@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/rewrite-rejudge.d.ts

@@ -0,0 +1,60 @@
+import type { PreToolUseResult } from "./hooks.js";
+import type { PermissionResult } from "./tool-policy.js";
+import type { PreToolUseScreening } from "./runner/gate-exit.js";
+/** What a judge did with the bytes it was handed: kept them (`as_is`), or handed back another form. */
+export type RejudgeReading = {
+    readonly kind: "as_is";
+} | {
+    readonly kind: "rewritten";
+    readonly form: unknown;
+};
+/** Do `a` and `b` read as the same bytes for the call `req` — each as the tool reads it? */
+export declare function sameBytes(req: {
+    readonly face?: object | undefined;
+}, a: unknown, b: unknown): boolean;
+/** The one reading of a judge's answer about the bytes it was handed (`given`): its `updatedInput` is a rewrite only when it
+ *  reads as other bytes; the form is returned as the tool reads it. */
+export declare function readRejudge(req: {
+    readonly face?: object | undefined;
+}, given: unknown, answer: {
+    readonly updatedInput?: unknown;
+} | undefined): RejudgeReading;
+/** What the PreToolUse screening said on its one second look at bytes rewritten after it judged: its verdict on them
+ *  (`stands` — no opinion, an allow, an ask; never a rewrite), or a refusal — the hook's own deny, or the engine's
+ *  (the screening failed, or it handed back yet another form). */
+export type ScreeningRejudge = {
+    readonly kind: "stands";
+    readonly answer: PreToolUseResult | undefined;
+    readonly answeredBy?: string;
+} | {
+    readonly kind: "refused";
+    readonly reason: string;
+    readonly by: "hook" | "engine";
+};
+/** The screening's second look at rewritten `bytes` (the gate's fold after a policy rewrite; the approved-edit pass). */
+export declare function screenRewrite(screening: PreToolUseScreening, req: {
+    readonly face?: object | undefined;
+    readonly toolName: string;
+}, bytes: unknown, subject: string): Promise<ScreeningRejudge>;
+/**
+ * A person's edit the restriction chain accepts only in another form: that form, as the tool reads it. Machine-readable, so
+ * a surface can offer "approve this form" — approving it as it stands runs exactly these bytes (they are the chain's own
+ * answer, so re-judging them changes nothing). Present on the approval request of the question that puts the form to the person,
+ * on a durable resume's refusal (`detail.editRewritten`), and on a refusal's details where nobody is left to ask.
+ */
+export interface EditRewritten {
+    readonly acceptableForm: unknown;
+}
+/** The question that puts a person's edit back to them, over the pass's standing verdict on the form: an allow becomes
+ *  this question; an ask keeps its own words after the outlet sentence (and every member it carries). It goes to the
+ *  approver whose edit it answers; its classes are the pass's, read by the one ladder like any of its questions. */
+export declare function outletAsk(standing: Exclude<PermissionResult, {
+    action: "deny";
+}>, toolName: string, form: unknown): Extract<PermissionResult, {
+    action: "ask";
+}>;
+/** The one sentence of a person's edit that a judge accepts only rewritten; each lane adds its outlet (approve the form shown /
+ *  decide again with it / re-issue the call). */
+export declare function editRewrittenSentence(toolName: string): string;
+/** The one sentence of a rewrite a judge would rewrite again on its one second look. */
+export declare function rewriteChasedSentence(toolName: string): string;

package/dist/core/rewrite-rejudge.js

@@ -0,0 +1,36 @@
+import { canonicalize } from "./canonical-json.js";
+import { argsAsTheToolReads } from "./effective-path-target.js";
+export function sameBytes(req, a, b) {
+    return a === b || canonicalize(argsAsTheToolReads(req, a)) === canonicalize(argsAsTheToolReads(req, b));
+}
+export function readRejudge(req, given, answer) {
+    const rewrite = answer?.updatedInput;
+    return rewrite === undefined || sameBytes(req, given, rewrite) ? { kind: "as_is" } : { kind: "rewritten", form: argsAsTheToolReads(req, rewrite) };
+}
+export async function screenRewrite(screening, req, bytes, subject) {
+    const screened = await screening.screen(bytes, subject);
+    if (screened.kind === "refused")
+        return { kind: "refused", reason: screened.reason, by: "engine" };
+    const r = screened.answer;
+    if (r?.action === "deny")
+        return { kind: "refused", reason: screening.deniedReason(r), by: "hook" };
+    if (readRejudge(req, bytes, r).kind === "rewritten")
+        return { kind: "refused", reason: rewriteChasedSentence(req.toolName), by: "engine" };
+    if (r === undefined)
+        return { kind: "stands", answer: undefined, ...(screened.answeredBy !== undefined ? { answeredBy: screened.answeredBy } : {}) };
+    const { updatedInput: _sameBytes, ...answer } = r;
+    return { kind: "stands", answer, ...(screened.answeredBy !== undefined ? { answeredBy: screened.answeredBy } : {}) };
+}
+export function outletAsk(standing, toolName, form) {
+    const editRewritten = { acceptableForm: form };
+    const sentence = `${editRewrittenSentence(toolName)}, shown here — approve that form as it stands, or edit again`;
+    if (standing.action === "allow")
+        return { action: "ask", message: sentence, editRewritten };
+    return { ...standing, message: standing.message !== undefined ? `${sentence}\n${standing.message}` : sentence, editRewritten };
+}
+export function editRewrittenSentence(toolName) {
+    return `the edit to "${toolName}" was not run as written: the restriction chain accepts it only in a rewritten form (acceptableForm)`;
+}
+export function rewriteChasedSentence(toolName) {
+    return `the arguments of "${toolName}" were rewritten, and a judge that saw them before the rewrite asks for yet another form — denied fail-closed (a rewrite is judged once, never chased)`;
+}

package/dist/core/roles.d.ts

@@ -1,5 +1,7 @@
 import type { ThinkingLevel } from "../internal/harness-types.js";
 import type { Model } from "../internal/llm.js";
+import type { HostRole } from "../prompt-assembly/catalog/schema.js";
+import { type RoleBaseDeclaration } from "../prompt-assembly/role-base.js";
 import { type ModelRef, type ModelRole, type ModelRoles, type RoleSpec } from "./types.js";
 export type { ModelRole, RoleSpec, ModelRoles } from "./types.js";
 export { MODEL_ROLES } from "./types.js";
@@ -106,6 +108,16 @@ export declare const ROLE_TIER_DEFAULTS: Readonly<Partial<Record<ModelRole, stri
  * preset-only role does not disable the relative pick. One reader, the same parts {@link specParts} reads.
  */
 export declare function roleSpecNamesModel(spec: RoleSpec | undefined): boolean;
+/** Merge two role maps, field-aware per role (task `over` wins). Every key and every value of both maps is judged first: a value that is no binding
+ *  (`null`, a number, a boolean, a word the catalog does not hold) is refused at its own seat before the merge reads it (the merge would otherwise read a
+ *  number as a record, or let a task's bad value vanish into the base); a list or a function written at a role seat still reads as an empty record (#2223 ⑦). */
+/**
+ * One role map's door — every key a role word, every entry a binding whose parts are each in their domain (its role word
+ * included) and whose named model has a binding's shape. `field` names the map (`RunnerDeps.roles` / `TaskSpec.roles`).
+ * Every entry is judged, read or not: a resume's screen calls it before the claim, and the merge below calls it on both
+ * maps, so an entry no task of this leg selects still refuses loudly.
+ */
+export declare function screenRoleMap(roles: ModelRoles | undefined, field: "RunnerDeps.roles" | "TaskSpec.roles"): void;
 export interface ResolvedRole {
     model: Model;
     /**
@@ -123,9 +135,24 @@ export interface ResolvedRole {
     modelRef: ModelRef;
     /** The effective thinking level: explicit `spec.thinking` wins, else the role's default. */
     thinking?: ThinkingLevel;
-    /** The requested role's preset system prompt, if it set one (independent of model fallback). */
+    /** The requested role's role-base statement, if it made one (independent of model fallback): its word (the host role
+     *  and the catalog variant it selects) and its text (which replaces that base) — the second source of the role-base
+     *  decision, after the task's own (`src/prompt-assembly/role-base.ts`). */
+    promptRole?: HostRole;
     systemPrompt?: string;
 }
+/**
+ * The requested role's role-base statement as the task path reads it — the chain-head role over the merged maps, its
+ * word and its text whole (the role-base decision's second source, `src/prompt-assembly/role-base.ts`); `undefined` ⇒
+ * the preset names none. For a station that must write the preset onto a child's own seat before prepare (the
+ * workflow lane's persona frame) — it reads exactly what prepare will, and refuses what prepare would.
+ */
+export declare function presetRoleBaseOf(spec: {
+    modelRole?: ModelRole;
+    roles?: ModelRoles;
+}, deps: {
+    roles?: ModelRoles;
+}): RoleBaseDeclaration | undefined;
 /**
  * Resolve the model (and default thinking) for a task. Explicit `spec.model` wins; otherwise walk the
  * `modelRole`'s fallback chain over the merged roles (task overrides runner) and use the first role

package/dist/core/roles.js

@@ -1,4 +1,7 @@
 import { selectModel } from "./select-model.js";
+import { namesRoleBase } from "../prompt-assembly/role-base.js";
+import { readPromptRole } from "../prompt-assembly/select.js";
+import { readMember } from "./thrown-value.js";
 import { MODEL_ROLES } from "./types.js";
 export { MODEL_ROLES } from "./types.js";
 function catalogModel(ref, models) {
@@ -11,13 +14,36 @@ function modelBindingRefusal(field, reason, message) {
     e.detail = { field, reason };
     return e;
 }
+const ROLE_RECORD_KEYS = new Set(["model", "select", "thinking", "promptRole", "systemPrompt"]);
+function isModelShaped(s) {
+    try {
+        if (typeof s === "function" || isList(s)) {
+            Reflect.ownKeys(s);
+            return false;
+        }
+        if (Reflect.ownKeys(s).some((k) => typeof k !== "string" || !ROLE_RECORD_KEYS.has(k)))
+            return true;
+        return readMember(s, "id") !== undefined || readMember(s, "api") !== undefined;
+    }
+    catch {
+        return true;
+    }
+}
 function isBindingObject(value) {
     return (typeof value === "object" && value !== null) || typeof value === "function";
 }
 function bindingShown(value) {
     if (typeof value === "string")
         return JSON.stringify(value.length > 80 ? `${value.slice(0, 80)}…` : value);
-    return value === null ? "null" : Array.isArray(value) ? "a list" : `a ${typeof value}`;
+    return value === null ? "null" : isList(value) ? "a list" : `a ${typeof value}`;
+}
+function isList(value) {
+    try {
+        return Array.isArray(value);
+    }
+    catch {
+        return false;
+    }
 }
 function unknownModelRefRefusal(ref, seat) {
     return modelBindingRefusal(seat, "unknown_model_ref", `Unknown model ref ${bindingShown(ref)} in ${seat}. Provide it in RunnerDeps.models or pass a Model object.`);
@@ -28,6 +54,7 @@ function modelOfBinding(value, models, seat, binds) {
         const held = catalogModel(value, models);
         if (held === undefined)
             throw unknownModelRefRefusal(value, seat);
+        assertModelObject(held, seat, `${bindingShown(value)} (a catalog entry)`);
         return held;
     }
     return value;
@@ -35,9 +62,19 @@ function modelOfBinding(value, models, seat, binds) {
 function assertModelBindingShape(value, seat, binds) {
     if (typeof value === "string")
         return;
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    if (typeof value !== "object" || value === null || isList(value)) {
         throw modelBindingRefusal(seat, "not_a_model_ref", `${seat} is ${bindingShown(value)}, not a model reference — ${binds}.`);
     }
+    assertModelObject(value, seat, "a Model object", binds === ROLE_BINDS ? " At a role seat an object with a key beyond model / select / thinking / promptRole / systemPrompt is read as a Model, not as a role record." : "");
+}
+function assertModelObject(value, seat, what, note = "") {
+    const id = readMember(value, "id");
+    const api = readMember(value, "api");
+    const [member, got] = typeof id !== "string" || id === "" ? ["id", id] : typeof api !== "string" ? ["api", api] : [undefined, undefined];
+    if (member === undefined)
+        return;
+    const shown = got === undefined ? "absent" : bindingShown(got);
+    throw modelBindingRefusal(seat, "not_a_model_ref", `${seat} is ${what} whose \`${member}\` is ${shown} — a Model carries a non-empty string \`id\` and a string \`api\`.${note}`);
 }
 const ROLE_BINDS = "a role binds a catalog model name or a Model object";
 const roleModelSeat = (named, seat) => (typeof named === "string" ? seat : `${seat}.model`);
@@ -156,7 +193,10 @@ function roleTierModel(role, models) {
     if (!models || !models[TIERS_ACTIVE])
         return undefined;
     const tier = ROLE_TIER_DEFAULTS[role];
-    return tier !== undefined ? models[tier] : undefined;
+    const m = tier !== undefined ? models[tier] : undefined;
+    if (m)
+        assertModelObject(m, `tiers.${String(tier)}`, "the catalog entry the tier word names");
+    return m;
 }
 const FALLBACK = {
     default: [],
@@ -176,11 +216,11 @@ function specParts(s, seat = "a role seat") {
     if (!isBindingObject(s)) {
         throw modelBindingRefusal(seat, "not_a_model_ref", `${seat} is ${bindingShown(s)}, not a model reference — a role binds a catalog model name, a Model object or a { model, select, thinking, systemPrompt } record.`);
     }
-    if ("id" in s && "api" in s) {
+    if (isModelShaped(s)) {
         return { model: s };
     }
     const cfg = s;
-    return { model: cfg.model, select: cfg.select, thinking: cfg.thinking, systemPrompt: cfg.systemPrompt };
+    return { model: cfg.model, select: cfg.select, thinking: cfg.thinking, promptRole: readPromptRole(`${seat}.promptRole`, cfg.promptRole), systemPrompt: cfg.systemPrompt };
 }
 export function roleSpecNamesModel(spec) {
     const parts = specParts(spec);
@@ -190,7 +230,7 @@ function toConfig(s) {
     if (s === undefined) {
         return undefined;
     }
-    if (typeof s === "string" || ("id" in s && "api" in s)) {
+    if (typeof s === "string" || isModelShaped(s)) {
         return { model: s };
     }
     return s;
@@ -203,11 +243,13 @@ function mergeRoleSpec(base, over) {
     if (!b)
         return over;
     const overHasSource = o.model !== undefined || o.select !== undefined;
+    const roleBase = namesRoleBase(o) ? o : b;
     return {
         model: overHasSource ? o.model : b.model,
         select: overHasSource ? o.select : b.select,
         thinking: o.thinking ?? b.thinking,
-        systemPrompt: o.systemPrompt ?? b.systemPrompt,
+        promptRole: roleBase.promptRole,
+        systemPrompt: roleBase.systemPrompt,
     };
 }
 function assertKnownRole(word, field, ofKey = false) {
@@ -216,19 +258,19 @@ function assertKnownRole(word, field, ofKey = false) {
     const shown = typeof word === "string" ? JSON.stringify(word).slice(0, 80) : `<${word === null ? "null" : typeof word}>`;
     throw modelBindingRefusal(field, "unknown_role_word", `${ofKey ? `${field} key` : field} names the model role ${shown}, which is not one of ${MODEL_ROLES.join(" / ")} — a word outside the vocabulary binds nothing and resolves nothing; bind the model on one of these roles, or name it on TaskSpec.model`);
 }
-function mergeRoles(base, over) {
-    for (const key of Object.keys(base ?? {}))
-        assertKnownRole(key, "RunnerDeps.roles", true);
-    for (const key of Object.keys(over ?? {}))
-        assertKnownRole(key, "TaskSpec.roles", true);
-    for (const roles of [base, over]) {
-        for (const [key, value] of Object.entries(roles ?? {})) {
-            const seat = `roles.${key}`;
-            const named = specParts(value, seat).model;
-            if (named !== undefined)
-                assertModelBindingShape(named, roleModelSeat(named, seat), ROLE_BINDS);
-        }
+export function screenRoleMap(roles, field) {
+    for (const key of Object.keys(roles ?? {}))
+        assertKnownRole(key, field, true);
+    for (const [key, value] of Object.entries(roles ?? {})) {
+        const seat = `roles.${key}`;
+        const named = specParts(value, seat).model;
+        if (named !== undefined)
+            assertModelBindingShape(named, roleModelSeat(named, seat), ROLE_BINDS);
     }
+}
+function mergeRoles(base, over) {
+    screenRoleMap(base, "RunnerDeps.roles");
+    screenRoleMap(over, "TaskSpec.roles");
     const out = { ...base };
     for (const role of Object.keys(over ?? {})) {
         out[role] = mergeRoleSpec(base?.[role], over?.[role]);
@@ -244,32 +286,45 @@ function partsModel(parts, models, seat = "a role seat") {
         if (needs != null && !Array.isArray(needs)) {
             throw modelBindingRefusal(`${seat}.select`, "not_a_model_ref", `${seat}.select.needs is ${bindingShown(needs)}, not a list of capabilities (vision / reasoning).`);
         }
-        const held = models != null && typeof models === "object" ? Object.values(models).filter(Boolean) : [];
-        return selectModel(held, parts.select);
+        const held = models != null && typeof models === "object" ? Object.entries(models).filter(([, m]) => Boolean(m)) : [];
+        for (const [key, m] of held)
+            assertModelObject(m, `${seat}.select`, `the catalog entry ${bindingShown(key)} the criteria read`);
+        const picked = selectModel(held.map(([, m]) => m), parts.select);
+        if (picked !== undefined)
+            assertModelObject(picked, `${seat}.select`, "the catalog entry the criteria pick");
+        return picked;
     }
     return undefined;
 }
-export function resolveTaskModel(spec, deps) {
+function chainHead(spec, deps) {
     const start = spec.modelRole === undefined ? "default" : spec.modelRole;
     assertKnownRole(start, "modelRole");
+    const merged = mergeRoles(deps.roles, spec.roles);
+    return { start, merged, startParts: specParts(merged[start], `roles.${start}`) };
+}
+export function presetRoleBaseOf(spec, deps) {
+    const { promptRole, systemPrompt } = chainHead(spec, deps).startParts;
+    return namesRoleBase({ promptRole, systemPrompt }) ? { ...(promptRole !== undefined ? { promptRole } : {}), ...(systemPrompt !== undefined ? { systemPrompt } : {}) } : undefined;
+}
+export function resolveTaskModel(spec, deps) {
+    const { start, merged, startParts } = chainHead(spec, deps);
     if (spec.model !== undefined) {
-        const startParts = specParts(mergeRoles(deps.roles, spec.roles)[start], `roles.${start}`);
         return {
             model: resolveModel(spec.model, deps.models, "TaskSpec.model"),
             modelRef: spec.model,
             thinking: spec.thinking ?? startParts.thinking,
+            promptRole: startParts.promptRole,
             systemPrompt: startParts.systemPrompt,
         };
     }
-    const merged = mergeRoles(deps.roles, spec.roles);
-    const startSystemPrompt = specParts(merged[start], `roles.${start}`).systemPrompt;
+    const { promptRole: startPromptRole, systemPrompt: startSystemPrompt } = startParts;
     for (const role of [start, ...FALLBACK[start]]) {
         const parts = specParts(merged[role], `roles.${role}`);
         const fromParts = partsModel(parts, deps.models, `roles.${role}`);
         const model = fromParts ?? roleTierModel(role, deps.models);
         if (model) {
             const modelRef = fromParts !== undefined ? (parts.model ?? model) : (ROLE_TIER_DEFAULTS[role] ?? model);
-            return { model, modelRef, thinking: spec.thinking ?? parts.thinking, systemPrompt: startSystemPrompt };
+            return { model, modelRef, thinking: spec.thinking ?? parts.thinking, promptRole: startPromptRole, systemPrompt: startSystemPrompt };
         }
     }
     throw new Error(`No model for role "${start}": set TaskSpec.model, or configure RunnerDeps.roles / TaskSpec.roles["${start}"] (or a "default" role). A "select" RoleSpec also fails here if no catalog model matches.`);

package/dist/core/rule-lane-reads.d.ts

@@ -34,16 +34,20 @@ export declare function normalizeOrgGateVerdict(answer: unknown, unreadable: str
 /**
  * Normalize the accepted {@link ToolGateInput.persistedRules} answers into one reading.
  *
- * `{}` = a clean negative (no rule admits this call). `{ unreadable: true }` = the lane could not read
- * its source. `{ hit }` = a match, whose `rules` is the non-empty coverage set (design/375). An answer
- * outside every accepted shape — a number, `null`, an object with neither `rules` nor `unreadable`, an
- * EMPTY `rules` array, the retired pre-375 `{ rule, dots? }` single-rule object — is read as a clean
- * negative rather than a match: this is a LOOSENING seam, so an answer nobody can name degrades toward
- * asking, never toward an allow built on it. All-or-nothing across the set's TEXTS for the same
- * reason: a set with one unreadable member is a different (smaller) claim than the lane made, and a
- * decision must not stand on a claim nobody made — one bad member drops the whole answer to the clean
- * negative. Per-member DOTS stay individually optional (identity lost ⇒ `"not_reported"`, exactly the
- * single-rule contract).
+ * Four readings, and the lane's own words pick them. `{}` = the lane SAID no rule speaks: the `undefined` answer
+ * (the store was read and holds nothing for this call) or a coverage answer (design/375 §5.2②, whose decision
+ * meaning is "no rule"). `{ hit }` = a match: a `behavior` of the closed set and a NON-EMPTY `rules` whose members each
+ * carry a text (design/375). `{ unreadable: true }` = the lane said it could not read its source (the store form).
+ * `{ unreadable: true, reason }` = the lane could not read the call against its rows (its own call form), OR the lane
+ * answered something this seam cannot read — `null`, a string or number, an object that is none of the shapes above, a
+ * `behavior` outside the closed set or absent, `rules` absent / not an array / empty, a member that is not a record or
+ * whose `rule` is not a string, a carrier that is not a plain object. The last arm is the one that matters: an answer the
+ * lane gave and nobody can read may be a DENY or an ASK row that did not survive the seam, and reading it as "no rule"
+ * would let the person's standing "never run this" fail silently — so it is read as the unreadable word (a
+ * real-approval ask no mode releases; headless, a refusal), the same word the org lane's unreadable answer takes.
+ * All-or-nothing across the set for the same reason: a set with one unreadable member is a different (smaller) claim than
+ * the lane made, and a decision must not stand on a claim nobody made. Per-member DOTS stay individually optional
+ * (identity lost ⇒ `"not_reported"`, exactly the single-rule contract).
  *
  * The hit's dots are COPIED, not aliased. The array travels onto an ask that may sit in front of a
  * person for a long time; a lane that retains and mutates its own array would otherwise change what the
@@ -68,11 +72,12 @@ export declare function readOrgRuleLane(org: {
 }, req: ToolCallRequest, signal: AbortSignal | undefined, timeoutMs?: number): Promise<OrgGateVerdict>;
 /**
  * The persisted-rule lane's one read for one call — every consumer's (the live gate, the synthetic-Read
- * judge), normalized once. A lane that throws, hangs past the dependency timeout, or answers something
- * unreadable is a lane that could not answer: a row nobody could read may forbid the call, so for the DECISION it
- * fails closed (`applyPersistedTightening` reads `{ unreadable }` without a reason as the store form: a real-approval
- * ask), and for the RECORD it is `"unavailable"`. A call the lane could not read against the rows (`reason`) fails
- * closed in the arms the same way, as the call form. Absent lane ⇒ the clean negative.
+ * judge), normalized once. A lane that throws or hangs past the dependency timeout is a lane that could not answer: a row
+ * nobody could read may forbid the call, so for the DECISION it fails closed (`applyPersistedTightening` reads `{ unreadable }`
+ * without a reason as the store form: a real-approval ask), and for the RECORD it is `"unavailable"`. A lane that ANSWERS
+ * something this seam cannot read, and a call the lane could not read against the rows, are `unreadable` with a `reason`
+ * (the normalizer's words, naming the field): they fail closed in the arms the same way, as the call form. Absent lane,
+ * or the lane's own `undefined` ⇒ the clean negative.
  */
 export declare function readPersistedRuleLane(lane: {
     adjudicate: (req: ToolCallRequest) => PersistedRuleAnswer | Promise<PersistedRuleAnswer>;

package/dist/core/rule-lane-reads.js

@@ -1,6 +1,6 @@
 import { describeThrown } from "./tool-policy.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "./permission-rule-org.js";
-import { isRuleBehavior } from "./permission-rule-model.js";
+import { isRuleBehavior, RULE_BEHAVIORS } from "./permission-rule-model.js";
 function isPlainOwnRecord(x) {
     try {
         if (x === null || typeof x !== "object" || Array.isArray(x))
@@ -21,6 +21,15 @@ function ownDataValue(obj, key) {
         return undefined;
     }
 }
+function bearsOwn(obj, key) {
+    try {
+        const d = Object.getOwnPropertyDescriptor(obj, key);
+        return d !== undefined && (!("value" in d) || d.value !== undefined);
+    }
+    catch {
+        return true;
+    }
+}
 export function normalizeOrgGateVerdict(answer, unreadable) {
     const clean = (v) => Object.assign(Object.create(null), v);
     const readable = (x) => {
@@ -94,16 +103,24 @@ function copiedUsableDots(dots) {
     const usable = copied?.every((d) => typeof d.actor === "string" && typeof d.counter === "number" && Number.isFinite(d.counter)) === true && copied.length > 0;
     return usable ? { dots: copied } : {};
 }
+function unreadableAnswer(where) {
+    return { unreadable: true, reason: `the host's persisted-rule lane, persistedRules.adjudicate, answered what this gate cannot read: ${where}` };
+}
 export function normalizePersistedRuleHit(hit) {
-    if (!isPlainOwnRecord(hit))
+    if (hit === undefined)
         return {};
+    if (!isPlainOwnRecord(hit))
+        return unreadableAnswer(hit === null ? "the answer is `null` — a lane with no rule for the call answers `undefined`" : "the answer is not a plain object");
     if (ownDataValue(hit, "unreadable") === true) {
         const reason = ownDataValue(hit, "reason");
         return typeof reason === "string" ? { unreadable: true, reason } : { unreadable: true };
     }
     const rulesRaw = ownDataValue(hit, "rules");
-    if (rulesRaw === undefined) {
+    const behavior = ownDataValue(hit, "behavior");
+    if (!bearsOwn(hit, "rules") && !bearsOwn(hit, "behavior") && !bearsOwn(hit, "unreadable")) {
         const coverageRaw = ownDataValue(hit, "segmentCoverage");
+        if (coverageRaw === undefined)
+            return unreadableAnswer("it names no `behavior`, no `rules`, no `unreadable` report and no `segmentCoverage` table");
         let rows;
         try {
             if (Array.isArray(coverageRaw)) {
@@ -120,27 +137,38 @@ export function normalizePersistedRuleHit(hit) {
         }
         return rows !== undefined && rows.length > 0 ? { coverage: rows.map((r) => ({ segment: r.segment, covered: r.covered })) } : {};
     }
-    let members;
+    if (!isRuleBehavior(behavior))
+        return unreadableAnswer(`\`behavior\` is not one of ${RULE_BEHAVIORS.join(" / ")}`);
+    const members = [];
+    let problem;
     try {
-        if (Array.isArray(rulesRaw)) {
-            const walked = [];
-            for (let i = 0; i < rulesRaw.length; i++) {
+        const count = Array.isArray(rulesRaw) ? rulesRaw.length : undefined;
+        if (!Array.isArray(rulesRaw))
+            problem = rulesRaw === undefined ? "`rules` is absent or not an own data property" : "`rules` is not an array";
+        else if (count === 0)
+            problem = "`rules` is empty — a hit names at least one rule";
+        else if (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0)
+            problem = "`rules` has no readable length";
+        else {
+            for (let i = 0; i < count && problem === undefined; i++) {
                 const m = rulesRaw[i];
-                walked.push(isPlainOwnRecord(m) ? { rule: ownDataValue(m, "rule"), dots: ownDataValue(m, "dots") } : { rule: undefined, dots: undefined });
+                if (!isPlainOwnRecord(m))
+                    problem = `\`rules[${i}]\` is not a plain object`;
+                else {
+                    const rule = ownDataValue(m, "rule");
+                    if (typeof rule !== "string")
+                        problem = `\`rules[${i}].rule\` is not a string`;
+                    else
+                        members.push({ rule, dots: ownDataValue(m, "dots") });
+                }
             }
-            members = walked;
         }
     }
     catch {
-        members = undefined;
+        problem = "`rules` could not be read (a throwing element or a revoked proxy)";
     }
-    if (members === undefined || members.length === 0)
-        return {};
-    if (!members.every((m) => typeof m.rule === "string"))
-        return {};
-    const behavior = ownDataValue(hit, "behavior");
-    if (!isRuleBehavior(behavior))
-        return {};
+    if (problem !== undefined)
+        return unreadableAnswer(problem);
     const denial = behavior === "deny" ? copiedDenial(ownDataValue(hit, "denial"), members.map((m) => m.rule)) : undefined;
     return { hit: { behavior, rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })), ...(denial !== undefined ? { denial } : {}) } };
 }

package/dist/core/rule-owner.d.ts

@@ -5,8 +5,8 @@
  * The faces that read an owner out of data — the two adoption markers read back from disk, the two adoption entries'
  * source, a stored approval record's identity and the consent entries' `owner` option — read it through
  * {@link readRuleOwner}, so the source an adoption entry writes into its marker is one that marker's reader reads back.
- * Its one run-time import is the import-free record judge — the root adoption marker reader, which every file store
- * loads, depends on this module and is kept free of the rule store's own imports.
+ * Its run-time imports are the two import-free judges — the record judge and the principal-name judge — because the root
+ * adoption marker reader, which every file store loads, depends on this module and is kept free of the rule store's own imports.
  */
 import type { AssertAllKeysHandled } from "./ask-origin.js";
 /**
@@ -36,7 +36,7 @@ export declare function sameRuleOwner(a: RuleOwner, b: RuleOwner): boolean;
 /**
  * Read an owner from a value the engine did not just build, or `undefined` when it is not one: not a plain record (an
  * object whose prototype is `Object.prototype` or none, so no member comes from a prototype it was given), a `kind`
- * outside {@link RULE_OWNER_KINDS}, or a `principal` arm whose name is not a string with a non-whitespace character (an
+ * outside {@link RULE_OWNER_KINDS}, or a `principal` arm whose name is not a principal name ({@link principalNameOf}: an
  * identity-less bucket is the `local-owner` kind, never a blank name). Fail-closed: a caller treats `undefined` as
  * "owns nothing" or refuses — never as either arm. The answer is a fresh object holding only the members the type
  * declares; `kind` and `principal` are each read once.

package/dist/core/rule-owner.js

@@ -1,4 +1,5 @@
 import { isPlainRecord } from "./mods/kernel/receive.js";
+import { principalNameOf } from "./principal-name.js";
 export const RULE_OWNER_KINDS = Object.freeze(["principal", "local-owner"]);
 export function sameRuleOwner(a, b) {
     return a.kind === "principal" ? b.kind === "principal" && a.principal === b.principal : b.kind === "local-owner";
@@ -14,8 +15,8 @@ export function readRuleOwner(raw) {
         case "local-owner":
             return { kind: "local-owner" };
         case "principal": {
-            const principal = raw.principal;
-            return typeof principal === "string" && principal.trim() !== "" ? { kind: "principal", principal } : undefined;
+            const principal = principalNameOf(raw.principal);
+            return principal === undefined ? undefined : { kind: "principal", principal };
         }
         default: {
             const unhandled = word;

package/dist/core/runner/announce-once-ledger.d.ts

@@ -68,6 +68,20 @@ export declare function flushOwedAnnouncedSnapshot(prepared: {
     announcedListingsRef: AnnouncedListingSnapshotInput;
     session: Pick<AnnounceOnceSession, "appendAnnouncedListing">;
 }): Promise<void>;
+/**
+ * The one commit of a delivered `mcp_unavailable` frame — the receipt of the message that carried it (a leg's first request), run
+ * inside the `message_end` walk: the delivered pairs leave the pending list and join the session's told-failure record, whose
+ * snapshot write is parked for the next serialization point. The next prepare on the session announces only what the record lacks.
+ */
+export declare function settleMcpUnavailable(prepared: {
+    readonly mcpUnavailable?: {
+        pending: AnnouncedMcpFailure[];
+    };
+    readonly announcedListingsRef: AnnouncedListingSnapshotInput;
+    readonly frameReceipts: {
+        listingSnapshotOwed: boolean;
+    };
+}, delivered: ReadonlyArray<AnnouncedMcpFailure>): void;
 /** The run-local ledger — see the module header for the two commit disciplines it serves. */
 export interface AnnounceOnceLedger {
     /** The nearest announced snapshot on the branch as read at prepare (undefined = pre-entry

package/dist/core/runner/announce-once-ledger.js

@@ -47,6 +47,11 @@ export async function flushOwedAnnouncedSnapshot(prepared) {
         return;
     await prepared.session.appendAnnouncedListing(prepared.announcedListingsRef).catch(() => undefined);
 }
+export function settleMcpUnavailable(prepared, delivered) {
+    prepared.mcpUnavailable?.pending.splice(0, delivered.length);
+    prepared.announcedListingsRef.mcpFailed = [...(prepared.announcedListingsRef.mcpFailed ?? []), ...delivered];
+    prepared.frameReceipts.listingSnapshotOwed = true;
+}
 export async function loadAnnounceOnceLedger(session, checkpointMirror, onError) {
     let recovered = true;
     const entry = await session.getAnnouncedListing().catch(() => {

package/dist/core/runner/assemble-result.d.ts

@@ -148,6 +148,7 @@ export interface ResultFlags {
      *  ended for its own reason first) leaves this empty: the original terminal stands and the seat is
      *  NOT signed (the settle lane mints `task.halt_unconsumed` for it). */
     haltConsumption?: HaltConsumption;
+    answerEntryIds?: readonly string[];
     /** Call ids of answered-but-never-collected questions, echoed on
      *  `TaskResult.strandedHumanAnswers`. Pure pass-through; empty/absent ⇒ the field is omitted. The
      *  optional `onError` alert is NOT the disclosure — this mandatory result face is. */

package/dist/core/runner/assemble-result.js

@@ -178,5 +178,5 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
     const stampHaltedByUser = haltConsumed(flags.haltConsumption);
-    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, terminal, ...(flags.model !== undefined ? { model: flags.model } : {}), ...(responseModel !== undefined ? { responseModel } : {}), result: result.trim(), salvagedOutput, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.editedFiles !== undefined && flags.editedFiles.length > 0 ? { editedFiles: flags.editedFiles } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(stampHaltedByUser ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: [...flags.remoteEnvFailures] } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveWriteFace !== undefined ? { effectiveWriteFace: flags.effectiveWriteFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), ...(flags.compaction !== undefined ? { compaction: flags.compaction } : {}), stats: publicStats };
+    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, terminal, ...(flags.model !== undefined ? { model: flags.model } : {}), ...(responseModel !== undefined ? { responseModel } : {}), result: result.trim(), ...(flags.answerEntryIds !== undefined ? { resultEntryIds: [...flags.answerEntryIds] } : {}), salvagedOutput, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.editedFiles !== undefined && flags.editedFiles.length > 0 ? { editedFiles: flags.editedFiles } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(stampHaltedByUser ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: [...flags.remoteEnvFailures] } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveWriteFace !== undefined ? { effectiveWriteFace: flags.effectiveWriteFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), ...(flags.compaction !== undefined ? { compaction: flags.compaction } : {}), stats: publicStats };
 }

package/dist/core/runner/call-hook-stations.d.ts

@@ -89,8 +89,9 @@ export interface ApprovedCallScreenInput {
  * the call (the decide is the upper bound; the screen can only narrow): a deny, a failed or cancelled screening, or a
  * refused answer refuses the call in the live gate's own sentences; an ask is the question the decide already answered —
  * unless it demands a person and the decide was the deployment's policy (the one predicate every resume station holds a
- * decide against); a rewrite is what executes when the decide carried none of its own (the person's bytes are the upper
- * bound); context rides the result. Undefined when no handler hangs on `classic.PreToolUse`.
+ * decide against); a rewrite comes back as the args — what executes when the decide carried no edit, a refusal of the edit
+ * when it did (a person's bytes are the ceiling, rewrite-rejudge.ts); context rides the result. Undefined when no handler hangs
+ * on `classic.PreToolUse`.
  */
 export declare function createApprovedCallScreen(input: ApprovedCallScreenInput): ApprovedCallScreen | undefined;
 /**