@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/decision-receipt.d.ts

@@ -1,4 +1,4 @@
-import { type AssertAllKeysHandled } from "./ask-origin.js";
+import type { AssertAllKeysHandled } from "./ask-origin.js";
 import type { DecisionMember, PermissionResult } from "./tool-policy.js";
 export declare const refusedOutOfContract: (message: string) => PermissionResult;
 /** Is `d` a refusal the engine itself minted (by object identity — a look-alike `deny` a caller built is not one)? The receipt's
@@ -47,14 +47,48 @@ export declare const DECISION_MEMBER_ARMS: Readonly<{
     readonly origin: readonly ["ask"];
     readonly askClass: readonly ["ask"];
     readonly classes: readonly ["ask"];
-    readonly guards: readonly ["ask"];
     readonly ruleUnreadable: readonly ["ask"];
     readonly authoredBy: readonly ["ask"];
-    readonly foldedAskClasses: readonly ["ask"];
+    readonly editRewritten: readonly ["ask"];
 }>;
 export type DecisionMemberArmsCoverTheUnion = AssertAllKeysHandled<{
     [M in DecisionMember]: Exclude<ArmOf<M>, (typeof DECISION_MEMBER_ARMS)[M][number]>;
 }[DecisionMember]>;
+/**
+ * WHO writes each member of the decision union — one writer per fact, one table (fenced to the union like
+ * {@link DECISION_MEMBER_ARMS}: a member the union gains without a row is a type error):
+ *  · `composer` — the policy's or hook's own statement about its question: received, and read as an input of the class derivation;
+ *  · `record` — the engine's attestation record (`attestation`): taken by reference after its brand check, read for its call;
+ *  · `stamp` — written by the gate after the receipt (the disclosed words of the classes the engine derives, the allow layer's
+ *    and the rule lane's accounts): no composer writes one, so a decision that states one is refused by name.
+ */
+export declare const DECISION_MEMBER_WRITERS: Readonly<{
+    readonly action: "composer";
+    readonly updatedInput: "composer";
+    readonly message: "composer";
+    readonly decisionReason: "composer";
+    readonly attestation: "record";
+    readonly requiresRealApproval: "composer";
+    readonly denialLimitFallback: "composer";
+    readonly classifierNoRuling: "composer";
+    readonly allowRuleShadowed: "stamp";
+    readonly probeReason: "composer";
+    readonly probeCause: "composer";
+    readonly probeMandated: "composer";
+    readonly crossBoundaryMandated: "composer";
+    readonly mandated: "composer";
+    readonly mandate: "stamp";
+    readonly probeReadRootCandidate: "composer";
+    readonly matchedAskRule: "composer";
+    readonly ruleEvidence: "stamp";
+    readonly segmentCoverage: "stamp";
+    readonly origin: "stamp";
+    readonly askClass: "stamp";
+    readonly classes: "stamp";
+    readonly ruleUnreadable: "composer";
+    readonly authoredBy: "composer";
+    readonly editRewritten: "composer";
+}>;
 export declare const RETIRED_WINDOW_MEMBER_DENY_MESSAGE: string;
 export declare const carriesRetiredWindow: (fallback: unknown) => boolean;
 /**

package/dist/core/decision-receipt.js

@@ -1,5 +1,4 @@
 import { types } from "node:util";
-import { ASK_CLASSES, ASK_ORIGINS, isAskClass, isAskOrigin, isPersistedRuleMandate, PERSISTED_RULE_MANDATES } from "./ask-origin.js";
 import { AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, isDenialLimitBound } from "./auto-mode.js";
 import { thrownText } from "./thrown-value.js";
 const ENGINE_REFUSALS = new WeakSet();
@@ -11,7 +10,6 @@ export const refusedOutOfContract = (message) => {
 export const isEngineRefusal = (d) => typeof d === "object" && d !== null && ENGINE_REFUSALS.has(d);
 const DECISION_REASONS = Object.freeze(["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill", "deployment_rule", "request_rule"]);
 const DECISION_ACTIONS = Object.keys({ allow: 0, deny: 0, ask: 0 });
-const GUARDS = Object.keys({ dangerous_delete: 0, unverifiable_delete: 0, unverifiable_shell_text: 0, transcript_write: 0, artifact_shared_read: 0 });
 const RULE_UNREADABLE_WORDS = Object.keys({ content_deny: 0, content_ask: 0, persisted_call: 0, persisted_rows: 0 });
 const AUTHORED_BY_WORDS = Object.keys({ deployment: 0 });
 const memberOf = (words) => {
@@ -21,12 +19,6 @@ const memberOf = (words) => {
 const CLOSED_MEMBERS = [
     { member: "action", words: DECISION_ACTIONS, has: memberOf(DECISION_ACTIONS), required: true },
     { member: "decisionReason", words: DECISION_REASONS, has: memberOf(DECISION_REASONS) },
-    { member: "origin", words: ASK_ORIGINS, has: isAskOrigin },
-    { member: "askClass", words: ASK_CLASSES, has: isAskClass },
-    { member: "classes", words: ASK_CLASSES, has: isAskClass, list: true },
-    { member: "foldedAskClasses", words: ASK_CLASSES, has: isAskClass, list: true },
-    { member: "mandate", words: PERSISTED_RULE_MANDATES, has: isPersistedRuleMandate },
-    { member: "guards", words: GUARDS, has: memberOf(GUARDS), list: true },
     { member: "ruleUnreadable", words: RULE_UNREADABLE_WORDS, has: memberOf(RULE_UNREADABLE_WORDS) },
     { member: "authoredBy", words: AUTHORED_BY_WORDS, has: memberOf(AUTHORED_BY_WORDS) },
     { member: "classifierNoRuling", words: AUTO_MODE_FALLBACK_CAUSES, has: isAutoModeFallbackCause },
@@ -41,8 +33,17 @@ export const DECISION_MEMBER_ARMS = Object.freeze({
     action: EVERY_ARM, updatedInput: EVERY_ARM, message: EVERY_ARM, decisionReason: EVERY_ARM, attestation: EVERY_ARM,
     requiresRealApproval: ASK, denialLimitFallback: ASK, classifierNoRuling: ASK, allowRuleShadowed: ASK, probeReason: ASK, probeCause: ASK,
     probeMandated: ASK, crossBoundaryMandated: ASK, mandated: ASK, mandate: ASK, probeReadRootCandidate: ASK, matchedAskRule: ASK, ruleEvidence: ASK,
-    segmentCoverage: ASK, origin: ASK, askClass: ASK, classes: ASK, guards: ASK, ruleUnreadable: ASK, authoredBy: ASK, foldedAskClasses: ASK,
+    segmentCoverage: ASK, origin: ASK, askClass: ASK, classes: ASK, ruleUnreadable: ASK, authoredBy: ASK,
+    editRewritten: ASK,
 });
+export const DECISION_MEMBER_WRITERS = Object.freeze({
+    action: "composer", updatedInput: "composer", message: "composer", decisionReason: "composer", attestation: "record",
+    requiresRealApproval: "composer", denialLimitFallback: "composer", classifierNoRuling: "composer", allowRuleShadowed: "stamp", probeReason: "composer",
+    probeCause: "composer", probeMandated: "composer", crossBoundaryMandated: "composer", mandated: "composer", mandate: "stamp",
+    probeReadRootCandidate: "composer", matchedAskRule: "composer", ruleEvidence: "stamp", segmentCoverage: "stamp", origin: "stamp", askClass: "stamp",
+    classes: "stamp", ruleUnreadable: "composer", authoredBy: "composer", editRewritten: "composer",
+});
+const STAMP_MEMBERS = Object.keys(DECISION_MEMBER_WRITERS).filter((m) => DECISION_MEMBER_WRITERS[m] === "stamp");
 const RETIRED_WINDOW_MEMBER = "autoDenyAfterMs";
 export const RETIRED_WINDOW_MEMBER_DENY_MESSAGE = `a permission decision's "denialLimitFallback" carries "${RETIRED_WINDOW_MEMBER}" — the decision names the counts only; ` +
     `the auto-deny window is decided by the ask's route (a live approver arms it, every other route runs none) and cannot be ` +
@@ -59,6 +60,7 @@ const NESTED_CONTRACTS = [
     { holder: "", member: "probeCause", members: Object.keys({ code: 0, roots: 0, further: 0 }), required: Object.keys({ code: 0, roots: 0 }) },
     { holder: "probeCause.", member: "roots", members: OPERAND_MEMBERS, required: OPERAND_MEMBERS },
     { holder: "probeCause.", member: "further", members: OPERAND_MEMBERS, required: OPERAND_MEMBERS },
+    { holder: "", member: "editRewritten", members: Object.keys({ acceptableForm: 0 }), required: Object.keys({ acceptableForm: 0 }) },
 ];
 const nonNegativeInteger = (v) => typeof v === "number" && Number.isInteger(v) && v >= 0;
 const NESTED_VALUE_FENCES = {
@@ -80,7 +82,12 @@ function renderForeignValue(v) {
     }
 }
 export function screenContractValues(contract, opts) {
-    for (const { member, words, has, list, required } of CLOSED_MEMBERS) {
+    const stamped = STAMP_MEMBERS.find((m) => contract[m] !== undefined);
+    if (stamped !== undefined) {
+        return refusedOutOfContract(`a permission decision carries "${stamped}" — the member is written by the gate after a policy answers (the disclosed account of what the engine's own layers found); ` +
+            `a policy states its question through its own members (requiresRealApproval, authoredBy, matchedAskRule, …); denied fail-closed rather than carrying a value the gate replaces`);
+    }
+    for (const { member, words, has, required } of CLOSED_MEMBERS) {
         if (opts?.skip?.has(member) === true)
             continue;
         const v = contract[member];
@@ -89,13 +96,6 @@ export function screenContractValues(contract, opts) {
                 return refusedOutOfContract(`a permission decision's "${member}" is absent — the closed set is ${words.join("/")}; denied fail-closed rather than reading a word outside it as an allow`);
             continue;
         }
-        if (list === true) {
-            const received = receiveList(v, member, words, has);
-            if (received.kind === "refused")
-                return received.refused;
-            contract[member] = received.held;
-            continue;
-        }
         if (has(v))
             continue;
         return unrecognized(member, v, words);

package/dist/core/delegation-not-started.d.ts

@@ -0,0 +1,6 @@
+/** The delegation factory's mint: `result`'s `details` object is a refusal before any child ran. Returns `result` as it is. */
+export declare function notStartedResult<T extends object>(result: T): T;
+/** An engine copy's carry: the engine's `copy` of a receipted object holds the receipt too. Anything else carries nothing. */
+export declare function carryNotStartedReceipt(original: unknown, copy: unknown): void;
+/** Is `result` one of the delegation tool's refusals before any child ran — by the receipt on its `details` object alone? */
+export declare function isNotStartedDelegationResult(result: unknown): boolean;

package/dist/core/delegation-not-started.js

@@ -0,0 +1,17 @@
+const NOT_STARTED_RECEIPTS = new WeakSet();
+export function notStartedResult(result) {
+    const details = result.details;
+    if (typeof details === "object" && details !== null)
+        NOT_STARTED_RECEIPTS.add(details);
+    return result;
+}
+export function carryNotStartedReceipt(original, copy) {
+    if (typeof original === "object" && original !== null && typeof copy === "object" && copy !== null && NOT_STARTED_RECEIPTS.has(original))
+        NOT_STARTED_RECEIPTS.add(copy);
+}
+export function isNotStartedDelegationResult(result) {
+    if (typeof result !== "object" || result === null)
+        return false;
+    const details = result.details;
+    return typeof details === "object" && details !== null && NOT_STARTED_RECEIPTS.has(details);
+}

package/dist/core/engine-attestation.d.ts

@@ -0,0 +1,93 @@
+/**
+ * The engine's ATTESTATION record — the one carrier of what an engine station knows about a decision and a policy cannot
+ * state: WHO settled the call's wait and WHICH question that answered (the settlement, the ask's origin word and class set,
+ * the digest of the arguments the answer licenses), and the facts the classifier stations, the in-fold unresolvable arms,
+ * the integrity guards and the policy fold record. It rides the decision as its `attestation` member and is read through
+ * {@link attestationOf} alone; the decision object's identity carries nothing.
+ *
+ * Minted only by {@link mintAttestation} and combined only by {@link mergeAttestation}: both freeze the record and enter it
+ * in a module-private brand set, so a value a caller composed — a literal, a copy, a structured clone — is not a record, and
+ * the decision receipt refuses a decision carrying one. A record is bound to the call it was minted for (`toolCallId` +
+ * `toolName`): handed back for another call it reads as absent. A spread of a decision keeps its record, and the record still
+ * says only what the engine minted — a refusal record on an allow is a contradiction the gate's exit refuses, and a
+ * resolution's answer binds the arguments it licensed (`inputDigest`).
+ *
+ * A leaf (type-only imports): the decision module that receives a record and the class derivation that reads one for its call
+ * both depend on it, and neither depends on the other through it.
+ */
+import type { AskClass, AskOrigin } from "./ask-origin.js";
+import type { ClassifierDenyCause, Settlement } from "./gate-outcome.js";
+import type { AutoModeClassifierRound } from "./auto-mode.js";
+import type { AskUnresolvableCause } from "./ask-unresolvable-notice.js";
+import type { PathDenialEvidence } from "../tools/fs/safety.js";
+import type { AskGuard } from "./tool-policy.js";
+export interface EngineAttestation {
+    readonly toolCallId: string;
+    readonly toolName: string;
+    /** What ended the call's wait. The answer group — `settlement`, `origin`, `classes`, `inputDigest` — travels as one. */
+    readonly settlement?: Settlement;
+    /** The settled ask's origin word. */
+    readonly origin?: AskOrigin;
+    /** The settled ask's class set (`ASK_CLASSES` order), when the minting station held one. */
+    readonly classes?: readonly AskClass[];
+    /** `exactBoundInputHashOf` of the arguments the settlement licenses (an approver's edit, the snapshot shown, or the asked
+     *  args); absent when they have none (outside the bindable domain) — such a record licenses no bytes. */
+    readonly inputDigest?: string;
+    /** The FORM of a classifier round that did not rule (a classifier deny's cause). */
+    readonly classifierCause?: ClassifierDenyCause;
+    /** WHICH model answered a classification, on either arm. */
+    readonly classifierRound?: AutoModeClassifierRound;
+    /** Why an in-fold deny refused an ask nobody could resolve. */
+    readonly unresolvableCause?: AskUnresolvableCause;
+    /** The classes of the OTHER asks a policy fold collapsed into this one (each contributor's classes, unioned) — so a fact the
+     *  fold does not copy (a guard, an unreadable-rule fact, a bare real-approval bit) is not lost behind the ask that won the
+     *  slot. Written by the policy fold and by the gate's own writers of a standing ask's carried classes; the one carrier of
+     *  those classes. */
+    readonly foldedClasses?: readonly AskClass[];
+    /** WHICH integrity guards stand behind this ask — a removal of a protected location, an unverifiable recursive delete, shell
+     *  text the engine cannot read (or an environment that did not answer the read station), the session-transcript write,
+     *  another person's shared artifact. Engine findings (the guard policies, the read station's silence, the artifact tool's
+     *  consent): the class derivation reads them as classes and as explainers of the real-approval bit, so only a record carries
+     *  them. Never copied onto the approval request or the park row. */
+    readonly guards?: readonly AskGuard[];
+    /** Where a path deny row refused the call — the row, the view of the target it met, the face the call is on. The gate's
+     *  exit mints the refusal's card from it; the judge that found the row is its only writer. */
+    readonly pathDenial?: PathDenialEvidence;
+    /** A seat refused the call's arguments because no approval can be bound to them: the refusal's sentence, carried by the
+     *  refusal itself — the gate's deny exit reads it (the remedy it gives) instead of judging again. */
+    readonly bindingRefusal?: string;
+}
+/** The members a station attests — everything but the call binding. */
+export type AttestationMembers = Omit<EngineAttestation, "toolCallId" | "toolName">;
+/** Mint a record for `call`. Engine stations only: not re-exported from `src/index.ts`. The values are DETACHED snapshots, so a
+ *  caller that later mutates the settlement object it was handed cannot rewrite what the engine attests. */
+export declare function mintAttestation(call: {
+    toolCallId: string;
+    toolName: string;
+}, members: AttestationMembers): EngineAttestation;
+/** Is `v` a record the engine minted (the brand alone — no binding)? The receipt's test. */
+export declare function isEngineAttestation(v: unknown): v is EngineAttestation;
+/** THE read: the record `d` carries FOR `call` — a branded record bound to that call, else `undefined` (a record bound to
+ *  another call is a replayed one and reads as absent). Read off the own data member, never through an accessor. */
+export declare function attestationOf(d: unknown, call: {
+    toolCallId: string;
+    toolName: string;
+}): EngineAttestation | undefined;
+/**
+ * Combine two records for `call`, member GROUP by group: the later record's group stands where it has one, the earlier's
+ * fills a group the later lacks. A record not bound to `call` contributes nothing. `answer` scope is the veto's merge: the
+ * earlier record contributes ONLY its answer, and only when the later carries none — a person's yes rides a later layer's
+ * deny (invariant I3) while the refusing station's own facts stay its own.
+ */
+export declare function mergeAttestation(call: {
+    toolCallId: string;
+    toolName: string;
+}, earlier: EngineAttestation | undefined, later: EngineAttestation | undefined, scope?: "all" | "answer"): EngineAttestation | undefined;
+/** `d` with `members` attested for `call`, merged over the record it already carries for that call (the new members' groups
+ *  win). Always a fresh object — the receipt hands out frozen ones. */
+export declare function attest<T extends object>(d: T, call: {
+    toolCallId: string;
+    toolName: string;
+}, members: AttestationMembers): T;
+/** `d` carrying `record` (a fresh object), or `d` itself when there is no record to put on it. */
+export declare function withAttestation<T extends object>(d: T, record: EngineAttestation | undefined): T;

package/dist/core/engine-attestation.js

@@ -0,0 +1,70 @@
+const ATTESTATION_GROUP_OF = {
+    settlement: "answer",
+    origin: "answer",
+    classes: "answer",
+    inputDigest: "answer",
+    classifierCause: "classifierCause",
+    classifierRound: "classifierRound",
+    unresolvableCause: "unresolvableCause",
+    foldedClasses: "foldedClasses",
+    guards: "guards",
+    pathDenial: "pathDenial",
+    bindingRefusal: "bindingRefusal",
+};
+const ATTESTATION_MEMBERS = Object.keys(ATTESTATION_GROUP_OF);
+const groupLead = (g) => ATTESTATION_MEMBERS.find((k) => ATTESTATION_GROUP_OF[k] === g);
+const ENGINE_ATTESTATIONS = new WeakSet();
+function detachedMember(v) {
+    if (Array.isArray(v))
+        return Object.freeze([...v]);
+    if (typeof v !== "object" || v === null)
+        return v;
+    return Object.freeze(Object.fromEntries(Object.entries(v).map(([k, x]) => [k, typeof x === "object" && x !== null ? Object.freeze(Array.isArray(x) ? [...x] : { ...x }) : x])));
+}
+export function mintAttestation(call, members) {
+    const record = { toolCallId: call.toolCallId, toolName: call.toolName };
+    for (const k of ATTESTATION_MEMBERS)
+        if (members[k] !== undefined)
+            record[k] = detachedMember(members[k]);
+    const minted = Object.freeze(record);
+    ENGINE_ATTESTATIONS.add(minted);
+    return minted;
+}
+export function isEngineAttestation(v) {
+    return typeof v === "object" && v !== null && ENGINE_ATTESTATIONS.has(v);
+}
+const boundTo = (r, call) => isEngineAttestation(r) && r.toolCallId === call.toolCallId && r.toolName === call.toolName ? r : undefined;
+export function attestationOf(d, call) {
+    if (typeof d !== "object" || d === null)
+        return undefined;
+    return boundTo(Object.getOwnPropertyDescriptor(d, "attestation")?.value, call);
+}
+export function mergeAttestation(call, earlier, later, scope = "all") {
+    const a = boundTo(earlier, call);
+    const b = boundTo(later, call);
+    if (a === undefined)
+        return b;
+    const members = {};
+    if (b !== undefined)
+        for (const k of ATTESTATION_MEMBERS)
+            if (b[k] !== undefined)
+                members[k] = b[k];
+    let filled = false;
+    for (const g of new Set(Object.values(ATTESTATION_GROUP_OF))) {
+        if ((scope === "answer" && g !== "answer") || members[groupLead(g)] !== undefined || a[groupLead(g)] === undefined)
+            continue;
+        for (const k of ATTESTATION_MEMBERS)
+            if (ATTESTATION_GROUP_OF[k] === g && a[k] !== undefined)
+                members[k] = a[k];
+        filled = true;
+    }
+    if (!filled)
+        return b;
+    return mintAttestation(call, members);
+}
+export function attest(d, call, members) {
+    return withAttestation(d, mergeAttestation(call, attestationOf(d, call), mintAttestation(call, members)));
+}
+export function withAttestation(d, record) {
+    return record === undefined ? d : { ...d, attestation: record };
+}

package/dist/core/engine-capabilities.d.ts

@@ -16,7 +16,10 @@
  *    memory distiller's chat seat key), and `inheritedHostEnv` subtracts every entry whose value is one,
  *    compared whole, under every policy. A credential resolved per request (a per-model auth hook's answer) is not in
  *    it: the host that resolves it declares it. The same inheritance-only reading as the word above.
+ *  - `mods.skill_seat` — a skill carries its own hooks: `SkillSpec.mods` registrations are admitted on every leg that loads
+ *    the skill and take part only while the skill is active there (from its activation to the run's end, a park and its
+ *    resume included); they are the leg's own (no delegated child dispatches them or is screened by them).
  */
-export declare const ENGINE_CAPABILITIES: readonly ["inherit_env.own_credentials_withheld", "inherit_env.own_credential_values_withheld"];
+export declare const ENGINE_CAPABILITIES: readonly ["inherit_env.own_credentials_withheld", "inherit_env.own_credential_values_withheld", "mods.skill_seat"];
 /** One word of {@link ENGINE_CAPABILITIES}. */
 export type EngineCapability = (typeof ENGINE_CAPABILITIES)[number];

package/dist/core/engine-capabilities.js

@@ -1 +1 @@
-export const ENGINE_CAPABILITIES = Object.freeze(["inherit_env.own_credentials_withheld", "inherit_env.own_credential_values_withheld"]);
+export const ENGINE_CAPABILITIES = Object.freeze(["inherit_env.own_credentials_withheld", "inherit_env.own_credential_values_withheld", "mods.skill_seat"]);

package/dist/core/engine-notice.d.ts

@@ -324,6 +324,14 @@ export interface EngineNotice {
      *    runs. ONCE PER LEG PER (api, key set) — a deployment fact, not a request fact. Audience `operator`;
      *    `detail: { keys, api, modelId, sessionId, runId }` — `keys` the key NAMES in `extraBody`'s order (never a
      *    value), `api` the wire the adapter speaks, `modelId` the catalog id the request was sent as.
+     *  - `"model.capability_downgraded"` (#1830) — a capability the session's requests used was withheld from the model
+     *    they were sent to: today, images replaced by a one-line placeholder because the model's entry declares no image
+     *    input (`Model.input` without `"image"`; `capabilityOf` in `brain/model-capability.ts` is the one reading, and an
+     *    entry that does not declare `input` keeps its images). The message names the model and the way out (declare the
+     *    image input, or switch models). Never minted for reasoning a model declares off — the reasoning resolution's
+     *    drop arm (`TaskResult.effectiveReasoning.dropped`) is that fact's face. ONCE PER SESSION PER (model, capability)
+     *    (the session's announced record); one report per request also becomes the operator trace `vision.placeholder`.
+     *    Audience `user`; `detail: { model, capability: "image", status: "declared_off", sessionId, runId }`.
      *  - `"context.tool_turn_repaired"` (#1224) — a provider request was built from a transcript that breaks the
      *    tool-turn law, and the request view restored it (`engine/llm/tool-turns.ts`; the transcript is never
      *    rewritten): a block after an assistant's tool calls moved ahead of them (`trailing_text`), a result recorded
@@ -392,16 +400,27 @@ export interface EngineNotice {
      *    is silent; a broken one must not look the same). Once per prepared leg;
      *    `detail: { problem, sessionId, runId }`.
      *  - `"config.execution_env_capability_invalid"` — a remote env DECLARES a boolean capability key
-     *    (`isolation`, `suspendable`, `canonicalPathAuthoritative`) with a non-boolean value; ABSENCE is a
-     *    supported reading of each and stays silent. Once per key per run; `detail: { key, valueType }`.
+     *    (`isolation`, `suspendable`, `canonicalPathAuthoritative`, `sharesProcessTable`) with a non-boolean value; ABSENCE is a
+     *    supported reading of the first three and stays silent, and is announced for `sharesProcessTable`, which has no
+     *    absent reading (`valueType: "undefined"`). Once per key per run; `detail: { key, valueType }`. Also minted for
+     *    `withheldEnv` (key `"withheldEnv"`) when it is neither a list of findings nor `"unknown"`, read at a shell call of
+     *    a root leg (once per run).
      *  - `"config.secret_env_scrubbed"` (#1081) — the D1 fail-closed `scrub` policy, or the deployment's
      *    own credentials (`declareWithheldEnv`: a declared name, or a value equal to a declared or engine-held
      *    credential value), withheld one or more keys from a spawned child's environment (a tool's shell, an
      *    oracle gate, or a language server).
      *    Once per PROCESS, shared by every scrub site ({@link import("./secret-env.js").announceSecretEnvScrub});
      *    `detail: { names, ownCredentials? }` — every withheld key's name, never a value; `ownCredentials`, present
-     *    only when one was withheld, the subset withheld as own credentials, by name or by value (under any policy,
-     *    `"all"` included).
+     *    only when one was withheld, the subset that is the deployment's own credential, by name or by value, whichever
+     *    rule withheld it (withheld under any policy, `"all"` included).
+     *  - `"inherit_env.names_withheld"` (#1963) — the same fact for the person whose run drives a tool shell: the variables
+     *    of the engine's environment that shell does not receive (`ExecutionEnv.withheldEnv`), the scrub's half (the run's
+     *    `inheritEnv` hands them on) and the deployment's own credentials (no policy does). Audience `user`. Read as each
+     *    call to the engine's own shell tool starts on a root leg (the answer can grow during a run: a credential the engine
+     *    takes in when it first routes a model is withheld from the next child); once per SESSION per name set (the
+     *    session's announced record). `detail: { state, names?, ownCredentials?, sessionId, runId? }` — `state` `"withheld"`
+     *    carries the operator row's split (names only, never a value); `"unknown"` (the environment answered `"unknown"`)
+     *    carries no names and says the engine could not determine them.
      *  - `"config.credential_not_withheld"` (#1816) — a credential value the engine was handed (a brain's key or credential
      *    header, a model entry's or a peer's credential header, a consolidation seat's key) is no credential (a placeholder
      *    such as `EMPTY`, fewer than eight characters, one character repeated): it is used as given, but a variable holding
@@ -416,10 +435,9 @@ export interface EngineNotice {
      *    {@link import("./cross-boundary-taint.js").crossBoundaryPostureUndeclaredNotice}. Audience `operator`.
      *  - `"config.cross_boundary_record_unwritten"` — a session's cross-boundary record the engine owed could not be written (the
      *    store threw, or answered with no entry id) and refused nothing: on a tree that is not governed no judgment reads the record;
-     *    at a governed leg's prepare or settle the next leg reads the content after the newest record as off-target — except where an
-     *    earlier record of the same write landed and its catch-up did not: that catch-up record has not been written, and until #2160
-     *    lands the next leg may read the content before the earlier record as covered and may not route its device calls to a person
-     *    (KNOWN-LIMITS KL-469-c; the terminal shape is fail-closed), which the sentence says. Once per state a leg could not write;
+     *    on a governed tree it stays owed — a prepare's by the leg's next write — and once none lands (a settle's failure is the leg's
+     *    last write; a parked leg's suspend record landed before it) the next leg reads the content after the newest record as off-target,
+     *    which the sentence says for the phase that failed. Once per state a leg could not write;
      *    `detail: { sessionId, runId, phase, governed, cause }` (`phase`: `prepare` / `exit` / `suspend` / `settle`, where that state
      *    first failed). Minted by
      *    {@link import("./cross-boundary-taint.js").crossBoundaryRecordUnwrittenNotice}. Audience `operator`.
@@ -466,14 +484,16 @@ export interface EngineNotice {
      *    the first eight `{ rule, scopeRoot }`, `count` all of them; `rule` is the rule text as the store served it, through the same reading
      *    as `permission.allowed_tool_not_granted`'s `entries[].entry` (the original, not a spelling of it, when it is at most 1 024 code points;
      *    a longer one is cut to 1 024 plus the truncation mark, 1 025 in all), `scopeRoot` neutralized and bounded. Audience `user`.
-     *  - `"config.session_rules_earlier_grammar"` — a session's stored permission rules (`RunnerDeps.sessionPolicyStore`) hold
-     *    entries the rule grammar they were written in reads as nothing: an allow entry admits nothing, and a `toolDeny` entry
-     *    this engine's grammar reads as no rule makes those rules refuse every call until they are rewritten. The message names
+     *  - `"config.session_rules_earlier_grammar"` — a session's stored permission rules (`RunnerDeps.sessionPolicyStore`) were
+     *    written in an earlier rule grammar and hold entries it reads otherwise than this engine's would: an entry that grammar
+     *    reads as nothing (an allow admits nothing; a `toolDeny` entry this engine's grammar reads as no rule makes those rules
+     *    refuse every call until they are rewritten), or one whose meaning a later grammar revised — the entry keeps its writer's
+     *    meaning, or takes this grammar's when its writer's could not read it, and the message says which, with both. The message names
      *    the session, the bucket, the entries (the first five, the rest counted), the reader's word and the way out. Audience
      *    `user`. Once per distinct entry set per bucket per rule layer (the run's own rules, each ancestor's inherited ones).
      *    `detail: { bucket, storedGrammar, entries: [{ entry, reader }], rewrite: { by, stampsGrammar }, rulesSessionId,
      *    sessionId }` — `entries` every one, `entry` through the same reading as `permission.allowed_tool_not_granted`'s;
-     *    `reader` ∈ `no_rule` / `named_no_tool`; `rewrite.by` = `operator_write_without_rev`; `rulesSessionId` the session
+     *    `reader` ∈ `no_rule` / `named_no_tool` / `grammar_revised`; `rewrite.by` = `operator_write_without_rev`; `rulesSessionId` the session
      *    whose rules they are (an ancestor's on a delegated child), `sessionId` the run that read them.
      *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
      *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own

package/dist/core/engine-notice.js

@@ -1,8 +1,14 @@
+import { egressAccount, egressText } from "./untrusted-egress.js";
 let malformedNoticeSeatAnnounced = false;
 export function __resetMalformedNoticeSeatAnnouncement() {
     malformedNoticeSeatAnnounced = false;
 }
 export function deliverEngineNotice(onNotice, notice) {
+    notice = {
+        ...notice,
+        message: typeof notice.message === "string" ? egressText("same-principal", notice.message) : notice.message,
+        ...(notice.detail !== undefined ? { detail: egressAccount("same-principal", notice.detail) } : {}),
+    };
     if (notice.sessionId === undefined && typeof notice.detail?.["sessionId"] === "string") {
         notice = { ...notice, sessionId: notice.detail["sessionId"] };
     }