@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/tool-policy.js

@@ -1,8 +1,10 @@
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { argsReadFrom, carryArgsReadFrom, withArgsReading } from "./effective-path-target.js";
+import { editRewrittenSentence, readRejudge, rewriteChasedSentence } from "./rewrite-rejudge.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { decisionAskClassesOf, headlessDenialMessage } from "./ask-origin.js";
+import { attest, attestationOf, isEngineAttestation, mergeAttestation, mintAttestation, withAttestation } from "./engine-attestation.js";
 import { ownReadRootCandidate, readRootGrantSeat } from "./read-root-grant-screen.js";
 import { decidersNote, settledByDecider } from "./gate-outcome.js";
 import { unjudgedAllowRefused } from "./real-approval.js";
@@ -19,9 +21,9 @@ import { egressText, egressThrownText } from "./untrusted-egress.js";
 import { assertNoRetiredKeys, assertNoRetiredToolPolicyKeys, RETIRED_DECISION_MEMBERS, RETIRED_TOOL_POLICY_KEYS } from "./retired-keys.js";
 import { DECISION_MEMBER_ARMS, isEngineRefusal, nestedRecordsOf, receiveContract, receiveNestedRecords, refusedOutOfContract, screenContractValues } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "./permission-rules.js";
+import { isCoveringRuleName, ruleNameCovers } from "./namespaced-rule-name.js";
 import { ruleContentOf } from "./permission-rule-model.js";
-import { wildcardPeerRefusalOf } from "./tool-name-aliases.js";
+import { grantWildcardRefusalOf } from "./tool-name-aliases.js";
 import { ruleSpellingOf } from "./permission-rule-syntax.js";
 import { protocolOf } from "./protocol-table.js";
 import { anchorSpelling, isAbsoluteForFamily, normalizeAbsPathLexically, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
@@ -37,75 +39,7 @@ export function exemptRootsSeat(exemptRoots) {
 function settledByNobody(kind) {
     return { kind, who: { party: "none" }, when: Date.now() };
 }
-const ATTESTATION_GROUP_OF = {
-    settlement: "answer",
-    origin: "answer",
-    classes: "answer",
-    inputDigest: "answer",
-    classifierCause: "classifierCause",
-    classifierRound: "classifierRound",
-    unresolvableCause: "unresolvableCause",
-    foldedClasses: "foldedClasses",
-    pathDenial: "pathDenial",
-    bindingRefusal: "bindingRefusal",
-};
-const ATTESTATION_MEMBERS = Object.keys(ATTESTATION_GROUP_OF);
-const groupLead = (g) => ATTESTATION_MEMBERS.find((k) => ATTESTATION_GROUP_OF[k] === g);
-const ENGINE_ATTESTATIONS = new WeakSet();
-function detachedMember(v) {
-    if (Array.isArray(v))
-        return Object.freeze([...v]);
-    if (typeof v !== "object" || v === null)
-        return v;
-    return Object.freeze(Object.fromEntries(Object.entries(v).map(([k, x]) => [k, typeof x === "object" && x !== null ? Object.freeze(Array.isArray(x) ? [...x] : { ...x }) : x])));
-}
-export function mintAttestation(call, members) {
-    const record = { toolCallId: call.toolCallId, toolName: call.toolName };
-    for (const k of ATTESTATION_MEMBERS)
-        if (members[k] !== undefined)
-            record[k] = detachedMember(members[k]);
-    const minted = Object.freeze(record);
-    ENGINE_ATTESTATIONS.add(minted);
-    return minted;
-}
-export function isEngineAttestation(v) {
-    return typeof v === "object" && v !== null && ENGINE_ATTESTATIONS.has(v);
-}
-const boundTo = (r, call) => isEngineAttestation(r) && r.toolCallId === call.toolCallId && r.toolName === call.toolName ? r : undefined;
-export function attestationOf(d, call) {
-    if (typeof d !== "object" || d === null)
-        return undefined;
-    return boundTo(Object.getOwnPropertyDescriptor(d, "attestation")?.value, call);
-}
-export function mergeAttestation(call, earlier, later, scope = "all") {
-    const a = boundTo(earlier, call);
-    const b = boundTo(later, call);
-    if (a === undefined)
-        return b;
-    const members = {};
-    if (b !== undefined)
-        for (const k of ATTESTATION_MEMBERS)
-            if (b[k] !== undefined)
-                members[k] = b[k];
-    let filled = false;
-    for (const g of new Set(Object.values(ATTESTATION_GROUP_OF))) {
-        if ((scope === "answer" && g !== "answer") || members[groupLead(g)] !== undefined || a[groupLead(g)] === undefined)
-            continue;
-        for (const k of ATTESTATION_MEMBERS)
-            if (ATTESTATION_GROUP_OF[k] === g && a[k] !== undefined)
-                members[k] = a[k];
-        filled = true;
-    }
-    if (!filled)
-        return b;
-    return mintAttestation(call, members);
-}
-export function attest(d, call, members) {
-    return withAttestation(d, mergeAttestation(call, attestationOf(d, call), mintAttestation(call, members)));
-}
-export function withAttestation(d, record) {
-    return record === undefined ? d : { ...d, attestation: record };
-}
+export { attest, attestationOf, isEngineAttestation, mergeAttestation, mintAttestation, withAttestation } from "./engine-attestation.js";
 const UNASKED_SEAT_SETTLEMENTS = new Set(["task_aborted", "no_approver"]);
 function seatNeverAsked(settlement) {
     return settlement !== undefined && UNASKED_SEAT_SETTLEMENTS.has(settlement.kind);
@@ -196,21 +130,11 @@ export function toolPolicyWriteGuardRows(policies) {
         return undefined;
     return async (at) => (await Promise.all(sources.map((rowsOf) => rowsOf(at)))).flat();
 }
-export function namespacedCoveringEntries(entries, behavior) {
-    return (entries ?? []).filter((entry) => isNamespacedCoveringRuleName(entry, behavior));
+export function coveringRuleEntries(entries, behavior) {
+    return (entries ?? []).filter((entry) => isCoveringRuleName(entry, behavior));
 }
-function allowlistNameRefusal(who, entry, list) {
-    if (typeof entry !== "string")
-        return undefined;
-    const sentence = wildcardPeerRefusalOf(ruleSpellingOf(entry)?.toolName ?? entry, "allow");
-    if (sentence === undefined)
-        return undefined;
-    const e = new Error(`${who}: ${list} entry "${entry}" — ${sentence}`);
-    e.code = "config.invalid_tool_name_set";
-    return e;
-}
-export function namespacedCoveringHit(covering, call) {
-    return covering.length > 0 && nameListHolds({ has: (name) => covering.some((e) => namespacedRuleNameCovers(e, name)) }, call);
+export function coveringRuleHit(covering, call) {
+    return covering.length > 0 && nameListHolds({ has: (name) => covering.some((e) => ruleNameCovers(e, name)) }, call);
 }
 export function projectionToolNames(c) {
     return c.kind === "shell_command" ? { member: "tools", list: c.tools } : { member: "names", list: c.names };
@@ -219,13 +143,13 @@ export function checkToolPolicyProjection(projection, req) {
     const listed = (list) => heldBy("policy.projectionReplay", { has: (n) => list.includes(n) }, req);
     for (const c of projection.components) {
         if (c.kind === "tool_deny") {
-            if (listed(c.names) || namespacedCoveringHit(namespacedCoveringEntries(c.names, "deny"), req)) {
+            if (listed(c.names) || coveringRuleHit(coveringRuleEntries(c.names, "deny"), req)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by a frozen inherited policy projection` };
             }
             continue;
         }
         if (c.kind === "tool_allowlist") {
-            if (!listed(c.names) && !namespacedCoveringHit(namespacedCoveringEntries(c.names, "allow"), req)) {
+            if (!listed(c.names) && !coveringRuleHit(coveringRuleEntries(c.names, "allow"), req)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in a frozen inherited policy projection's allowlist` };
             }
             continue;
@@ -300,6 +224,12 @@ const HOOK_SEAM_UNREAD = new Set(["decisionReason"]);
 const HOOK_SEAM_OPTIONAL = new Set(["action"]);
 const HOOK_RECEIPTS = new WeakSet();
 const ENGINE_RECEIPTS = new WeakSet();
+function askOfAnotherCall(d, call) {
+    if (call === undefined || d.action !== "ask" || d.attestation === undefined || attestationOf(d, call) !== undefined)
+        return undefined;
+    return refusedOutOfContract(`a permission decision asks with the engine's record of another call — what the engine found about that call's question is not this call's; ` +
+        `a policy answers the call it is asked about (a cached or relayed ask is asked again); denied fail-closed rather than reading the findings as absent`);
+}
 export function refuseOutOfContractDecision(d, opts) {
     const hookSeam = opts?.reasonIsNonInput === true;
     if (hookSeam && (d === null || d === undefined || Object.is(d, false)))
@@ -308,7 +238,7 @@ export function refuseOutOfContractDecision(d, opts) {
         return refusedOutOfContract(`a permission decision's "action" is absent (the decision is ${d === null || d === undefined ? String(d) : `a ${typeof d}`}, not an object) — the closed set is allow/deny/ask; denied fail-closed rather than reading a word outside it as an allow`);
     }
     if ((hookSeam ? HOOK_RECEIPTS : ENGINE_RECEIPTS).has(d) || isEngineRefusal(d))
-        return d;
+        return askOfAnotherCall(d, opts?.call) ?? d;
     const decision = receiveContract(d, hookSeam ? HOOK_RESULT_MEMBERS : DECISION_MEMBERS, "", RETIRED_DECISION_MEMBERS);
     if (decision.kind === "refused")
         return decision.refused;
@@ -323,13 +253,9 @@ export function refuseOutOfContractDecision(d, opts) {
             : `a permission decision carries an "attestation" the engine did not mint — the member is an engine record (who settled the call, ` +
                 `which question it answered); denied fail-closed rather than reading a caller's value as a settlement`);
     }
-    const folded = contract.foldedAskClasses;
-    const signed = attestation?.foldedClasses;
-    if (folded !== undefined && !(signed !== undefined && Array.isArray(folded) && signed.length === folded.length && signed.every((c, i) => c === folded[i]))) {
-        return refusedOutOfContract(`a permission decision carries "foldedAskClasses" that no policy fold of the engine attested on it — the member is ` +
-            `engine-written (combinePolicies records the classes of the asks it collapsed); denied fail-closed rather than letting a ` +
-            `class no station judged reach the class derivation`);
-    }
+    const foreign = askOfAnotherCall({ action: contract.action, attestation }, opts?.call);
+    if (foreign !== undefined)
+        return foreign;
     if (hookSeam && contract.additionalContext !== undefined && typeof contract.additionalContext !== "string") {
         return refusedOutOfContract(`a PreToolUse hook result's "additionalContext" is not a string — the member is the text appended for the model; denied fail-closed rather than rendering a value this layer cannot classify`);
     }
@@ -387,86 +313,75 @@ export function toolPolicyNameSets(p) {
     const sets = p?.nameSets;
     return Array.isArray(sets) ? sets : [];
 }
-export function createAllowDenyPolicy(opts) {
-    assertNoRetiredKeys(opts, RETIRED_ALLOW_DENY_POLICY_OPTIONS, "createAllowDenyPolicy");
-    const invalid = [];
-    const screen = (entries, list) => {
-        if (entries === undefined)
-            return undefined;
-        const kept = [];
-        const seen = new Set();
-        for (const entry of entries) {
-            const ns = protocolOf(entry);
-            if (ns !== undefined) {
-                const suffix = entry.slice(ns.prefix.length);
-                const sep = suffix.indexOf("__");
-                const malformed = suffix.length === 0 || sep === 0 || (sep > 0 && suffix.length === sep + 2);
-                if (malformed) {
-                    const family = ns.id.toUpperCase();
-                    const lesson = `a malformed ${family} tool name (empty peer or tool segment) — it can never match any mounted tool. ` +
-                        `Use \`${ns.prefix}<peer>\` for every tool of a peer, or \`${ns.prefix}<peer>__<tool>\` for one tool.`;
-                    invalid.push({ entry, list, message: `"${entry}" is ${lesson}`, lesson });
-                    continue;
-                }
-            }
-            const spelled = ruleSpellingOf(entry);
-            if (spelled === undefined) {
-                const lesson = `a spelling no tool name can have — the rule syntax reads no tool name in it, so a name set never names a tool by it. Fix the entry.`;
+function screenToolNameList(entries, list, behavior, invalid) {
+    if (entries === undefined)
+        return undefined;
+    const kept = [];
+    const seen = new Set();
+    for (const entry of entries) {
+        const ns = protocolOf(entry);
+        if (ns !== undefined) {
+            const suffix = entry.slice(ns.prefix.length);
+            const sep = suffix.indexOf("__");
+            if (suffix.length === 0 || sep === 0 || (sep > 0 && suffix.length === sep + 2)) {
+                const lesson = `a malformed ${ns.id.toUpperCase()} tool name (empty peer or tool segment) — it can never match any mounted tool. ` +
+                    `Use \`${ns.prefix}<peer>\` for every tool of a peer, or \`${ns.prefix}<peer>__<tool>\` for one tool.`;
                 invalid.push({ entry, list, message: `"${entry}" is ${lesson}`, lesson });
                 continue;
             }
-            if (ruleContentOf(spelled) === undefined) {
-                if (spelled.toolName === "*" && list === "deny") {
-                    const lesson = `the wildcard — \`*\` names no tool, and a deny entry reaches the tool it names, so this one would be kept and never match ` +
-                        `(a deny that reads protective and denies nothing). Name the tools to deny; to leave a run no tools, write an empty allow list.`;
-                    invalid.push({ entry, list, message: `"${entry}" is ${lesson}`, lesson });
-                    continue;
-                }
-                const wild = list === "allow" ? wildcardPeerRefusalOf(spelled.toolName, "allow") : undefined;
-                if (wild !== undefined) {
-                    invalid.push({ entry, list, message: `"${entry}": ${wild}`, lesson: wild });
-                    continue;
-                }
-                if (!seen.has(spelled.toolName)) {
-                    seen.add(spelled.toolName);
-                    kept.push(spelled.toolName);
-                }
-                continue;
-            }
+        }
+        const spelled = ruleSpellingOf(entry);
+        if (spelled === undefined) {
+            const lesson = `a spelling no tool name can have — the rule syntax reads no tool name in it, so a name set never names a tool by it. Fix the entry.`;
+            invalid.push({ entry, list, message: `"${entry}" is ${lesson}`, lesson });
+            continue;
+        }
+        if (ruleContentOf(spelled) !== undefined) {
             const lesson = `a rule CONTENT form, not a tool name — a name set matches raw tool names, so this entry ` +
                 `can never match any mounted tool (in an allow list it removes the tool entirely). Use the tool NAME here, ` +
                 `and route the narrowing through the lane that speaks this grammar: parameter rules via ` +
                 `createPermissionRulePolicy, Bash command prefixes via the persisted allow-rule lane.`;
             invalid.push({ entry, list, message: `"${entry}" is ${lesson}`, lesson });
+            continue;
         }
-        return kept;
-    };
-    const screenedAllow = screen(opts.allow, "allow");
-    const screenedDeny = screen(opts.deny, "deny");
-    if (invalid.length > 0) {
-        if ((opts.onInvalidName ?? "throw") === "throw") {
-            const byLesson = new Map();
-            for (const i of invalid) {
-                const group = byLesson.get(i.lesson) ?? [];
-                group.push({ entry: i.entry, list: i.list });
-                byLesson.set(i.lesson, group);
-            }
-            const e = new Error(`createAllowDenyPolicy: ${invalid.length} entr${invalid.length === 1 ? "y is" : "ies are"} not tool name(s):\n` +
-                [...byLesson.entries()]
-                    .map(([lesson, group]) => `  Each of the following is ${lesson}\n` + group.map((g) => `    [${g.list}] "${g.entry}"`).join("\n"))
-                    .join("\n"));
-            e.code = "config.invalid_tool_name_set";
-            e.issues = invalid;
-            throw e;
+        const wild = behavior === "allow" ? grantWildcardRefusalOf(spelled.toolName) : undefined;
+        if (wild !== undefined) {
+            invalid.push({ entry, list, message: `"${entry}": ${wild}`, lesson: wild });
+            continue;
         }
+        if (!seen.has(spelled.toolName)) {
+            seen.add(spelled.toolName);
+            kept.push(spelled.toolName);
+        }
+    }
+    return kept;
+}
+function toolNameSetRefusal(who, invalid) {
+    const byLesson = new Map();
+    for (const i of invalid)
+        byLesson.set(i.lesson, [...(byLesson.get(i.lesson) ?? []), { entry: i.entry, list: i.list }]);
+    const e = new Error(`${who}: ${invalid.length} entr${invalid.length === 1 ? "y is" : "ies are"} not tool name(s):\n` +
+        [...byLesson.entries()].map(([lesson, group]) => `  Each of the following is ${lesson}\n` + group.map((g) => `    [${g.list}] "${g.entry}"`).join("\n")).join("\n"));
+    e.code = "config.invalid_tool_name_set";
+    e.issues = invalid;
+    return e;
+}
+export function createAllowDenyPolicy(opts) {
+    assertNoRetiredKeys(opts, RETIRED_ALLOW_DENY_POLICY_OPTIONS, "createAllowDenyPolicy");
+    const invalid = [];
+    const screenedAllow = screenToolNameList(opts.allow, "allow", "allow", invalid);
+    const screenedDeny = screenToolNameList(opts.deny, "deny", "deny", invalid);
+    if (invalid.length > 0) {
+        if ((opts.onInvalidName ?? "throw") === "throw")
+            throw toolNameSetRefusal("createAllowDenyPolicy", invalid);
         for (const issue of invalid)
             opts.onInvalidNameIssue?.(issue);
     }
     opts = { ...opts, ...(screenedAllow ? { allow: screenedAllow } : {}), ...(screenedDeny ? { deny: screenedDeny } : {}) };
     const allow = opts.allow ? new Set(opts.allow) : undefined;
     const deny = new Set(opts.deny ?? []);
-    const denyCovering = namespacedCoveringEntries(opts.deny, "deny");
-    const allowCovering = namespacedCoveringEntries(opts.allow, "allow");
+    const denyCovering = coveringRuleEntries(opts.deny, "deny");
+    const allowCovering = coveringRuleEntries(opts.allow, "allow");
     return {
         projection: {
             components: [
@@ -477,10 +392,10 @@ export function createAllowDenyPolicy(opts) {
         },
         nameSets: [{ ...(opts.allow ? { allow: [...opts.allow] } : {}), ...(opts.deny ? { deny: [...opts.deny] } : {}) }],
         check(req) {
-            if (nameListHolds(deny, req) || namespacedCoveringHit(denyCovering, req)) {
+            if (nameListHolds(deny, req) || coveringRuleHit(denyCovering, req)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
-            if (allow && !nameListHolds(allow, req) && !namespacedCoveringHit(allowCovering, req)) {
+            if (allow && !nameListHolds(allow, req) && !coveringRuleHit(allowCovering, req)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in the allowlist` };
             }
             return ALLOW;
@@ -497,19 +412,21 @@ export function createApprovalPolicy(opts) {
     if (opts.approvalTimeoutMs !== undefined && opts.approvalTimeoutMs > 2_147_483_647) {
         throw new Error(`createApprovalPolicy: approvalTimeoutMs must not exceed 2147483647ms (~24.8 days) (got ${opts.approvalTimeoutMs}) — a host timer truncates a larger delay and fires immediately, denying every request at once; omit it to wait indefinitely`);
     }
-    for (const [list, entries] of [["autoAllow", opts.autoAllow ?? []], ["requireApproval", opts.denyByDefault === true ? opts.requireApproval : []]]) {
-        for (const entry of entries) {
-            const refusal = allowlistNameRefusal("createApprovalPolicy", entry, list);
-            if (refusal !== undefined)
-                throw refusal;
-        }
-    }
+    const invalid = [];
+    const requireApproval = screenToolNameList(opts.requireApproval, "requireApproval", "ask", invalid) ?? [];
+    const denied = screenToolNameList(opts.deny, "deny", "deny", invalid);
+    const autoAllow = screenToolNameList(opts.autoAllow, "autoAllow", "allow", invalid);
+    if (opts.denyByDefault === true)
+        screenToolNameList(requireApproval, "requireApproval", "allow", invalid);
+    if (invalid.length > 0)
+        throw toolNameSetRefusal("createApprovalPolicy", invalid);
+    opts = { ...opts, requireApproval, ...(denied !== undefined ? { deny: denied } : {}), ...(autoAllow !== undefined ? { autoAllow } : {}) };
     const need = new Set(opts.requireApproval);
     const deny = new Set(opts.deny ?? []);
     const auto = new Set(opts.autoAllow ?? []);
-    const needCovering = namespacedCoveringEntries(opts.requireApproval, "ask");
-    const denyCovering = namespacedCoveringEntries(opts.deny, "deny");
-    const autoCovering = namespacedCoveringEntries(opts.autoAllow, "allow");
+    const needCovering = coveringRuleEntries(opts.requireApproval, "ask");
+    const denyCovering = coveringRuleEntries(opts.deny, "deny");
+    const autoCovering = coveringRuleEntries(opts.autoAllow, "allow");
     return {
         projection: {
             components: [
@@ -526,10 +443,10 @@ export function createApprovalPolicy(opts) {
             },
         ],
         async check(req, signal) {
-            if (nameListHolds(deny, req) || namespacedCoveringHit(denyCovering, req)) {
+            if (nameListHolds(deny, req) || coveringRuleHit(denyCovering, req)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
-            if (nameListHolds(need, req) || namespacedCoveringHit(needCovering, req)) {
+            if (nameListHolds(need, req) || coveringRuleHit(needCovering, req)) {
                 const attestOver = (inputDigest) => (d, settlement, bindingRefusal) => ({ ...d, attestation: mintAttestation(req, { settlement, origin: "policy", ...(inputDigest !== undefined ? { inputDigest } : {}), ...(bindingRefusal !== undefined ? { bindingRefusal } : {}) }) });
                 const unasked = unaskedSeatAnswer(req, signal, { aborted: `approval aborted for "${req.toolName}" (run or turn interrupted)`, unreachable: `approval for "${req.toolName}" was not requested: nobody can be asked about this call` }, "policy");
                 if (unasked !== undefined)
@@ -592,7 +509,7 @@ export function createApprovalPolicy(opts) {
                 }
                 return attest({ action: "deny", message: `approval denied for "${req.toolName}"` }, settledByDecider("person", "refused", undefined));
             }
-            if (nameListHolds(auto, req) || namespacedCoveringHit(autoCovering, req))
+            if (nameListHolds(auto, req) || coveringRuleHit(autoCovering, req))
                 return ALLOW;
             if (opts.denyByDefault) {
                 return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
@@ -636,7 +553,6 @@ export function combinePolicies(...policies) {
             let asked;
             let current = Object.freeze({ ...req });
             let rewrite;
-            let records;
             let ruleAskText;
             let probeMandateSeen = false;
             let mandateSeen = false;
@@ -644,25 +560,64 @@ export function combinePolicies(...policies) {
             let noRulingSeen;
             let authoredBySeen = false;
             const contributors = [];
-            const settleDeny = (d) => {
+            const decisions = [];
+            const recordsExcept = (at) => decisions.reduce((acc, d, j) => (j !== at && d?.action === "allow" && d.attestation !== undefined ? mergeAttestation(req, acc, d.attestation) : acc), undefined);
+            const settleDeny = (d, at) => {
                 const out = rewrite !== undefined ? refusalOf(d, current.args) : d;
+                const records = recordsExcept(at);
                 if (records === undefined)
                     return out;
                 return { ...out, attestation: mergeAttestation(req, records, d.attestation) };
             };
             let seatDeny;
-            for (const p of policies) {
-                const d = refuseOutOfContractDecision(await p.check(current, signal));
+            const denied = (d, at) => {
+                decisions[at] = undefined;
+                if (!seatNeverAsked(attestationOf(d, current)?.settlement))
+                    return settleDeny(d, at);
+                seatDeny ??= settleDeny(d, at);
+                return undefined;
+            };
+            let emitter = -1;
+            let personWrote = false;
+            for (const [at, p] of policies.entries()) {
+                const d = refuseOutOfContractDecision(await p.check(current, signal), { call: req });
                 if (d.action === "deny") {
-                    if (!seatNeverAsked(attestationOf(d, current)?.settlement))
-                        return settleDeny(d);
-                    seatDeny ??= settleDeny(d);
+                    const ended = denied(d, at);
+                    if (ended !== undefined)
+                        return ended;
                     continue;
                 }
-                if (d.updatedInput !== undefined) {
+                decisions[at] = d;
+                if (readRejudge(current, current.args, d).kind === "rewritten") {
+                    if (personWrote)
+                        return settleDeny({ action: "deny", message: `${editRewrittenSentence(req.toolName)}, which a later policy layer wrote over a person's edit — denied fail-closed` }, at);
                     current = Object.freeze(await withArgsReading(current, d.updatedInput, signal));
                     rewrite = d;
+                    emitter = at;
+                    personWrote = attestationOf(d, current)?.settlement?.who.party === "person" && answeredFor(d, req, current.args);
+                }
+            }
+            for (let at = 0; at < emitter; at++) {
+                const p = policies[at];
+                const d = refuseOutOfContractDecision(await p.check(current, signal), { call: req });
+                if (d.action === "deny") {
+                    const ended = denied(d, at);
+                    if (ended !== undefined)
+                        return ended;
+                    continue;
                 }
+                if (readRejudge(current, current.args, d).kind === "rewritten")
+                    return settleDeny({ action: "deny", message: rewriteChasedSentence(req.toolName) }, at);
+                const { updatedInput: _sameBytes, ...asIs } = d;
+                const first = decisions[at];
+                decisions[at] = asIs.action === "allow" && first?.action === "allow" && first.attestation !== undefined ? withAttestation(asIs, mergeAttestation(req, first.attestation, asIs.attestation)) : asIs;
+            }
+            if (seatDeny !== undefined)
+                return seatDeny;
+            let records;
+            for (const d of decisions) {
+                if (d === undefined)
+                    continue;
                 if (d.action === "allow" && d.attestation !== undefined)
                     records = mergeAttestation(req, records, d.attestation);
                 if (d.action === "ask" && (asked === undefined || (d.requiresRealApproval === true && asked.requiresRealApproval !== true))) {
@@ -684,8 +639,6 @@ export function combinePolicies(...policies) {
                 if (d.action === "ask")
                     contributors.push(d);
             }
-            if (seatDeny !== undefined)
-                return seatDeny;
             if (asked) {
                 const merged = rewrite?.updatedInput;
                 const withRuleAsk = ruleAskText !== undefined && asked.matchedAskRule === undefined ? { ...asked, matchedAskRule: ruleAskText } : asked;
@@ -694,16 +647,15 @@ export function combinePolicies(...policies) {
                 const withFallback = fallbackSeen !== undefined && withMandate.denialLimitFallback === undefined ? { ...withMandate, denialLimitFallback: fallbackSeen, requiresRealApproval: true } : withMandate;
                 const withNoRuling = noRulingSeen !== undefined && withFallback.classifierNoRuling === undefined ? { ...withFallback, classifierNoRuling: noRulingSeen, requiresRealApproval: true } : withFallback;
                 const withAuthor = authoredBySeen && withNoRuling.authoredBy === undefined ? { ...withNoRuling, authoredBy: "deployment" } : withNoRuling;
-                const folded = new Set(withAuthor.foldedAskClasses ?? []);
+                const folded = new Set(attestationOf(asked, req)?.foldedClasses ?? []);
                 for (const c of contributors)
                     if (c !== asked)
-                        for (const k of decisionAskClassesOf(c))
+                        for (const k of decisionAskClassesOf(c, req))
                             folded.add(k);
                 if (withNoRuling !== withMandate)
-                    for (const k of decisionAskClassesOf(asked))
+                    for (const k of decisionAskClassesOf(asked, req))
                         folded.add(k);
-                const withClasses = folded.size > 0 ? { ...withAuthor, foldedAskClasses: [...folded] } : withAuthor;
-                const out = merged !== undefined ? { ...withClasses, updatedInput: merged } : withClasses;
+                const out = merged !== undefined ? { ...withAuthor, updatedInput: merged } : withAuthor;
                 return folded.size > 0 ? attest(out, req, { foldedClasses: [...folded] }) : out;
             }
             const allowed = rewrite ?? ALLOW;
@@ -780,17 +732,17 @@ export function createUnverifiableDeletePolicy(opts) {
             if (typeof command !== "string")
                 return ALLOW;
             const removal = removalReadingOf(command, req, opts?.removalSeat, safeRoots);
-            return removal === undefined ? ALLOW : removal.judge(signal).then((found) => (found === undefined ? ALLOW : removalAsk(found.guard, found.text)));
+            return removal === undefined ? ALLOW : removal.judge(signal).then((found) => (found === undefined ? ALLOW : removalAsk(req, found.guard, found.text)));
         },
     }, "external_authority");
 }
-function removalAsk(guard, text) {
+function removalAsk(req, guard, text) {
     const messages = {
         dangerous_delete: `Dangerous removal: ${text}. No permission mode, allow rule or classifier clears this — only a person confirming this call does.`,
         unverifiable_delete: `Unverifiable recursive delete (fail-closed unless cleared): ${text}. Re-run the delete with the resolved literal path written into the command itself (or assign the variable a literal path in the same command, e.g. \`DIR=/exact/path; rm -rf "$DIR"\`) so the target can be verified.`,
-        unverifiable_shell_text: `Unverifiable shell text (fail-closed unless cleared): ${text}. Write the text into the command itself (a \`-c\` string, a here-document or a here-string) and the engine reads it as it reads any command.`,
+        unverifiable_shell_text: `Unverifiable shell text (fail-closed unless cleared): ${text}.`,
     };
-    return { action: "ask", decisionReason: "safety", requiresRealApproval: true, guards: [guard], message: messages[guard] };
+    return attest({ action: "ask", decisionReason: "safety", requiresRealApproval: true, message: messages[guard] }, req, { guards: [guard] });
 }
 function pathSegments(p) {
     return p.split(/[\\/]/).filter(Boolean);
@@ -859,16 +811,15 @@ export function createTranscriptIntegrityPolicy(opts) {
         }
         return false;
     };
-    const askReason = (what) => ({
+    const askReason = (req, what) => attest({
         action: "ask",
         decisionReason: "safety",
         requiresRealApproval: true,
-        guards: ["transcript_write"],
         message: `Session-transcript write (fail-closed unless cleared): ${what}. Session transcripts (the .jsonl files ` +
             `under the agent data dir's sessions/ directory) are harness-written session state, not agent working ` +
             `files — modifying or deleting them tampers with the run's own audit trail. Reading them (ls/cat/grep ` +
             `as a single simple command) is fine.`,
-    });
+    }, req, { guards: ["transcript_write"] });
     return brandPolicyAskClass({
         check(req) {
             if (shellToolsListHolds(shellTools, req)) {
@@ -882,7 +833,7 @@ export function createTranscriptIntegrityPolicy(opts) {
                 const parsed = parseLeadingCommandName(command);
                 if ("name" in parsed && readAllow.has(parsed.name))
                     return ALLOW;
-                return askReason("name" in parsed
+                return askReason(req, "name" in parsed
                     ? `\`${parsed.name}\` is not a read-only command${cwdInsideProtected ? " and the shell's working directory is inside the transcript directory" : ""}`
                     : cwdInsideProtected
                         ? "the shell's working directory is inside the transcript directory and this is not a single read-only command (fail-closed)"
@@ -892,7 +843,7 @@ export function createTranscriptIntegrityPolicy(opts) {
             if (writeTarget !== undefined && writeTarget.access !== "read") {
                 const p = writeTargetPath(req);
                 if (typeof p === "string" && inProtectedDir(p, req.cwd)) {
-                    return askReason(`"${p}" is inside the session-transcript directory`);
+                    return askReason(req, `"${p}" is inside the session-transcript directory`);
                 }
             }
             return ALLOW;

package/dist/core/tool-result-store.js

@@ -6,6 +6,7 @@ import { deliverEngineNotice } from "./types.js";
 import { TOOL_SEARCH_NAME } from "./runner/tool-disclosure.js";
 import { mountRuleFace, toolFace } from "./tool-catalog-entries.js";
 import { thrownText } from "./thrown-value.js";
+import { carryNotStartedReceipt } from "./delegation-not-started.js";
 export const TOOL_RESULT_REF_CONFLICT_CODE = "tool_result.ref_conflict";
 export class ToolResultRefConflictError extends Error {
     ref;
@@ -239,6 +240,8 @@ export function withToolResultOffload(tool, store, thresholdChars, sessionId, re
     const wrappedExecute = async (toolCallId, params, signal, onUpdate) => {
         const res = await tool.execute(toolCallId, params, signal, onUpdate);
         const offloadedDetails = res.details === undefined ? undefined : await offloadOversizedDetailStrings(res.details, store, thresholdChars, sessionId, toolCallId, provenance);
+        if (offloadedDetails !== undefined)
+            carryNotStartedReceipt(res.details, offloadedDetails.value);
         const withDetails = (r) => offloadedDetails === undefined || offloadedDetails.value === res.details ? r : { ...r, details: offloadedDetails.value };
         if (totalTextChars(res.content) <= thresholdChars)
             return withDetails(res);