defaultSystemPrompt"> | undefined;
@@ -81,8 +78,12 @@ export interface PreparePromptInputsInput {
     delegation: {
         readonly isNonForkChild: boolean;
     };
-    /** borrowed-readonly — the resolved role; only its `systemPrompt` preset is read (second source). */
-    resolvedRole: Pick<ResolvedRole, "systemPrompt">;
+    /** borrowed-readonly — the resolved role; only its role-base statement (`promptRole` / `systemPrompt`) is read (the
+     *  role-base decision's second source). */
+    resolvedRole: Pick<ResolvedRole, "promptRole" | "systemPrompt">;
+    /** borrowed-readonly — the task seat's role word as its door judged it (`TaskSpec.promptRole`, `resolveHost`): the
+     *  role-base decision's first source, beside the spec's own text. */
+    taskRole: HostRole | undefined;
     /** borrowed-mutable — the materialized MCP roster; `serverInstructions` (the disposed entries) and `tools` (each server's listing: did it list
      *  any tool) are read, and the instructions lane's ledger is stated: the block is what the model is told at the run's start. */
     mcp: Pick<MaterializedMcp, "serverInstructions" | "tools" | "instructionsDelta">;
@@ -122,8 +123,9 @@ export interface PreparePromptInputsInput {
 export interface PreparePromptInputsResult {
     /** owned — the runtime feature flags (see {@link PromptFeatureFlags}). */
     featureFlags: PromptFeatureFlags;
-    /** owned — the request-body sugar's overlays (the task class's first contributions), in application order. */
-    sugar: readonly SourcedOverlay[];
+    /** owned — the request-body sugar: its overlays (the task class's first contributions, in application order) and the
+     *  run's host role, from the one role-base decision. */
+    sugar: RequestBodySugar;
     /** owned — the fenced MCP server-instructions block, or undefined when no server declared any. */
     mcpInstructionsBlock: string | undefined;
     /** owned — the environment facts the env tail renders from. Filled here; no later phase writes it

package/dist/core/runner/prepare-prompt-inputs.js

@@ -1,5 +1,5 @@
 import { formatLocalDate, isValidTimeZone } from "../../prompts/default.js";
-import { sugarOverlays } from "../../prompt-assembly/sugar.js";
+import { requestBodySugar } from "../../prompt-assembly/sugar.js";
 import { valveLeaves } from "../../agents/tool-filter.js";
 import { instructionsTaught, toldAtStart } from "../mounted-mcp.js";
 import { isIsolated } from "../remote-env.js";
@@ -9,7 +9,7 @@ import { renderMcpInstructionsEntry } from "./turn-attachments.js";
 const ULTRA_REASONING_TIERS = new Set(["xhigh", "max"]);
 import { compactionEnabled } from "../context-settings.js";
 export async function preparePromptInputs(input) {
-    const { spec, deps, failClosedReason, lockedPreflight, selfOrchestrationActive, executionEnv, reminderMark, resolvedReadFace, resolvedWriteFace, toolFaceSnapshot, promptProfile, fableMitigations, internals, thinking, ownedEnv, delegation, resolvedRole, mcp, model, externalContentTargetActive, resume, handsEnabled, taskRootFinal, additionalRootsCanonical, additionalReadRootsCanonical, sessionId, session, advertisedWritableDirs } = input;
+    const { spec, deps, failClosedReason, lockedPreflight, selfOrchestrationActive, executionEnv, reminderMark, resolvedReadFace, resolvedWriteFace, toolFaceSnapshot, internals, thinking, ownedEnv, delegation, resolvedRole, mcp, model, externalContentTargetActive, resume, handsEnabled, taskRootFinal, additionalRootsCanonical, additionalReadRootsCanonical, sessionId, session, advertisedWritableDirs } = input;
     const promptPolicyEnabled = Boolean(lockedPreflight.toolPolicy);
     const promptHooksEnabled = input.modBus.hasHandlers("classic.PreToolUse") || input.modBus.hasHandlers("classic.PostToolUse");
     if (failClosedReason) {
@@ -24,15 +24,13 @@ export async function preparePromptInputs(input) {
         writeFaceOpen: resolvedWriteFace === "open",
         orchestrationEnabled: selfOrchestrationActive,
         orchestrationDeferred: selfOrchestrationActive && (toolFaceSnapshot.defer?.includes("Workflow") ?? false),
-        promptProfile,
-        fableMitigations,
         goalEnabled: internals?.goalMode === true,
         awarenessEnabled: thinking !== undefined && ULTRA_REASONING_TIERS.has(thinking),
         worktreeIsolated: internals?.isolation === "worktree" && ownedEnv !== undefined,
         withinTaskCompactionEnabled: compactionEnabled(spec.compaction?.enabled, input.contextOverlay) && (spec.compaction?.withinTask ?? true),
         isSubagent: delegation.isNonForkChild,
     };
-    const sugar = sugarOverlays({ spec, resolvedRole, ...(internals !== undefined ? { internals } : {}) });
+    const sugar = requestBodySugar({ spec, resolvedRole, ...(input.taskRole !== undefined ? { taskRole: input.taskRole } : {}), ...(internals !== undefined ? { internals } : {}) });
     const valveLeft = valveLeaves(spec, toolFaceSnapshot.selector);
     const taught = mcp.serverInstructions.filter((entry) => instructionsTaught(valveLeft, entry.server, input.roster.tools, mcp.tools));
     toldAtStart(mcp.instructionsDelta, new Set(taught.map((entry) => entry.server)));

package/dist/core/runner/prepare-protocol-tools.d.ts

@@ -36,6 +36,8 @@ export interface PrepareProtocolToolsInput {
      *  mount predicate, and whether a real client was acquired) and `a2a` (the declared peers the door judged: the materialize
      *  input and whether a handle was acquired) are read. */
     lockedPreflight: Pick<LockedPreflight, "mcp" | "a2a">;
+    /** borrowed-readonly — the deployment's host floor as the config doors compiled it: each MCP http dial and every A2A request is judged by it. */
+    hostFloor: import("../host-floor.js").HostFloor | undefined;
     /** borrowed-readonly — the REBOUND spec. Read: `principal` (the MCP header / the A2A identity), `tools`
      *  (the caller names both reserved-name guards check against), `excludeAllTools` (the valve's whole-face switch: the live roster lane's
      *  reading, and the first-dial gate), `signal` (the host's abort, which stops an MCP dial). */

package/dist/core/runner/prepare-protocol-tools.js

@@ -14,7 +14,7 @@ import { applyMcpToolFaces } from "./tool-face-overlay.js";
 import { sectionDisposerOf } from "../prompt-section-seat.js";
 import { thrownText } from "../thrown-value.js";
 export async function prepareProtocolTools(input) {
-    const { lockedPreflight, spec, deps, mcpPool, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, toolMarkSources, abortController, rollback } = input;
+    const { lockedPreflight, hostFloor, spec, deps, mcpPool, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, toolMarkSources, abortController, rollback } = input;
     const markedBy = (name, source) => {
         const set = toolMarkSources.get(name);
         if (set !== undefined)
@@ -30,7 +30,7 @@ export async function prepareProtocolTools(input) {
     const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
     const resourcesReached = resourceFacesLeft(leaves);
     const mcp = lockedPreflight.mcp?.length
-        ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps, runId), mcpPool === undefined ? undefined : { pool: mcpPool.pool, ownsPool: mcpPool.owned }, sectionDisposerOf(input.modBus, abortController.signal), (entry) => resourcesReached || serverReached(mintNamespacePrefix(MCP_NAMESPACE, entry.name)), AbortSignal.any([abortController.signal, ...(spec.signal !== undefined ? [spec.signal] : [])]))
+        ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps, runId), mcpPool === undefined ? undefined : { pool: mcpPool.pool, ownsPool: mcpPool.owned }, sectionDisposerOf(input.modBus, abortController.signal), (entry) => resourcesReached || serverReached(mintNamespacePrefix(MCP_NAMESPACE, entry.name)), AbortSignal.any([abortController.signal, ...(spec.signal !== undefined ? [spec.signal] : [])]), hostFloor)
         :
             { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, droppedTools: [], statuses: [], refresh: async () => [], reconnect: async (server) => ({ server, prefix: mintNamespacePrefix(MCP_NAMESPACE, server), outcome: "not_declared", reason: "this task declared no MCP servers", toolCount: 0, added: [], removed: [] }), dispose: async () => { } };
     if (lockedPreflight.mcp?.length)
@@ -167,7 +167,7 @@ export async function prepareProtocolTools(input) {
     foldProtocolAxes(mcp.toolAxes, "MCP");
     const a2aDeclared = lockedPreflight.a2a;
     const a2a = a2aDeclared
-        ? await materializeA2aTools(a2aDeclared, spec.principal, abortController.signal)
+        ? await materializeA2aTools(a2aDeclared, spec.principal, abortController.signal, hostFloor)
         : { tools: [], toolAxes: [], warnings: [], statuses: [], refresh: async () => [], dispose: async () => { } };
     if (a2aDeclared)
         rollback.push(function a2aDispose() { return a2a.dispose(); });

package/dist/core/runner/prepare-safety-scan.d.ts

@@ -16,7 +16,7 @@ export interface PrepareSafetyScanInput {
  * The six collections are **borrowed-mutable**: the driver and later phases fold into them IN
  * PLACE (identity is part of the contract — closures alias these exact objects). Mutation owners
  * after this phase, in driver order:
- *  · the roster builder (`toolEffects`: every mount and unmount; the aliases' axes on a non-caller mount and on an unmount);
+ *  · the roster builder (`toolEffects`: every mount and unmount);
  *  · the MCP/A2A materialize fold + the runtime refresh seam (protocol-axis tighten registration and a protocol tool's effect;
  *    on refresh, `toolEffects.delete` resets a replaced tool's effect record for the fresh fold —
  *    the irreversible/egress sets deliberately KEEP their entries, the tighten-only residue);

package/dist/core/runner/prepare-safety-scan.js

@@ -116,9 +116,7 @@ export function prepareSafetyScan(input) {
         }
     }
     const candidates = engineCandidatesOf(spec, deps);
-    const engineNames = new Set(candidates.map(([n]) => n));
     for (const t of survivors.values()) {
-        const tier = tierOf(t);
         for (const alias of t.aliases ?? []) {
             if (alias === t.name || survivors.has(alias))
                 continue;
@@ -128,21 +126,6 @@ export function prepareSafetyScan(input) {
             claimedAliases.add(alias);
             if (t.effect)
                 declared.set(alias, t.effect);
-            if (engineNames.has(alias))
-                continue;
-            if (tier !== undefined) {
-                irreversibilityTier.set(alias, tier);
-                if (tier === "always" || tier === "maybe") {
-                    irreversibleTools.add(alias);
-                    markedBy(alias, "deployment");
-                }
-            }
-            if (t.reversibilityProbe)
-                reversibilityProbes.set(alias, t.reversibilityProbe);
-            if (t.egress) {
-                egressTools.add(alias);
-                markedBy(alias, "deployment");
-            }
         }
     }
     return {