@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/permission-rule-org.js

@@ -284,12 +284,13 @@ function orgStateCopyOf(state) {
 function readOrgRow(row, index) {
     const { rule: text, behavior: said } = orgRowPolicyOf(row);
     const behavior = said === "ask" ? "ask" : "deny";
-    const unreadable = (code, detail) => ({
+    const unreadable = (code, detail, respelling) => ({
         kind: "unreadable",
         index,
         rule: typeof text === "string" ? text : text === undefined ? "<unreadable>" : escapeForDisclosure(text),
         code,
         ...(detail !== undefined ? { detail } : {}),
+        ...(respelling !== undefined ? { respelling } : {}),
         behavior,
         reach: reachOfRowHead(text, behavior),
     });
@@ -299,8 +300,8 @@ function readOrgRow(row, index) {
         return unreadable("invalid.grammar", said === undefined ? "no behavior" : `behavior "${escapeForDisclosure(said)}" is not deny or ask`);
     const parsed = parseRuleText(text, said);
     if ("reject" in parsed)
-        return unreadable(parsed.reject.code);
-    if (parsed.rule.tool !== COMMAND_RULE_TOOL)
+        return unreadable(parsed.reject.code, undefined, parsed.reject.respelling);
+    if (parsed.rule.tool !== COMMAND_RULE_TOOL || parsed.rule.match === "tool")
         return unreadable("unsupported.tool");
     return { kind: "read", index, rule: text, behavior: said, parsed: parsed.rule };
 }
@@ -355,6 +356,9 @@ function readListedOrgRules(rules) {
     return reading;
 }
 export function unreadableOrgRowReason(row) {
+    if (row.respelling !== undefined) {
+        return `row ${row.index} of the organization snapshot, "${escapeForDisclosure(row.rule)}", is not a rule spelling (${row.code}); republish it as "${escapeForDisclosure(row.respelling)}"`;
+    }
     return `row ${row.index} of the organization snapshot is not a rule this layer reads (${row.code}${row.detail !== undefined ? `: ${row.detail}` : ""}); republish it in the shell tool's command grammar`;
 }
 export function orgUnreadableClause(reason) {
@@ -365,7 +369,7 @@ export function describeUnreadableOrgRows(unreadable, revision) {
         return undefined;
     const named = unreadable
         .slice(0, DISCLOSED_UNREADABLE_ROWS)
-        .map((u) => `row ${u.index} "${escapeForDisclosure(u.rule)}" (${u.code}${u.detail !== undefined ? `: ${u.detail}` : ""})`)
+        .map((u) => `row ${u.index} "${escapeForDisclosure(u.rule)}" (${u.code}${u.detail !== undefined ? `: ${u.detail}` : ""}${u.respelling !== undefined ? `; republish it as "${escapeForDisclosure(u.respelling)}"` : ""})`)
         .join(", ");
     const more = unreadable.length - DISCLOSED_UNREADABLE_ROWS;
     return (`the org snapshot${revision !== undefined ? ` (revision ${escapeForDisclosure(revision)})` : ""} is served DEGRADED: ${unreadable.length} row(s) this layer cannot read — ${named}${more > 0 ? ` and ${more} more` : ""}; ` +

package/dist/core/permission-rule-provider.d.ts

@@ -36,7 +36,7 @@
  */
 import type { PersistedRule, RuleScope } from "./permission-rule-model.js";
 import { type DurableRulePartitionProvider, type QuarantinedRuleAdd } from "./permission-rule-store.js";
-import type { RuleOwner } from "./rule-owner.js";
+import { type RuleOwner } from "./rule-owner.js";
 import { type OrgRulePartitionConfig, type OrgRuleResolution } from "./permission-rule-org.js";
 import type { SessionRulePartition } from "./permission-rule-session.js";
 import type { StoreDurability, StoreFidelity } from "./checkpoint-store.js";
@@ -146,7 +146,10 @@ export interface PermissionRuleStoreProvider {
  * provider: an absent principal resolves to zero personal rules, and a provider that forgot it would hand one person's
  * standing approvals to an anonymous task. The ONE exception is an explicitly declared LOCAL-OWNER deployment, where "no
  * principal" is the typed absence of identity — the machine owner's own bucket (a provider with no such face resolves
- * the anonymous store; {@link createPermissionRuleLanes} refuses that declaration loudly).
+ * the anonymous store; {@link createPermissionRuleLanes} refuses that declaration loudly). "No principal" is ABSENCE only —
+ * `undefined`, and the empty string the engine has always spelled the same ({@link readPrincipal}). A principal that was provided
+ * and is not a name (white space, an invisible or control character) is a bad value and is refused here: read as absence it
+ * would be the machine owner's bucket on a local-owner deployment.
  */
 export declare function ownerStoreOf(provider: PermissionRuleStoreProvider, principal: string | undefined, localOwnerDeclared: boolean): PermissionRuleStore;
 /** What {@link createPermissionRuleStoreProvider} composes. */

package/dist/core/permission-rule-provider.js

@@ -1,17 +1,39 @@
-import { escapeForDisclosure } from "./permission-rule-model.js";
+import { escapeForDisclosure, isRuleBehavior, parseRuleText } from "./permission-rule-model.js";
 import { PERMISSION_RULE_WRITER, errText, isValidDurableScope, normalizePersistedRule, sameRuleIdentity, writerOf, } from "./permission-rule-store.js";
+import { readRuleOwner } from "./rule-owner.js";
+import { readPrincipal } from "./principal-name.js";
 import { UNGOVERNED_ORG_RESOLUTION, compileOrgShadowPredicate, createOrgRulePartition } from "./permission-rule-org.js";
 export function ruleSourceOf(scope) {
     return scope.kind === "global" ? "user" : scope.kind;
 }
 export function ownerStoreOf(provider, principal, localOwnerDeclared) {
-    const anonymous = principal === undefined || principal === "";
-    return anonymous && localOwnerDeclared && provider.forLocalOwner !== undefined ? provider.forLocalOwner() : provider.forPrincipal(anonymous ? undefined : principal);
+    const reading = readPrincipal(principal);
+    if (reading.kind === "invalid") {
+        throw new Error(`the principal given is not a principal name (got ${reading.fault}) — refusing to resolve a bucket for it; a provided value that names nobody is not "no principal"`);
+    }
+    if (reading.kind === "name")
+        return provider.forPrincipal(reading.name);
+    return localOwnerDeclared && provider.forLocalOwner !== undefined ? provider.forLocalOwner() : provider.forPrincipal(undefined);
 }
 function usableSessionId(sessionId) {
     return typeof sessionId === "string" && sessionId !== "" ? sessionId : undefined;
 }
 const EMPTY_DURABLE = { rules: [], tombstones: [], rev: 0 };
+function durableReadOf(settled) {
+    if (!settled.ok)
+        return settled;
+    for (const [kind, rows] of [["rule", settled.v.rules], ["tombstone", settled.v.tombstones]]) {
+        const at = rows.findIndex((r) => !isRuleBehavior(r?.behavior));
+        if (at < 0)
+            continue;
+        const row = rows[at];
+        return {
+            ok: false,
+            e: new Error(`the persisted rule partition served a ${kind} row (#${at}, ${escapeForDisclosure(row?.rule)}) whose behavior word ${escapeForDisclosure(row?.behavior)} is outside deny/ask/allow — whether it refuses a call is unknown, so the partition is read as one that could not be read`),
+        };
+    }
+    return settled;
+}
 export function createPermissionRuleStoreProvider(cfg) {
     if (cfg === null || typeof cfg !== "object") {
         throw new Error("createPermissionRuleStoreProvider takes a config object naming the partitions to compose");
@@ -61,7 +83,7 @@ class UnifiedPermissionRuleStore {
         const disclosures = [];
         const [orgSettled, durableSettled, sessionRows] = await Promise.all([
             this.org !== undefined ? this.org.resolve() : Promise.resolve({ ...UNGOVERNED_ORG_RESOLUTION, rules: [], disclosures: [] }),
-            this.durable !== undefined ? this.durable.list().then((v) => ({ ok: true, v }), (e) => ({ ok: false, e })) : Promise.resolve({ ok: true, v: EMPTY_DURABLE }),
+            this.durable !== undefined ? this.durable.list().then((v) => durableReadOf({ ok: true, v }), (e) => ({ ok: false, e })) : Promise.resolve({ ok: true, v: EMPTY_DURABLE }),
             this.readSessionRows(usableSessionId(query?.sessionId), disclosures),
         ]);
         const orgResolution = orgSettled;
@@ -106,7 +128,7 @@ class UnifiedPermissionRuleStore {
             const served = structuredClone(await this.session.read(sessionId));
             const rows = served.filter((r) => {
                 const scope = r?.scope;
-                return scope?.kind === "session" && scope.sessionId === sessionId && !("reject" in normalizePersistedRule(r));
+                return scope?.kind === "session" && scope.sessionId === sessionId && (!("reject" in normalizePersistedRule(r)) || ((r.behavior === "deny" || r.behavior === "ask") && "reject" in parseRuleText(r.rule, r.behavior)));
             });
             if (rows.length < served.length) {
                 disclosures.push(`the session rule partition served ${served.length - rows.length} row(s) that are not canonical session rows of this session — dropped, not adjudicated`);
@@ -157,8 +179,17 @@ export async function effectivePermissionRules(opts) {
     return await resolveOwnerStore(opts).effective(opts.sessionId !== undefined ? { sessionId: opts.sessionId } : undefined);
 }
 export function resolveOwnerStore(opts) {
-    if (opts.owner !== undefined && opts.owner.kind === "local-owner") {
-        if (opts.principal !== undefined) {
+    const owner = opts.owner === undefined ? undefined : readRuleOwner(opts.owner);
+    if (opts.owner !== undefined && owner === undefined) {
+        throw new Error("the owner given is neither a principal nor the local owner (a principal owner names a principal name) — refusing to resolve a bucket nobody can name");
+    }
+    const given = readPrincipal(opts.principal);
+    if (given.kind === "invalid") {
+        throw new Error(`the principal given is not a principal name (got ${given.fault}) — pass a verified principal, the local owner, or neither; a provided value that names nobody is not "no principal"`);
+    }
+    const principal = given.kind === "name" ? given.name : undefined;
+    if (owner?.kind === "local-owner") {
+        if (principal !== undefined) {
             throw new Error("pass either a principal or a local-owner, not both — a bucket has one owner");
         }
         const store = opts.provider.forLocalOwner?.();
@@ -167,9 +198,8 @@ export function resolveOwnerStore(opts) {
         }
         return store;
     }
-    if (opts.owner !== undefined && opts.owner.kind === "principal" && opts.principal !== undefined && opts.owner.principal !== opts.principal) {
-        throw new Error(`contradictory identity: principal "${escapeForDisclosure(opts.principal)}" and owner principal "${escapeForDisclosure(opts.owner.principal)}" disagree`);
+    if (owner?.kind === "principal" && principal !== undefined && owner.principal !== principal) {
+        throw new Error(`contradictory identity: principal "${escapeForDisclosure(principal)}" and owner principal "${escapeForDisclosure(owner.principal)}" disagree`);
     }
-    const principal = opts.owner?.kind === "principal" ? opts.owner.principal : opts.principal;
-    return opts.provider.forPrincipal(principal);
+    return opts.provider.forPrincipal(owner?.kind === "principal" ? owner.principal : principal);
 }

package/dist/core/permission-rule-store.d.ts

@@ -45,7 +45,7 @@ import type { PersistedRule, RuleAdd, RuleDot, RuleScope, RuleTombstone } from "
 import { type RuleBehavior } from "./permission-rule-model.js";
 import type { RuleSyncDropReason, RuleQuarantineReason } from "./governance-codes.js";
 import type { StoreDurability, StoreFidelity } from "./checkpoint-store.js";
-import type { RuleOwner } from "./rule-owner.js";
+import { type RuleOwner } from "./rule-owner.js";
 /** One store read: the rules as persisted, their tombstones, and the revision they were read at. */
 export interface StoredRules {
     /** Rules with their FULL add sets — tombstoned dots already removed by the backend on read. */
@@ -93,7 +93,8 @@ export interface DurableRulePartition {
     /** Declared serialization fidelity, same doctrine as the other store families. */
     readonly fidelity?: StoreFidelity;
 }
-/** Resolves one owner's durable partition. `undefined` ⇒ a partition that reports zero rules. This is
+/** Resolves one owner's durable partition. `undefined` — or anything that is not a principal name
+ *  (`principalNameOf`: the empty and the blank string included) ⇒ a partition that reports zero rules. This is
  *  the BACKEND contract (file, in-memory, an out-of-repo SQL twin); the engine never consumes it
  *  directly — `createPermissionRuleStoreProvider({ durable })` composes it into the unified store. */
 export interface DurableRulePartitionProvider {

package/dist/core/permission-rule-store.js

@@ -1,6 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { canonicalize } from "./canonical-json.js";
 import { escapeForDisclosure, isRuleBehavior, isRuleLive, parseRuleText } from "./permission-rule-model.js";
+import { readRuleOwner } from "./rule-owner.js";
 import { thrownText } from "./thrown-value.js";
 import { validatePath } from "./effective-path-target.js";
 export const PERMISSION_RULES_LATER_GRAMMAR_CODE = "permission_rules.later_grammar";
@@ -510,6 +511,10 @@ async function readRuleLiveness(store, identity) {
     }
 }
 const REMOVE_MAX_ATTEMPTS = 8;
+const NO_TARGET_OWNER = "the principal given is neither a principal name (a string with a visible character, no control or separator character, and no format character but a joiner) nor an owner (a principal owner names a principal name; the local owner is { kind: \"local-owner\" })";
+function persistedRuleTargetOwner(target) {
+    return readRuleOwner(typeof target === "string" ? { kind: "principal", principal: target } : target);
+}
 export async function removePersistedRule(opts) {
     const behavior = opts.behavior;
     const rule = opts.rule;
@@ -519,7 +524,9 @@ export async function removePersistedRule(opts) {
         return { status: "failed", error: `removePersistedRule: behavior ${escapeForDisclosure(behavior)} is not one of ${["deny", "ask", "allow"].join("/")} — refusing to name a rule identity nothing can carry`, committed: "no" };
     }
     const identity = { behavior, rule, scope };
-    const owner = typeof target === "string" ? { kind: "principal", principal: target } : structuredClone(target);
+    const owner = persistedRuleTargetOwner(target);
+    if (owner === undefined)
+        return { status: "failed", error: `removePersistedRule: ${NO_TARGET_OWNER} — refusing to remove from a bucket nobody can name`, committed: "no" };
     const provider = opts.provider;
     if (scope?.kind === "session") {
         return {
@@ -686,7 +693,9 @@ export async function addPersistedRule(opts) {
     if ("reject" in parsed)
         return { status: "failed", error: `addPersistedRule: ${parsed.reject.code}: ${parsed.reject.message}`, committed: "no" };
     const identity = { behavior, rule: parsed.rule.rule, scope };
-    const owner = typeof target === "string" ? { kind: "principal", principal: target } : structuredClone(target);
+    const owner = persistedRuleTargetOwner(target);
+    if (owner === undefined)
+        return { status: "failed", error: `addPersistedRule: ${NO_TARGET_OWNER} — refusing to write into a bucket nobody can name`, committed: "no" };
     const provider = opts.provider;
     if (owner.kind === "local-owner" && provider.forLocalOwner === undefined) {
         return { status: "failed", error: "this provider has no local-owner bucket (forLocalOwner is not implemented) — a local-owner rule cannot be added through it", committed: "no" };

package/dist/core/permission-rule-sync.js

@@ -1,4 +1,5 @@
 import { escapeForDisclosure, isRuleBehavior, parseRuleText, RULE_ADD_ORIGINS } from "./permission-rule-model.js";
+import { principalNameOf } from "./principal-name.js";
 import { PERMISSION_RULES_LATER_GRAMMAR_CODE, applyTombstones, errText, isProjectScopeRoot, joinFrontiers, joinRuleStates, normalizePersistedRule, readRuleWriteOutcome, ruleSyncVector, sameRuleIdentity, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
 import { emitTrace } from "./trace.js";
 import { SESSION_RULES_GRAMMAR, readRuleGrammarStamp } from "./session-policy-store.js";
@@ -23,8 +24,8 @@ export async function syncPermissionRules(opts) {
             throw new Error(`contradictory identity: principal "${escapeForDisclosure(principal)}" and owner principal "${escapeForDisclosure(owner.principal)}" disagree`);
         }
     }
-    if (typeof principal !== "string" || principal === "") {
-        throw new Error("syncPermissionRules requires a verified principal — an unauthenticated deployment has no cloud bucket to sync");
+    if (principalNameOf(principal) === undefined) {
+        throw new Error("syncPermissionRules requires a verified principal — an unauthenticated deployment has no cloud bucket to sync (a blank name, or one holding a control, separator or invisible format character, is not a principal)");
     }
     const traceClock = opts.now ?? Date.now;
     const disclose = (result) => {

package/dist/core/permission-rule-syntax.d.ts

@@ -29,10 +29,11 @@ export declare function lastIndexOfUnescaped(s: string, ch: string): number;
  */
 export declare function parsePermissionRule(rule: string): ParsedPermissionRule;
 /**
- * Can a rule name this tool name — is it the rule syntax's name head ({@link RULE_TOOL_NAME}) and not the lone `*`? The
- * lone `*` is the wildcard (every tool), not a name: a tool called `*` could never be granted or refused on its own. The
- * mount contract for every name a caller tool answers to (its name and each alias), so each one is a name every list can
- * write; a protocol-minted name (`<ns>__<peer>__<tool>`, segments in `[A-Za-z0-9_-]`) is always one.
+ * Can a rule name this tool name — is it the rule syntax's name head ({@link RULE_TOOL_NAME}) with no `*` in it? A `*` makes a
+ * spelling a glob over names, not a name: a tool whose name held one would be reached by every rule whose glob matches it and
+ * could never be named on its own (the reference's mount spelling holds no `*` either). The mount contract for every name a
+ * caller tool answers to (its name and each alias), so each one is a name every list can write; a protocol-minted name
+ * (`<ns>__<peer>__<tool>`, segments in `[A-Za-z0-9_-]`) is always one.
  */
 export declare function isNameableToolName(name: string): boolean;
 /**

package/dist/core/permission-rule-syntax.js

@@ -36,9 +36,9 @@ export function parsePermissionRule(rule) {
         return { toolName: name.trim() };
     return { toolName: name.trim(), ruleContent: unescapeRuleContent(content) };
 }
-const RULE_TOOL_NAME = /^(?:\*|[A-Za-z0-9_](?:[A-Za-z0-9_.:*-]*[A-Za-z0-9_*-])?)$/;
+const RULE_TOOL_NAME = /^[A-Za-z0-9_*](?:[A-Za-z0-9_.:*-]*[A-Za-z0-9_*-])?$/;
 export function isNameableToolName(name) {
-    return typeof name === "string" && name !== "*" && RULE_TOOL_NAME.test(name);
+    return typeof name === "string" && !name.includes("*") && RULE_TOOL_NAME.test(name);
 }
 export function ruleSpellingOf(rule) {
     if (rule !== rule.trim())

package/dist/core/permission-rules.d.ts

@@ -90,8 +90,8 @@ export interface PermissionRuleIssue {
     /** A rule the rule syntax reads no rule in (`ruleSpellingOf`) whose name is the reason: blanks around the rule, a
      *  character outside a tool name's spelling (a variation selector, a filler, a zero-width space), a blank or an invisible
      *  character before the `(`, a leading `-`. Refused — the lenient reading would deny a tool under another spelling, or none.
-     *  Also a rule whose tool name the syntax reads as the wildcard `*` (`*`, `*()`, `*(*)`): a rule reaches the tool it
-     *  names, and `*` names none. */
+     *  (A `*` in a tool name is no such spelling: a deny or ask rule reads it as a glob over the whole name, `*` alone as every
+     *  tool.) */
      | "invalid.tool_name" | "invalid.param_split" | "invalid.primary_field" | "invalid.cap_exceeded"
     /** An ALLOW rule (any spelling): a policy fold says deny / ask only — "this does not need asking" is the allow
      *  layer's (`TaskSpec.allowedTools`, `RunnerDeps.allowedTools`). One issue per allow rule. */
@@ -206,8 +206,8 @@ export interface PermissionRulePolicyOptions {
      */
     pathBases?: PathRuleBases;
 }
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, wildcardMatch } from "./namespaced-rule-name.js";
-export { isNamespacedCoveringRuleName, namespacedRuleNameCovers, wildcardMatch };
+import { isCoveringRuleName, ruleNameCovers, wildcardMatch } from "./namespaced-rule-name.js";
+export { isCoveringRuleName, ruleNameCovers, wildcardMatch };
 /**
  * design/388 A-6/7/8/9 (D-3): the per-tool RULE FACE — the parameters a `Tool(param:pattern)` rule may name
  * (`params`, the SCALAR top-level keys ∪ the path target's aliases), the ones the generic lexical matcher must

package/dist/core/permission-rules.js

@@ -1,5 +1,5 @@
 import { attest } from "./tool-policy.js";
-import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
+import { MCP_NAMESPACE } from "./protocol-table.js";
 import { catalogRuleFaceOf, isShellFaceToolName, pathTargetOf } from "./tool-registry.js";
 import { HOST_UNREADABLE_SENTENCE, callHostTargetOf } from "./host-target.js";
 import { indexOfUnescaped, lastIndexOfUnescaped, parsePermissionRule, ruleSpellingOf } from "./permission-rule-syntax.js";
@@ -36,9 +36,8 @@ export const DEFAULT_CAPS = {
     maxStars: 16,
     maxScalarValueChars: DEFAULT_MAX_SCALAR_VALUE_CHARS,
 };
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, wildcardMatch } from "./namespaced-rule-name.js";
-import { wildcardPeerRefusalOf } from "./tool-name-aliases.js";
-export { isNamespacedCoveringRuleName, namespacedRuleNameCovers, wildcardMatch };
+import { isCoveringRuleName, ruleNameCovers, wildcardMatch } from "./namespaced-rule-name.js";
+export { isCoveringRuleName, ruleNameCovers, wildcardMatch };
 const vocabularyOf = (face) => face.params ?? face.primaryParams;
 const carriedPhrase = (face) => {
     const vocabulary = vocabularyOf(face);
@@ -119,22 +118,13 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
             bad(text, why.code, why.message);
             continue;
         }
-        if (parsed.toolName === "*") {
-            bad(text, "invalid.tool_name", "`*` names no tool — a rule reaches the tool it names, so this one would compile and never match; name the tool", { name: "defaultAction" });
-            continue;
-        }
         const toolName = parsed.toolName;
         const parenthesised = parsed.ruleContent !== undefined || indexOfUnescaped(text, "(") !== -1;
         if (toolName.startsWith(MCP_NAMESPACE.prefix) && parenthesised) {
             bad(text, "unsupported.mcp_paren", "MCP rules do not support patterns in parentheses (CC parity); a rule names a whole tool (`mcp__<server>__<tool>`) or a whole server (`mcp__<server>`), and what a tool does is declared per tool in the MCP server's spec", { name: "toolAxes" });
             continue;
         }
-        const wildPeer = wildcardPeerRefusalOf(toolName, verb);
-        if (wildPeer !== undefined) {
-            bad(text, "invalid.tool_name", wildPeer);
-            continue;
-        }
-        if (parenthesised && isNamespacedCoveringRuleName(toolName, verb)) {
+        if (ruleContentOf(parsed) !== undefined && isCoveringRuleName(toolName, verb)) {
             bad(text, "unsupported.covering_paren", `"${toolName}" reaches a SET of tools, and the generic param DSL is keyed by exact tool name — a parenthesised rule on it can never match. ` +
                 `Write the parenthesised rule against one exact tool name, or drop the parentheses to keep the covering rule.`);
             continue;
@@ -142,7 +132,7 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
         const entry = byTool.get(toolName) ?? { bare: {}, param: { deny: [], ask: [] }, content: { deny: [], ask: [] } };
         const content = ruleContentOf(parsed);
         if (content === undefined) {
-            if (isNamespacedCoveringRuleName(toolName, verb)) {
+            if (isCoveringRuleName(toolName, verb)) {
                 namespacedCovering[verb].push({ ruleName: toolName, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
                 continue;
             }
@@ -339,7 +329,8 @@ export function createPermissionRulePolicy(rules, opts) {
         for (const r of namespacedCovering[behavior])
             nameSets[behavior].push(r.ruleName);
     }
-    const coveringHit = (lane, toolName) => lane.length === 0 ? undefined : lane.find((r) => namespacedRuleNameCovers(r.ruleName, toolName));
+    const heldFor = (table, req) => heldValues("policy.permissionRules", table, req);
+    const coveringHit = (lane, req) => lane.length === 0 ? undefined : heldFor({ get: (name) => lane.find((r) => ruleNameCovers(r.ruleName, name)) }, req)[0];
     const hasCovering = namespacedCovering.deny.length > 0 || namespacedCovering.ask.length > 0;
     const faceRules = {
         deny: [...byTool.values()].flatMap((e) => e.content.deny.filter((r) => r.faces !== undefined)),
@@ -454,7 +445,7 @@ export function createPermissionRulePolicy(rules, opts) {
         requiresRealApproval: true,
     });
     const entryFor = (req) => {
-        const entries = heldValues("policy.permissionRules", byTool, req);
+        const entries = heldFor(byTool, req);
         if (entries.length <= 1)
             return entries[0];
         const bare = {};
@@ -474,12 +465,12 @@ export function createPermissionRulePolicy(rules, opts) {
         ...(pathSpecs.length > 0 ? { pathRules: (anchors) => boundAt(policyAnchors(pathBases, anchors)).rows } : {}),
         check(req) {
             const entry = entryFor(req);
-            const covering = hasCovering && protocolOf(req.toolName) !== undefined;
+            const covering = hasCovering;
             if (entry?.bare.deny) {
                 return { action: "deny", message: ruleDenial(req, entry.bare.deny.ruleText, entry.bare.deny.source) };
             }
             if (covering) {
-                const coveringDeny = coveringHit(namespacedCovering.deny, req.toolName);
+                const coveringDeny = coveringHit(namespacedCovering.deny, req);
                 if (coveringDeny)
                     return { action: "deny", message: ruleDenial(req, coveringDeny.ruleText, coveringDeny.source) };
             }
@@ -509,7 +500,7 @@ export function createPermissionRulePolicy(rules, opts) {
                 }
             }
             if (covering) {
-                const coveringAsk = coveringHit(namespacedCovering.ask, req.toolName);
+                const coveringAsk = coveringHit(namespacedCovering.ask, req);
                 if (coveringAsk)
                     return { action: "ask", message: ruleAskMessage(coveringAsk.ruleText, coveringAsk.source), matchedAskRule: coveringAsk.ruleText };
             }

package/dist/core/persisted-rule-arms.d.ts

@@ -44,7 +44,7 @@ export declare function disclosedRuleSet(rules: readonly PersistedRuleHitRule[])
  *    lane's allow carries: one authority, one word) and the rule text disclosed through the display
  *    transform; the STATION attributes the refusal (`tightened: "deny"` ⇒ it writes the pass's refusing
  *    layer — the attribution is a station's word and lives in the station file). A path row's hit reports where
- *    it met the call; with `call` given and the face the call's own, the deny carries that as its attested `pathDenial`, so every exit that
+ *    it met the call; with the face the call's own (`call`, the request the lane read), the deny carries that as its attested `pathDenial`, so every exit that
  *    reads the deny (the gate's exit, the approved-edit re-check, a resumed leg's belt) mints the same card from the same fact.
  *  · ASK — on an allow, a fresh ask is minted carrying `matchedAskRule` (the marker an explicit `ask`
  *    permission rule stamps, so the ask's origin derives as `ask_rule`: the classifier never answers
@@ -69,7 +69,7 @@ export declare function disclosedRuleSet(rules: readonly PersistedRuleHitRule[])
  *    resumed-call belt, which vetoes only the call form: a person already answered that call's question.
  * An allow hit (or no hit) returns the decision untouched: the allow arm is the station's.
  */
-export declare function applyPersistedTightening(decision: PermissionResult, read: PersistedRuleRead | undefined, call?: ToolCallRequest): {
+export declare function applyPersistedTightening(decision: PermissionResult, read: PersistedRuleRead | undefined, call: ToolCallRequest): {
     decision: PermissionResult;
     tightened?: "deny" | "ask" | "unreadable" | "store_unreadable";
 };

package/dist/core/persisted-rule-arms.js

@@ -1,6 +1,6 @@
-import { attest } from "./tool-policy.js";
+import { attest, attestationOf } from "./tool-policy.js";
 import { callPathFaceOf } from "./permission-rule-model.js";
-import { decisionAskClassesOf } from "./ask-origin.js";
+import { ownAskClassesOf } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export function strongestAnswer(answers) {
     const rank = (a) => (a === undefined ? 0 : "unreadable" in a ? 4 : "behavior" in a ? { deny: 5, ask: 3, allow: 2 }[a.behavior] : 1);
@@ -20,15 +20,13 @@ export function applyPersistedTightening(decision, read, call) {
             ? `this call could not be read against the person's standing deny/ask rules (${read.reason}) — whether one of them forbids it is unknown, so it needs a real approval`
             : "the person's standing permission rules could not be read — whether one of them forbids this call is unknown, so it needs a real approval";
         const unreadableCall = callForm ? { ruleUnreadable: "persisted_call" } : {};
-        const standingFence = decision.action === "ask" && decisionAskClassesOf({ ...decision, foldedAskClasses: undefined }).has("policy_rra")
-            ? { foldedAskClasses: [...(decision.foldedAskClasses ?? []), "policy_rra"] }
-            : {};
-        return {
-            decision: decision.action === "allow"
-                ? { action: "ask", message, decisionReason: "persisted_rule", requiresRealApproval: true, ...unreadableCall, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) }
-                : { ...decision, requiresRealApproval: true, ...unreadableCall, ...standingFence, message: `${decision.message !== undefined ? `${decision.message} ` : ""}(${message})` },
-            tightened: callForm ? "unreadable" : "store_unreadable",
-        };
+        const tightened = callForm ? "unreadable" : "store_unreadable";
+        if (decision.action === "allow") {
+            return { decision: { action: "ask", message, decisionReason: "persisted_rule", requiresRealApproval: true, ...unreadableCall, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) }, tightened };
+        }
+        const record = attestationOf(decision, call);
+        const asked = { ...decision, requiresRealApproval: true, ...unreadableCall, message: `${decision.message !== undefined ? `${decision.message} ` : ""}(${message})` };
+        return { decision: ownAskClassesOf(decision, record).has("policy_rra") ? attest(asked, call, { foldedClasses: [...new Set([...(record?.foldedClasses ?? []), "policy_rra"])] }) : asked, tightened };
     }
     const hit = read?.hit;
     if (hit === undefined || hit.behavior === "allow")
@@ -36,7 +34,7 @@ export function applyPersistedTightening(decision, read, call) {
     const shown = disclosedRuleSet(hit.rules);
     if (hit.behavior === "deny") {
         const denied = { action: "deny", message: `a persisted deny rule (${shown}) refuses this call`, decisionReason: "persisted_rule" };
-        const attested = hit.denial !== undefined && call !== undefined && hit.denial.face === callPathFaceOf(call);
+        const attested = hit.denial !== undefined && hit.denial.face === callPathFaceOf(call);
         return { decision: attested ? attest(denied, call, { pathDenial: hit.denial }) : denied, tightened: "deny" };
     }
     if (decision.action === "deny")

package/dist/core/principal-name.d.ts

@@ -0,0 +1,20 @@
+export declare function principalNameOf(raw: unknown): string | undefined;
+/** What a value offered as THE principal of a task or of a lookup is — read once, here, so no face decides it on its own. */
+export type PrincipalReading = {
+    readonly kind: "name";
+    readonly name: string;
+} | {
+    readonly kind: "absent";
+} | {
+    readonly kind: "invalid";
+    readonly fault: string;
+};
+/**
+ * A principal offered to a face that tolerates having none: `name` (a principal name), `absent` (no principal — `undefined`, and the
+ * empty string, which the task door and the bucket resolvers have always spelled the same), or `invalid` (it was PROVIDED and is not a name). Only absence reaches
+ * the unauthenticated floor, or the declared local owner's bucket; an invalid value is a bad value, refused where a principal is taken
+ * (never read as absence — a caller who appends one invisible character to a principal must not become the machine owner).
+ */
+export declare function readPrincipal(raw: unknown): PrincipalReading;
+/** Why a value is not a principal name, as a clause for a refusal sentence: the kind of string it is, or the type of the value. */
+export declare function principalNameFault(raw: unknown): string;

package/dist/core/principal-name.js

@@ -0,0 +1,22 @@
+const NOT_IN_A_NAME = /[\p{Cc}\p{Zl}\p{Zp}]|(?![\u200c\u200d])\p{Cf}/u;
+const NOT_VISIBLE = /[\s\p{Cf}]+/gu;
+export function principalNameOf(raw) {
+    return typeof raw === "string" && raw.replace(NOT_VISIBLE, "") !== "" && !NOT_IN_A_NAME.test(raw) ? raw : undefined;
+}
+export function readPrincipal(raw) {
+    if (raw === undefined || raw === "")
+        return { kind: "absent" };
+    const name = principalNameOf(raw);
+    return name !== undefined ? { kind: "name", name } : { kind: "invalid", fault: principalNameFault(raw) };
+}
+export function principalNameFault(raw) {
+    if (typeof raw !== "string")
+        return raw === null ? "null" : typeof raw;
+    if (raw === "")
+        return "an empty string";
+    if (raw.trim() === "")
+        return "a blank string";
+    if (raw.replace(NOT_VISIBLE, "") === "")
+        return "a string with no visible character";
+    return "a string holding a control, separator or format character";
+}

package/dist/core/prompt-section-seat.js

@@ -1,16 +1,14 @@
 import { bandOf } from "../prompt-assembly/bands.js";
-import { lockedTextIn, receivePromptData } from "../prompt-assembly/overlay.js";
+import { lockedTextIn } from "../prompt-assembly/overlay.js";
+import { isPlainRecord } from "./mods/kernel/receive.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { egressThrownText, extensionWords } from "./untrusted-egress.js";
 export const DISPOSABLE_PROMPT_SECTIONS = Object.freeze(["core/discovery.mcp-instructions"]);
 const DEFECT_MAX = 600;
 function readAnswer(answer, seat) {
-    if (typeof answer !== "object" || answer === null || Array.isArray(answer))
+    if (!isPlainRecord(answer))
         return `answered ${answer === null ? "null" : Array.isArray(answer) ? "an array" : typeof answer}; prompt.section takes { text: string | null }`;
-    const received = receivePromptData(answer);
-    if ("notData" in received)
-        return `a prompt.section answer is data (plain objects, arrays, strings, booleans); it holds ${received.notData}`;
-    const data = received.value;
+    const data = answer;
     const keys = Object.keys(data);
     const stray = keys.filter((k) => k !== "text");
     if (stray.length > 0)

package/dist/core/protocol-http-auth.d.ts

@@ -10,10 +10,11 @@
  * A declaration that breaks the rule is that peer's defect: the resolver throws inside the peer's own dial,
  * so the peer is skipped with a coded warning and its siblings still mount. The MCP transport binds its
  * endpoint by dialing only the declared URL with redirects not followed (`declaredEndpointFetch`); the A2A
- * peer, whose card may name another endpoint, is bound by {@link assertEndpointBound} and by
- * {@link redirectPolicy}.
+ * peer, whose card may name another endpoint, is bound by {@link assertEndpointBound} and by its follow law (a request carrying
+ * declared headers follows no redirect, {@link carriesDeclaredHeaders}).
  */
 import type { ProtocolId } from "./protocol-table.js";
+import { type Egress } from "./untrusted-egress.js";
 /** The per-peer HTTP auth declaration every protocol spec carries in the same two fields. */
 export interface ProtocolHttpAuth {
     headers?: Record<string, string>;
@@ -35,10 +36,44 @@ export declare function resolveProtocolHttpHeaders(protocol: ProtocolId, t: Prot
 /** The engine's default request headers under the declared ones: a declared name, in any case, owns that header
  *  (the default of the same name is not sent beside it). */
 export declare function underDeclaredHeaders(defaults: Readonly<Record<string, string>>, declared: Record<string, string> | undefined): Record<string, string>;
-/** Whether a resolved header set carries anything the declaration bound to its endpoints. */
+/**
+ * Every header VALUE one HTTP peer's requests carry, whatever the header's NAME: each string value of the declaration's static
+ * `headers` and the principal the engine sends under `principalHeader`, as declared. The transport knows these; the credential vocabulary
+ * can only guess by name. How an endpoint can print one back — edges dropped, its credentials part, percent-encoded — is derived from
+ * each value by {@link requestEchoSpellings}, once, and nowhere else.
+ * Total: a declaration whose members cannot be read yields what could be read, because it is called on a failure path.
+ */
+export declare function declaredHeaderValues(transport: unknown, principal?: string): readonly string[];
+/**
+ * A peer's error text with what the peer was SENT taken out of it. Both kinds of removal are found on the ORIGINAL text (so no marker is
+ * rescanned and no replacement can disturb what another one reads) and the ranges they take are merged, one marker per merged range: every
+ * occurrence of a declared value in any spelling {@link requestEchoSpellings} derives from it (as declared and as sent, its credentials
+ * part, JSON-escaped with or without `\/`, percent-encoded, form-urlencoded, `+` for a space), in any letter case, longest first, and every `Cookie` / `Set-Cookie` member
+ * whole — a header line to its end, a record member's string, array or object to its close. The two never disarm each other: a declared
+ * value that lies wholly inside a Cookie member's NAME leaves the name (and the member's value is still taken); one that overlaps the name
+ * from outside takes its own range and the member's value goes with it. A declared value that is also an ordinary word or number (`en`, `1`,
+ * `application/json`) goes wherever it occurs in the remote's words, in any case — a legibility cost, never a leak; the failure's closed
+ * fields (code, status, delivery) are not text. A declaration too large for one matcher (tens of thousands of characters, which no header
+ * carries) makes the whole text the marker: the pass never throws and never shows what it could not match. A hit that lies wholly inside
+ * a marker a pass already wrote (the exact literals, `redactionMarkerSpans`) is no hit, and one that reaches into a marker takes the
+ * whole marker with it, so the pass over its own output answers the same text.
+ */
+export declare function scrubRequestEcho(text: string, declared: readonly string[]): string;
+/**
+ * THE one form a remote endpoint's words take when the engine carries them in its own words — an MCP server's failure, a model
+ * provider's error body, frame or transport failure, a memory distiller seat's failure: what the request was declared with
+ * ({@link scrubRequestEcho}: `declared` is required, so no mint reads a remote's words without naming its request), then the credential
+ * vocabulary. Words with no declared value in them read exactly as the vocabulary renders them. Where a declared value is there, the
+ * values the vocabulary finds in the ORIGINAL words are taken out with it, so neither disarms the other: removing a declared `Bearer`
+ * cannot hide the token after it from the vocabulary, and the vocabulary rewriting part of a declared value cannot leave the rest. A
+ * caller that bounds the text for display cuts what this returns, never the remote's raw words, so a cut can leave no part of a value.
+ * The function is a fixed point (its own output answers the same text). A store, a log or an event lane that receives the result does
+ * not redact again: persistence is not an exit, the mint is.
+ */
+export declare function remoteWords(text: string, declared: readonly string[]): Egress<"same-principal">;
+/** Whether a resolved header set carries anything the declaration bound to its endpoints — a request that does follows no redirect (the
+ *  next hop is not a declared endpoint; A2A's follow law reads this). */
 export declare function carriesDeclaredHeaders(headers: Record<string, string> | undefined): boolean;
-/** A request carrying declared headers does not follow a redirect (the next hop is not a declared endpoint). */
-export declare function redirectPolicy(headers: Record<string, string> | undefined): "manual" | "follow";
 /**
  * Refuse an endpoint a peer advertised (an A2A card's interface URL) when it lies outside every origin the
  * declaration names and the peer's requests carry declared headers: `config.protocol_endpoint_unbound`.