@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/allow-entry.js

@@ -1,6 +1,7 @@
 import { heldBy } from "./tool-name-readings.js";
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, ruleIssue } from "./permission-rules.js";
-import { parsePermissionRule, ruleSpellingOf } from "./permission-rule-syntax.js";
+import { ruleIssue } from "./permission-rules.js";
+import { isCoveringRuleName, ruleNameCovers } from "./namespaced-rule-name.js";
+import { ruleSpellingOf } from "./permission-rule-syntax.js";
 import { judgeRuleToolName, splitNamespacedName } from "./tool-name-aliases.js";
 import { catalogToolNames, isShellFaceToolName } from "./tool-registry.js";
 import { ALLOW_RULE_MEMBERS } from "./allow-rule-shadow.js";
@@ -58,7 +59,7 @@ export function readRuleEntry(raw, behavior, roster) {
     if (parsed === undefined)
         return inert("grammar");
     const name = parsed.toolName;
-    if (name === "*")
+    if (name === "*" && behavior === "allow")
         return inert("wildcard_all");
     if (roster !== undefined) {
         const stale = toolNameReading(name, roster, behavior);
@@ -66,14 +67,10 @@ export function readRuleEntry(raw, behavior, roster) {
             return stale;
     }
     if (ruleContentOf(parsed) === undefined) {
-        const split = splitNamespacedName(name);
-        if (split !== undefined) {
-            if (split.peer.includes("*"))
-                return isNamespacedCoveringRuleName(name, behavior) ? row({ kind: "namespace", pattern: name }) : inert("namespace_wildcard");
-            if (isNamespacedCoveringRuleName(name))
-                return row({ kind: "namespace", pattern: name });
-            return row({ kind: "tool", name });
-        }
+        if (isCoveringRuleName(name, behavior))
+            return row({ kind: "covering", pattern: name });
+        if (name.includes("*"))
+            return inert(splitNamespacedName(name) !== undefined ? "namespace_wildcard" : "grammar");
         return row(isShellFaceToolName(name) ? { kind: "shell", name } : { kind: "tool", name });
     }
     const grammar = ruleToolGrammarOf(name);
@@ -94,7 +91,7 @@ export function compiledEntryName(compiled) {
         case "tool":
         case "shell":
             return compiled.name;
-        case "namespace":
+        case "covering":
             return compiled.pattern;
         default:
             return compiled.rule.tool;
@@ -104,11 +101,10 @@ function inertReasonOf(code) {
     return code === "unsupported.tool" ? "content_unsupported" : "grammar";
 }
 export function compileAllowList(entries, behavior, roster) {
-    const voided = behavior === "allow" && entries.some(namesWholeRoster);
     const rows = [];
     const inert = [];
     for (const entry of entries) {
-        const read = typeof entry !== "string" || !voided ? readRuleEntry(entry, behavior, roster) : { kind: "inert", reason: "wildcard_all" };
+        const read = readRuleEntry(entry, behavior, roster);
         if (read.kind === "row")
             rows.push({ entry, compiled: read.compiled });
         else {
@@ -119,9 +115,6 @@ export function compileAllowList(entries, behavior, roster) {
     }
     return { rows, inert };
 }
-function namesWholeRoster(entry) {
-    return typeof entry === "string" && entry === entry.trim() && parsePermissionRule(entry).toolName === "*";
-}
 function answersTo(req, has) {
     return heldBy("allowEntry.names", { has }, req);
 }
@@ -160,7 +153,7 @@ export function autoStripped(compiled, call) {
             return call !== undefined && answersTo(call, isShellFaceToolName);
         case "command":
             return compiled.rule.match === "pattern" ? commandPatternMayRun(compiled.rule.command, AUTO_STRIPPED_PROGRAMS) : shellContentStripped(shellRuleContent(compiled.rule));
-        case "namespace":
+        case "covering":
         case "path":
         case "name":
         case "domain":
@@ -176,7 +169,7 @@ export function autoStrippedRule(rule, call) {
 }
 const NO_LEADS = new Map();
 function nameRowReaches(compiled, req) {
-    const covers = compiled.kind === "namespace" ? (n) => namespacedRuleNameCovers(compiled.pattern, n) : compiled.kind === "tool" || compiled.kind === "shell" ? (n) => n === compiled.name : undefined;
+    const covers = compiled.kind === "covering" ? (n) => ruleNameCovers(compiled.pattern, n) : compiled.kind === "tool" || compiled.kind === "shell" ? (n) => n === compiled.name : undefined;
     return covers !== undefined && answersTo(req, covers);
 }
 function commandOf(req) {
@@ -348,6 +341,16 @@ export function allowRuleShadowOf(member, entries) {
     const shown = entries.slice(0, SHADOW_ENTRIES_MAX).map((e) => inlineUntrusted(e, SHADOW_ENTRY_MAX_CHARS));
     return { member, entries: shown, ...(entries.length > shown.length ? { omitted: entries.length - shown.length } : {}) };
 }
+export function withAllowRuleShadow(list, shadow) {
+    const at = list.findIndex((s) => s.member === shadow.member);
+    if (at < 0)
+        return [...list, shadow];
+    const held = list[at];
+    const entries = [...held.entries, ...shadow.entries];
+    const shown = entries.slice(0, SHADOW_ENTRIES_MAX);
+    const omitted = (held.omitted ?? 0) + (shadow.omitted ?? 0) + (entries.length - shown.length);
+    return list.map((s, i) => (i === at ? { member: held.member, entries: shown, ...(omitted > 0 ? { omitted } : {}) } : s));
+}
 const MEMBER_SET = new Set(ALLOW_RULE_MEMBERS);
 export function readAllowRuleShadows(value) {
     try {
@@ -432,10 +435,11 @@ export function allowRuleShadowSentence(shadows, ask) {
 }
 export function cardDisclosureOf(decision, fallbackMessage) {
     const base = decision.message ?? fallbackMessage;
+    const outlet = decision.editRewritten !== undefined ? { editRewritten: decision.editRewritten } : {};
     const shadows = readAllowRuleShadows(decision.allowRuleShadowed);
     if (shadows === undefined)
-        return { message: base };
-    return { message: `${base} (${allowRuleShadowSentence(shadows, decision)})`, allowRuleShadowed: shadows };
+        return { message: base, ...outlet };
+    return { message: `${base} (${allowRuleShadowSentence(shadows, decision)})`, allowRuleShadowed: shadows, ...outlet };
 }
 export const ALLOWED_TOOL_NOT_GRANTED_CODE = "permission.allowed_tool_not_granted";
 const NOTICE_ENTRIES_SHOWN = 5;
@@ -486,7 +490,7 @@ export function allowedToolsNotGrantedNotice(inert, sessionId) {
     return {
         code: ALLOWED_TOOL_NOT_GRANTED_CODE,
         message: `${inert.length} allowed-tools entr${inert.length === 1 ? "y grants" : "ies grant"} or refuse${inert.length === 1 ? "s" : ""} nothing — ${shown.join("; ")}${rest > 0 ? `; and ${rest} more` : ""}. ` +
-            "A list holding `*` voids the list, `mcp__*` names no server, a rule the grammar refuses (`grammar`) or one on a tool with no such rule form (`content_unsupported`: an allow by path is an `Edit(…)` or `Read(…)` rule) grants nothing, and a tool name must be spelled as the tool is mounted; name the tools (or `mcp__<server>`) instead." +
+            "On an allow list a `*` outside a protocol name's tool segment (`*`, `Re*d`, `mcp__*`) names no scope and grants nothing — the entries beside it still grant — and a rule the grammar refuses (`grammar`) or one on a tool with no such rule form (`content_unsupported`: an allow by path is an `Edit(…)` or `Read(…)` rule) grants nothing; a tool name must be spelled as the tool is mounted; name the tools (or `mcp__<server>`) instead." +
             (refusing ? " Such an entry in a disallowed-tools list keeps its Skill from activating: a refusal that reads as nothing is not dropped." : ""),
         detail: { ...(sessionId !== undefined ? { sessionId } : {}), entries: inert.map((e) => ({ ...e, entry: noticeRuleText(e.entry) })) },
     };

package/dist/core/allow-rule-shadow.d.ts

@@ -8,9 +8,9 @@
  *  `TaskSpec.allowedTools`. The closed set {@link AllowRuleShadow.member} names. */
 export declare const ALLOW_RULE_MEMBERS: readonly ["hook", "deployment", "persisted", "skill", "request"];
 export type AllowRuleMember = (typeof ALLOW_RULE_MEMBERS)[number];
-/** One allow-layer member that matched a call and could not clear its ask: the member, and the entries it matched as their
- *  source spells them (sanitized and capped at the mint; a hook names none — its word is about the call, not an entry).
- *  `omitted` counts entries beyond the cap, never dropped silently. */
+/** One allow-layer member that matched a call and could not clear its ask — one record per member: the member, and the
+ *  entries it matched as their source spells them (sanitized and capped at the mint; the hook member names the registrations
+ *  that spoke). `omitted` counts entries beyond the cap, never dropped silently. */
 export interface AllowRuleShadow {
     readonly member: AllowRuleMember;
     readonly entries: readonly string[];

package/dist/core/ask-origin.d.ts

@@ -25,6 +25,7 @@
  * the ask). Both stay where they are and are consumed beside the origin, not folded into it.
  */
 import type { PermissionResult } from "./tool-policy.js";
+import { type EngineAttestation } from "./engine-attestation.js";
 import type { ContainmentFace } from "../tools/fs/containment-face.js";
 /**
  * The closed set, in AUTHORITY order — the order {@link askOriginOf} resolves a fold in when several
@@ -93,6 +94,12 @@ export type AssertAllKeysHandled<T extends never> = T;
  *  itself. Every member is a plain boolean/word read ONCE by the gate, so the derivation is a pure
  *  function that a test can drive arm by arm. */
 export interface AskOriginFacts {
+    /** The call these facts are about — the one an engine record on the decision must be bound to for the derivation to read it
+     *  ({@link import("./engine-attestation.js").attestationOf}): a record handed back for another call reads as absent. */
+    readonly call: {
+        readonly toolCallId: string;
+        readonly toolName: string;
+    };
     /** The call is on the reserved question tool. */
     readonly contentQuestion: boolean;
     /** The call is marked unresolvable by an ancestor (see the gate's `isMarkedUnresolvable` seat). */
@@ -148,7 +155,7 @@ export declare function askOriginOf(decision: Extract<PermissionResult, {
  * word, so a site that stamped without it would be a second, quieter answer to one question.
  * The same stamp writes the ask's CLASS members (`askClass` / `classes`, {@link askClassMembersOf} over the
  * `classification` the caller derived from this decision under these facts): the word and the class leave the
- * gate on one object, and a value a policy put on either is replaced.
+ * gate on one object. No policy states either (the decision receipt refuses a stamp member).
  */
 export declare function stampAskOrigin<T extends Extract<PermissionResult, {
     action: "ask";
@@ -237,10 +244,14 @@ export interface RuleClearanceFacts {
     /** The ask is being resolved at an ANCESTOR's frozen approver (the three inherited-lane mint sites
      *  pass it literally) — this task's rule lane never adjudicates it. */
     ancestorResolved?: boolean;
-    /** The classes of the contributors the policy fold carried under this ask (see {@link import("./tool-policy.js").PermissionResult});
-     *  a member whose row no rule may clear keeps the question a person's. */
-    foldedAskClasses?: readonly AskClass[];
+    /** The classes of the contributors the policy fold carried under this ask — the decision's engine record's
+     *  ({@link EngineAttestation.foldedClasses}), filled in by the builder of these facts ({@link withFoldedOf}); a member whose row
+     *  no rule may clear keeps the question a person's. */
+    foldedClasses?: readonly AskClass[];
 }
+/** `facts` with the folded contributors' classes the decision's record carries for its call — the one way a builder of
+ *  {@link RuleClearanceFacts} fills them (a decision carries no such member: the record is their one carrier). */
+export declare function withFoldedOf<F extends RuleClearanceFacts>(facts: F, record: EngineAttestation | undefined): F;
 /** The ask FACE's mandate members — the bit and its table word, spread at the four mint stations and the
  *  park row. The stations hand it the SAME facts object they hand the rule-offer factory, so the card's word
  *  and these members are readings of one derivation and cannot drift. The tool SEAT is not re-judged here:
@@ -265,10 +276,11 @@ export declare function withProbeMandate<D extends Extract<PermissionResult, {
 }>>(decision: D, account: string | undefined): D;
 /** The clearance facts of an ask the engine did not construct (a policy's verdict), each member read ONCE into
  *  an engine-owned value — for a station that keeps the answer past its own side effects, where the verdict's
- *  accessors must not run again. The members a verdict may carry that narrow what may clear it. */
+ *  accessors must not run again. The members a verdict may carry that narrow what may clear it, and the folded classes its
+ *  record carries for `call`. */
 export declare function ownedClearanceFacts(d: Extract<PermissionResult, {
     action: "ask";
-}>): RuleClearanceFacts;
+}>, call: AskOriginFacts["call"]): RuleClearanceFacts;
 /**
  * Which origins IMPLY the `requiresRealApproval` bit, and WHERE that implication is verified — the
  * consistency table {@link askOriginOf} reads. An ask of a must-carry origin exists so that no automatic
@@ -813,16 +825,22 @@ export declare function askClassMembersOf(c: AskClassification): AskClassMembers
  *  first member in {@link ASK_CLASSES} order. The copy returned is fresh and frozen, never the caller's array. */
 export declare function screenAskClassMembers(askClass: unknown, classes: unknown): AskClassMembers | undefined;
 /**
- * The DECISION half of the class derivation — what ONE ask says about itself through its own members, read
- * per contributing ask at the policy fold so a member the fold does not copy (a guard mark, the unreadable-rule
- * fact) is not lost behind the ask that won the slot. The bare-bit rules are applied over THIS ask's own set:
- * `requiresRealApproval` with no explaining class is `policy_rra`; a self-declared `mandated` with no other
- * class is `operator_forced` (a deployment probe's own mandate, read conservatively). Returns the specific
- * classes only — an empty set is "nothing but hesitation", which the caller reads as `ordinary`.
+ * The OWN half of the class derivation — what ONE ask says about itself through its own members, and the integrity guards
+ * its engine record carries for its call (`record`, read by the caller through {@link attestationOf}): the guards are engine
+ * findings, never a member, so a policy cannot move a real-approval question into a guard's class. The bare-bit rules are
+ * applied over THIS ask's own set: `requiresRealApproval` with no explaining class is `policy_rra`; a self-declared
+ * `mandated` with no other class is `operator_forced` (a deployment probe's own mandate, read conservatively). Returns the
+ * specific classes only — an empty set is "nothing but hesitation", which the caller reads as `ordinary`.
  */
+export declare function ownAskClassesOf(d: Extract<PermissionResult, {
+    action: "ask";
+}>, record: EngineAttestation | undefined): Set<AskClass>;
+/** The DECISION's classes as the policy fold reads a contributing ask: its own ({@link ownAskClassesOf}) and the classes of the
+ *  asks a fold already collapsed into it ({@link EngineAttestation.foldedClasses}) — both off its record for `call`, so a
+ *  fact the fold does not copy is not lost behind the ask that won the slot. */
 export declare function decisionAskClassesOf(d: Extract<PermissionResult, {
     action: "ask";
-}>): Set<AskClass>;
+}>, call: AskOriginFacts["call"]): Set<AskClass>;
 /** Fold a class set onto one row: `bypassImmune` and `hookAskFloor` by OR (any immune member keeps the ask; any floored
  *  member floors a hook's ask), the three permissive switches by AND (one refusing member withholds the lane). An empty
  *  set is `ordinary`. The two faces the ask was raised under enter HERE and nowhere else, so every reader of the folded row
@@ -865,9 +883,36 @@ export declare function dontAskRefusalMessage(input: {
  *  asked (`approvalReach: "none"`), whatever is wired. Absent in the input reads as `absent` (the posture the function was
  *  written for). */
 export type HeadlessApproverSeat = "absent" | "unavailable" | "declared_none";
+/** The kinds of way out a refusal carries as DATA: `approver` — a person who can answer becomes reachable (the sentence's approver clause);
+ *  `permission_mode` — a mode that releases the ask with nobody answering it (`bypassPermissions`, unless the deployment's caps deny it:
+ *  a denied bypass folds to `default`). A host renders a kind or leaves it unrendered; the sentence a user reads never teaches the release. */
+export declare const APPROVAL_REMEDY_KINDS: readonly ["approver", "permission_mode"];
+export type ApprovalRemedyKind = (typeof APPROVAL_REMEDY_KINDS)[number];
+/** Membership test for {@link ApprovalRemedyKind} — the word rides a notice detail across process boundaries. */
+export declare function isApprovalRemedyKind(v: unknown): v is ApprovalRemedyKind;
+/** One way out, discriminated by `kind` ({@link APPROVAL_REMEDY_KINDS}). `permission_mode` names the mode (`value`: `bypassPermissions`, the one
+ *  mode that releases an ask a person did not answer) and where the release is disclosed (`disclosedOn`: the allowed disposition's `released`
+ *  member on the call's `tool_end.gate`) — the disclosure a host shows beside the offer. */
+export type ApprovalRemedy = {
+    readonly kind: "approver";
+} | {
+    readonly kind: "permission_mode";
+    readonly value: "bypassPermissions";
+    readonly disclosedOn: "gate.disposition.released";
+};
+/** One {@link ApprovalRemedy} read from `v`, as a fresh plain object holding only the fields its kind owns — or `undefined` when `v` is not exactly
+ *  one (a kind outside the closed set, a member missing, a member beyond the kind's own, any field inherited rather than own). Each field is read
+ *  once; the notice mint copies through this and refuses what it cannot read. */
+export declare function readApprovalRemedy(v: unknown): ApprovalRemedy | undefined;
+/** The headless remedy: `sentence` — the user-facing way out, which names the approver and never offers the bypass release — and `remedies` — every way out as data, the approver first. */
+export interface HeadlessApprovalRemedy {
+    readonly sentence: string;
+    readonly remedies: readonly ApprovalRemedy[];
+}
 /**
- * The ONE sentence a headless auto-deny (an ask that reached its final deny because no approver is wired) adds
- * after its refusal: the caller-side change that would have let this call run. Read off the effective mode, the
+ * The ONE answer a headless auto-deny (an ask that reached its final deny because no approver is wired) adds
+ * after its refusal: the caller-side change that would have let this call run, as a sentence (`sentence`) and as the
+ * ways out in data (`remedies`, {@link ApprovalRemedy}: the approver in every arm). Read off the effective mode, the
  * ask's folded class row and whether the call is a covered write (the mode write gate's own question):
  *  · a class no permission mode releases (`bypassImmune`) — only a person can answer it: wire an approver;
  *  · the plan mode's own question (`mode`) — leave plan (steer the mode, or approve the plan) or wire an approver;
@@ -875,11 +920,12 @@ export type HeadlessApproverSeat = "absent" | "unavailable" | "declared_none";
  *    directories through without asking;
  *  · the same ask under `acceptEdits` — the target lies outside the working directories: add its directory to
  *    `additionalDirectories`;
- *  · any other releasable ask — `bypassPermissions` releases it (disclosed on the call).
+ *  · any other releasable ask, and a tool that states no permission of its own — `bypassPermissions` releases it (disclosed on the call):
+ *    the sentence does not say so; `remedies` carries it as a `permission_mode` member for a host that chooses to offer it.
  * Every arm also names the approver, in the clause of the seat's own state ({@link HeadlessApproverSeat}): none wired ⇒
  * wire one; one wired that answered `unavailable` for this ask ⇒ make a person reachable through it (a wired approver is
  * never told to be wired); the run declared nobody can be asked ⇒ run it where a person can be, or park it. The refusal's tool text and the `delegation.ask_unresolvable` notice both carry this sentence —
- * they call this function, neither spells it.
+ * they call this function, neither spells it — and the notice carries `remedies` beside it.
  * Under `dontAsk` (the mode answers no ask: {@link dontAskRefusalMessage} carries this arm) the one question is whether an allow
  * rule may clear the ask — the folded row's `ruleMayClear`, the allow layer's own reading: yes ⇒ add an allow rule covering the
  * call, in the tool's rule shape (`ruleShape`, the caller's reading of the call's grammar — never a rule minted for the call), or
@@ -894,7 +940,7 @@ export declare function headlessApprovalRemedy(input: {
     };
     readonly approverSeat?: HeadlessApproverSeat;
     readonly ruleShape?: string;
-}): string;
+}): HeadlessApprovalRemedy;
 /** The reference implementation's sentence for a `cp` / `mv` the mode will not answer because it carries option
  *  words — the approval card's message under `acceptEdits` and the head of the headless remedy. */
 export declare function fileCommandOptionsSentence(program: "cp" | "mv"): string;

package/dist/core/ask-origin.js

@@ -1,3 +1,4 @@
+import { attestationOf } from "./engine-attestation.js";
 import { isShellFaceToolName } from "./tool-registry.js";
 export const ASK_ORIGINS = Object.freeze(["content_question", "plan_review", "ancestor_marked", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"]);
 const ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
@@ -15,8 +16,8 @@ const TIGHTEN_ONLY_ORIGINS = new Set(["shell_gate_tighten", "safety_tighten"]);
 export function stampAskOrigin(decision, facts, classification) {
     const origin = askOriginOf(decision, facts);
     const classed = askClassMembersOf(classification);
-    const { mandate: _selfDeclared, ...unstamped } = decision;
-    const clearance = ruleClearanceOf(unstamped, facts.mandateMarks);
+    const { mandate: _earlierStamp, ...unstamped } = decision;
+    const clearance = ruleClearanceOf(withFoldedOf(unstamped, attestationOf(decision, facts.call)), facts.mandateMarks);
     const mandated = { ...unstamped, ...(clearance.mandated ? { mandated: true } : {}), ...(clearance.mandate !== undefined ? { mandate: clearance.mandate } : {}), ...(facts.mandateMarks.requiresUserInteraction === true ? { requiresRealApproval: true } : {}) };
     if (mandated.probeReadRootCandidate === undefined || TIGHTEN_ONLY_ORIGINS.has(origin))
         return { ...mandated, origin, ...classed };
@@ -26,7 +27,7 @@ export function stampAskOrigin(decision, facts, classification) {
 export const RULE_OFFERS_ABSENCES = Object.freeze(["mandated", "allow_outranked", "ask_rule_matched", "lane_cannot_speak"]);
 export function ruleClearanceOf(ask, marks) {
     const marksWord = ask?.crossBoundaryMandated === true ? "cross_boundary_taint" : persistedRuleMandateOf({ ...marks, probeMandated: ask?.probeMandated === true });
-    const foldedDoor = (ask?.foldedAskClasses ?? []).some((c) => !MODE_ARBITRATION[c].ruleMayClear);
+    const foldedDoor = (ask?.foldedClasses ?? []).some((c) => !MODE_ARBITRATION[c].ruleMayClear);
     const doorOutsideTable = ask?.requiresRealApproval === true || ask?.decisionReason === "hook" || ask?.decisionReason === "mode" || foldedDoor || ask?.authoredBy === "deployment" || ask?.inheritedUnresolved === true || ask?.ancestorResolved === true;
     const mandated = ask?.mandated === true || doorOutsideTable || marksWord !== undefined;
     const stampedWord = ask?.mandated === true && isPersistedRuleMandate(ask.mandate) ? ask.mandate : undefined;
@@ -52,6 +53,10 @@ export function ruleClearanceOf(ask, marks) {
     })();
     return { ...(word !== undefined ? { word } : {}), mandated, ...(mandate !== undefined ? { mandate } : {}) };
 }
+export function withFoldedOf(facts, record) {
+    const folded = record?.foldedClasses;
+    return folded !== undefined && folded.length > 0 ? { ...facts, foldedClasses: [...folded] } : facts;
+}
 export function askMandateMember(ask) {
     const { mandated, mandate } = ruleClearanceOf(ask, {});
     const authored = ask?.authoredBy === "deployment" ? { authoredBy: "deployment" } : {};
@@ -63,18 +68,17 @@ export function withProbeMandate(decision, account) {
     const { probeReason: _arrivedWith, ...rest } = decision;
     return { ...rest, probeMandated: true, ...(account !== undefined ? { probeReason: account } : {}) };
 }
-export function ownedClearanceFacts(d) {
-    const { mandated, requiresRealApproval, decisionReason, matchedAskRule, probeMandated, crossBoundaryMandated, authoredBy, foldedAskClasses } = d;
-    return {
+export function ownedClearanceFacts(d, call) {
+    const { mandated, requiresRealApproval, decisionReason, matchedAskRule, probeMandated, crossBoundaryMandated, authoredBy } = d;
+    return withFoldedOf({
         ...(crossBoundaryMandated === true ? { crossBoundaryMandated } : {}),
         ...(mandated === true ? { mandated } : {}),
-        ...(Array.isArray(foldedAskClasses) && foldedAskClasses.length > 0 ? { foldedAskClasses: [...foldedAskClasses] } : {}),
         ...(authoredBy === "deployment" ? { authoredBy } : {}),
         ...(requiresRealApproval === true ? { requiresRealApproval } : {}),
         ...(decisionReason !== undefined ? { decisionReason } : {}),
         ...(typeof matchedAskRule === "string" ? { matchedAskRule } : {}),
         ...(probeMandated === true ? { probeMandated } : {}),
-    };
+    }, attestationOf(d, call));
 }
 function originLadder(decision, facts) {
     if (facts.contentQuestion)
@@ -282,9 +286,9 @@ export function screenAskClassMembers(askClass, classes) {
         return undefined;
     return { askClass, classes: Object.freeze(ordered) };
 }
-export function decisionAskClassesOf(d) {
+export function ownAskClassesOf(d, record) {
     const out = new Set();
-    for (const guard of d.guards ?? [])
+    for (const guard of record?.guards ?? [])
         out.add(guard);
     if (d.ruleUnreadable !== undefined)
         out.add("rule_unreadable");
@@ -308,7 +312,12 @@ export function decisionAskClassesOf(d) {
         out.add("policy_rra");
     if (out.size === 0 && d.mandated === true)
         out.add("operator_forced");
-    for (const c of d.foldedAskClasses ?? [])
+    return out;
+}
+export function decisionAskClassesOf(d, call) {
+    const record = attestationOf(d, call);
+    const out = ownAskClassesOf(d, record);
+    for (const c of record?.foldedClasses ?? [])
         out.add(c);
     return out;
 }
@@ -328,7 +337,8 @@ export function foldArbitrationRow(classes, readFace, askFace) {
     return { bypassImmune, classifierEligible, sandboxAdmission, ruleMayClear, hookAskFloor };
 }
 export function classifyAsk(d, facts) {
-    const classes = decisionAskClassesOf({ ...d, foldedAskClasses: undefined });
+    const record = attestationOf(d, facts.call);
+    const classes = ownAskClassesOf(d, record);
     classes.delete("policy_rra");
     if (facts.contentQuestion)
         classes.add("content_question");
@@ -365,7 +375,7 @@ export function classifyAsk(d, facts) {
         classes.add(c);
     if (d.requiresRealApproval === true && ![...classes].some((c) => RRA_EXPLAINERS.has(c)))
         classes.add("policy_rra");
-    for (const c of d.foldedAskClasses ?? [])
+    for (const c of record?.foldedClasses ?? [])
         classes.add(c);
     if (classes.size === 0 && d.mandated === true)
         classes.add("operator_forced");
@@ -379,15 +389,45 @@ export function headlessDenialMessage(toolName, askMessage) {
 }
 const REFUSED_CAPABILITY_GUIDANCE = "IMPORTANT: you may try to accomplish this with other tools that would naturally be used for it (for example `head` instead of `cat`), but do not work around this denial in malicious ways — for example, do not use your ability to run tests to run non-test actions; only work around it in reasonable ways that keep to the intent behind it. If you believe this capability is essential to complete the user's request, STOP and explain to the user what you were trying to do and why you need this permission, and let the user decide how to proceed.";
 export function dontAskRefusalMessage(input) {
-    const remedy = headlessApprovalRemedy({ mode: "dontAsk", classification: input.classification, coveredWrite: input.coveredWrite, ruleShape: input.ruleShape });
+    const remedy = headlessApprovalRemedy({ mode: "dontAsk", classification: input.classification, coveredWrite: input.coveredWrite, ruleShape: input.ruleShape }).sentence;
     return `Permission to use ${input.toolName} has been denied because this run is in the dontAsk permission mode (this call needed approval: ${input.classification.askClass}). ${REFUSED_CAPABILITY_GUIDANCE} To let a call like this run: ${remedy}.`;
 }
+export const APPROVAL_REMEDY_KINDS = Object.freeze(["approver", "permission_mode"]);
+const APPROVAL_REMEDY_KIND_SET = new Set(APPROVAL_REMEDY_KINDS);
+export function isApprovalRemedyKind(v) {
+    return APPROVAL_REMEDY_KIND_SET.has(v);
+}
+export function readApprovalRemedy(v) {
+    if (typeof v !== "object" || v === null || Array.isArray(v))
+        return undefined;
+    const keys = Object.keys(v);
+    const field = (k) => (keys.includes(k) ? v[k] : undefined);
+    const kind = field("kind");
+    if (!isApprovalRemedyKind(kind))
+        return undefined;
+    switch (kind) {
+        case "approver":
+            return keys.length === 1 ? { kind } : undefined;
+        case "permission_mode": {
+            const value = field("value");
+            const disclosedOn = field("disclosedOn");
+            return keys.length === 3 && value === "bypassPermissions" && disclosedOn === "gate.disposition.released" ? { kind, value, disclosedOn } : undefined;
+        }
+        default: {
+            const _exhaustive = kind;
+            return _exhaustive;
+        }
+    }
+}
+const APPROVER_REMEDY = Object.freeze({ kind: "approver" });
+const RELEASE_REMEDY = Object.freeze({ kind: "permission_mode", value: "bypassPermissions", disclosedOn: "gate.disposition.released" });
 export function headlessApprovalRemedy(input) {
+    const way = (sentence, release = false) => ({ sentence, remedies: Object.freeze(release ? [APPROVER_REMEDY, RELEASE_REMEDY] : [APPROVER_REMEDY]) });
     if (input.mode === "dontAsk") {
         const c = input.classification;
-        return c?.row.ruleMayClear === true
+        return way(c?.row.ruleMayClear === true
             ? `an allow rule covering this call answers it under dontAsk — add one${input.ruleShape !== undefined ? ` in this tool's rule shape (\`${input.ruleShape}\`)` : ""} to the allow rules (a settings file's \`permissions.allow\`, or the request's or the deployment's allow list), or run under a mode with an approver`
-            : `no allow rule answers this ask${c !== undefined ? ` (${c.askClass})` : ""} — only a person can: run under a mode with an approver, or change the call`;
+            : `no allow rule answers this ask${c !== undefined ? ` (${c.askClass})` : ""} — only a person can: run under a mode with an approver, or change the call`);
     }
     const approver = input.approverSeat === "unavailable"
         ? "make a person reachable through the approver that is wired (it answered `unavailable` for this ask)"
@@ -396,21 +436,21 @@ export function headlessApprovalRemedy(input) {
             : "wire an approver (`onAsk`) to put it to a person";
     const c = input.classification;
     if (input.mode === "acceptEdits" && input.unplacedOptions !== undefined && (c === undefined || (c.classes.size === 1 && c.classes.has("ordinary"))))
-        return `${fileCommandOptionsSentence(input.unplacedOptions.program)} Spell the ${input.unplacedOptions.program} without option words for the mode to answer it, or ${approver}`;
+        return way(`${fileCommandOptionsSentence(input.unplacedOptions.program)} Spell the ${input.unplacedOptions.program} without option words for the mode to answer it, or ${approver}`);
     if (c !== undefined && bypassImmuneOf(c))
-        return `no permission mode releases this ask (${c.askClass}): ${approver}, or change the call`;
+        return way(`no permission mode releases this ask (${c.askClass}): ${approver}, or change the call`);
     if (input.mode === "plan" && c?.classes.has("mode") === true)
-        return `the plan permission mode asks before every write and every call to a tool the engine does not define that is not read-only — leave plan mode (\`setPermissionMode\` to another mode, or approve the plan) to run it, or ${approver}`;
+        return way(`the plan permission mode asks before every write and every call to a tool the engine does not define that is not read-only — leave plan mode (\`setPermissionMode\` to another mode, or approve the plan) to run it, or ${approver}`);
     if (c !== undefined && c.classes.size === 1 && c.classes.has("unstated"))
-        return `no allow entry, stored allow rule or hook granted this tool, and it states no permission of its own — grant it with an allow entry for its name (\`RunnerDeps.allowedTools\` / \`TaskSpec.allowedTools\`), run with \`permissionMode: "bypassPermissions"\`, or ${approver}`;
+        return way(`no allow entry, stored allow rule or hook granted this tool, and it states no permission of its own — grant it with an allow entry for its name (\`RunnerDeps.allowedTools\` / \`TaskSpec.allowedTools\`), or ${approver}`, true);
     const onlyOrdinary = c === undefined || (c.classes.size === 1 && c.classes.has("ordinary"));
     if (input.coveredWrite && onlyOrdinary) {
         if (input.mode === "acceptEdits")
-            return `under \`permissionMode: "acceptEdits"\` the mode asks only for a write outside the working directories — if this target is outside them, add its directory to \`additionalDirectories\`; otherwise (or besides) ${approver}`;
+            return way(`under \`permissionMode: "acceptEdits"\` the mode asks only for a write outside the working directories — if this target is outside them, add its directory to \`additionalDirectories\`; otherwise (or besides) ${approver}`);
         if (input.mode === undefined || input.mode === "default" || input.mode === "auto")
-            return `the mode's write gate asks every write under \`default\`: \`permissionMode: "acceptEdits"\` lets writes inside the working directories (the task root and \`additionalDirectories\`) through without asking (a question another policy raised still stands), or ${approver}`;
+            return way(`the mode's write gate asks every write under \`default\`: \`permissionMode: "acceptEdits"\` lets writes inside the working directories (the task root and \`additionalDirectories\`) through without asking (a question another policy raised still stands), or ${approver}`);
     }
-    return `run with \`permissionMode: "bypassPermissions"\` to release this ask (the release is disclosed on the call), or ${approver}`;
+    return way(approver, true);
 }
 export function fileCommandOptionsSentence(program) {
     return `${program} with flags requires manual approval to ensure path safety: the mode cannot automatically validate ${program} commands that use flags, as some flags like --target-directory=PATH can bypass path validation.`;

package/dist/core/ask-question.d.ts

@@ -3,15 +3,23 @@ import type { ToolPolicy } from "./tool-policy.js";
 /** The reserved tool name for AskUserQuestion — shared so the durable-resume path (runtask) can recognize it
  *  as a content-ask whose SHOWN questions must not be rewritten by an operator `updatedInput` (design/80 D-F).
  *
- *  RESERVED means the whole engine keys content-ask semantics on this name: a policy `ask` on it is NEVER
- *  routed to a synchronous PERMISSION approver — on the main gate, the degraded fall-through, and the
- *  inherited ancestor wrappers alike (a permission frame's allow/deny cannot carry an ANSWER; CC parity:
- *  AskUserQuestion never raises a permission card). What it DOES reach, in this order, is the run's own
- *  content-ask channel: a LIVE question face answers it in-stream (the gate routes the question, not a
- *  verdict), and only with no live face — or with the durable gate forced — does it park durably or answer
- *  the typed refusal. Permission-GATING this tool stays unsupported by design; content-ROUTING it is the
- *  supported path. A caller-supplied tool reusing this name inherits the same routing; don't. */
+ *  The engine mounts its own question tool under this name, and the gate's content-ask semantics belong to THAT tool,
+ *  read off the call's face ({@link isEngineQuestionFace}), never off this name: a policy `ask` on it is NEVER routed to
+ *  a synchronous PERMISSION approver (a permission frame's allow/deny cannot carry an ANSWER; CC parity: AskUserQuestion
+ *  never raises a permission card). What it DOES reach, in this order, is the run's own content-ask channel: a LIVE
+ *  question face answers it in-stream (the gate routes the question, not a verdict), and only with no live face — or
+ *  with the durable gate forced — does it park durably or answer the typed refusal. Permission-GATING this tool stays
+ *  unsupported by design; content-ROUTING it is the supported path. A caller-supplied tool reusing this name is an
+ *  ordinary caller tool to the gate, its park decline, an ancestor's settlement and a person's edit of its parked call — asked, cleared by an allow rule,
+ *  released by a mode or refused like any other; the approval card a call carries is still chosen by this name. */
 export declare const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
+/** "Is this call the engine's own question tool?" — the catalog's one mount judge ({@link engineMountedAs}) for the
+ *  question definition: every station that treats a call as a content ask (the gate's content-question class and route,
+ *  the park's sync-first decline, the ancestor adapters' question float, {@link createDurableQuestionPolicy}) reads this answer. */
+export declare const isEngineQuestionFace: (face: {
+    readonly engineMounted?: true;
+    readonly contractId: string;
+} | undefined) => boolean;
 /**
  * AskUserQuestion (design/64 §5). A model-callable tool that lets the agent ask the USER a structured
  * multiple-choice question (which approach? which of these?) — distinct from the design/37 permission `ask`
@@ -278,6 +286,41 @@ export interface AskUserQuestionToolOptions {
      *  would let a LATER question inherit the claim that an operator approved it. */
     redeemedApprovalQuestionsHash?: string;
 }
+/**
+ * Durable ask (design/64 TC-5.4 — ABOVE CC, the disconnected-human case): instead of the headless
+ * "proceed with your best judgment" default, an AskUserQuestion **suspends the task durably** and the
+ * answer resumes it — built ENTIRELY from existing primitives, no new gate kind.
+ *
+ * **The park is the fallback, not the mandate.** An adjudicated question parks durably UNLESS this run
+ * has a live question face (see {@link isLiveQuestionFace}), in which case the engine routes the question
+ * to that face and the answer arrives in-stream — same turn, no checkpoint, no rebuild. The park is what
+ * happens when nobody is there: no live face, the face affirming nobody is reachable, or a control-plane
+ * `forceDurableGate` that mandates the durable breakpoint regardless. A deployment that wired a live face
+ * AND wants every question parked anyway states that with `forceDurableGate` (or by not wiring the face).
+ *
+ *  1. Run the task with `durableApproval` + a durable `CheckpointStore` (+ durable session/offload
+ *     stores) and `combinePolicies(createDurableQuestionPolicy(), yourPolicy)`. The policy adjudicates
+ *     the AskUserQuestion call `ask`; in durable mode that suspends BEFORE the tool executes —
+ *     `onQuestion` is never called on the suspend side, so mount the tool with
+ *     {@link QUESTION_AWAITS_RESUME} when no live human is connected.
+ *  2. The HITL surface reads the questions from `checkpoint.pendingAction.args.questions` and collects
+ *     the human's {@link QuestionAnswer} out-of-band (hours/days later, any replica).
+ *  3. `runner.resume(token, { gate: "policy_ask", decision: "allow", boundCallId:
+ *     checkpoint.pendingAction.toolCallId }, { ...taskConfig, onQuestion: async () => answer })` — the resume
+ *     re-mounts the tool with the answer closure; the pending call executes against it and the model
+ *     continues with "The user answered: …". `boundCallId` (design/80 D-1) must name the pending call the
+ *     human answered, or the resume is rejected (`checkpoint.invalid_outcome`).
+ *
+ * A deployment that wants the CC-style threshold form ("wait N minutes for a live human, then go
+ * durable") implements it inside its own policy: return `allow` while a human is connected (the live
+ * `onQuestion` answers synchronously) and `ask` when none is — the sync-vs-durable choice is exactly
+ * one policy decision. Composing this policy's answer is how such a policy keeps the one judge (an `ask`
+ * from here means the call is the engine's question tool).
+ *
+ * The call it asks about is the ENGINE's question tool, read off the request's face ({@link isEngineQuestionFace}):
+ * a caller's tool that took the name is not asked about here, and neither is a bare request (no face — a host
+ * driving a policy outside a Runner stamps the face itself, `toolCallFaceOf(roster, name)`).
+ */
 export declare function createDurableQuestionPolicy(): ToolPolicy;
 /**
  * Placeholder {@link OnQuestion} that mounts the AskUserQuestion tool on a worker with NO live human

package/dist/core/ask-question.js

@@ -3,10 +3,10 @@ import { uuidv7 } from "../engine/session/uuid.js";
 import { boundInputHashOf, capturedJsonOf } from "./canonical-json.js";
 import { defineTool, errorResult } from "./tools.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";
-import { mountRuleFace, toolFace } from "./tool-catalog-entries.js";
+import { engineMountedAs, mountRuleFace, toolFace } from "./tool-catalog-entries.js";
 import { thrownText } from "./thrown-value.js";
-import { heldBy } from "./tool-name-readings.js";
 export const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
+export const isEngineQuestionFace = engineMountedAs(["ask-user-question"]);
 export function classifyQuestionOutcome(outcome) {
     let unavailable;
     let answers;
@@ -69,11 +69,10 @@ export function validateAskQuestions(questions) {
     }
     return undefined;
 }
-const QUESTION_TOOL_NAMES = new Set([ASK_USER_QUESTION_TOOL_NAME]);
 export function createDurableQuestionPolicy() {
     return {
         check(req) {
-            if (!heldBy("policy.durableQuestion", QUESTION_TOOL_NAMES, req)) {
+            if (!isEngineQuestionFace(req.face)) {
                 return { action: "allow" };
             }
             return { action: "ask", message: "AskUserQuestion: awaiting a human answer (durable)" };

package/dist/core/ask-unresolvable-notice.d.ts

@@ -28,7 +28,7 @@
  * is pure.
  */
 import type { EngineNotice } from "./engine-notice.js";
-import type { AssertAllKeysHandled, HeadlessApproverSeat } from "./ask-origin.js";
+import { type ApprovalRemedy, type AssertAllKeysHandled, type HeadlessApproverSeat } from "./ask-origin.js";
 /** WHY the ask could not be resolved — the closed set (see the module note for each word). */
 export declare const ASK_UNRESOLVABLE_CAUSES: readonly ["approver_unavailable", "no_approver_wired", "mandate_unreconstructible"];
 export type AskUnresolvableCause = (typeof ASK_UNRESOLVABLE_CAUSES)[number];
@@ -52,6 +52,10 @@ export interface AskUnresolvableFacts {
      *  for arguments no approval can be bound to, the binding's own sentence, which is that text — the remedy's approver half would
      *  not let them run) — carried verbatim, never re-composed here. */
     readonly remedy?: string;
+    /** The ways out of that same refusal as data ({@link ApprovalRemedy}) — the approver, and the permission mode where the refusal could be
+     *  released by one — for a host that chooses which to offer. Rides exactly when {@link remedy} is the headless remedy's sentence
+     *  (`headlessApprovalRemedy`); a binding's own sentence, which has no way out to offer, carries none. */
+    readonly remedies?: readonly ApprovalRemedy[];
 }
 /**
  * Which causes take the caller-side remedy (`headlessApprovalRemedy`, ask-origin.ts), and in which seat's clause — the table IS
@@ -82,8 +86,9 @@ export declare function askUnresolvableRemedySeat(cause: AskUnresolvableCause):
  * an empty session or tool name, or a cause outside the closed set, is refused at the mint with a
  * `TypeError` rather than shaped into a notice that would route nowhere or say nothing.
  *
- * `detail: { sessionId, toolName, toolCallId, cause, parkLaneExisted, remedy? }` — `remedy` rides the causes that say nobody
- * could be asked ({@link askUnresolvableRemedySeat}: the sentence the refusal's tool text carries); `sessionId` is lifted onto the typed key by {@link import("./engine-notice.js").deliverEngineNotice}, the one throat.
+ * `detail: { sessionId, toolName, toolCallId, cause, parkLaneExisted, remedy?, remedies? }` — `remedy` rides the causes that say nobody
+ * could be asked ({@link askUnresolvableRemedySeat}: the sentence the refusal's tool text carries) and `remedies` beside it, the same
+ * way out as data ({@link ApprovalRemedy}); `sessionId` is lifted onto the typed key by {@link import("./engine-notice.js").deliverEngineNotice}, the one throat.
  */
 export declare function askUnresolvableNotice(facts: AskUnresolvableFacts): EngineNotice;
 export {};