@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/runner/prepare-file-history.d.ts

@@ -14,15 +14,18 @@
  *
  * The request door (the bad-value doors and every refusal the request decides alone) lives in
  * `./file-history-request.ts` and runs BEFORE the session is acquired; this phase receives its resolution.
- * The module-level helpers below the phase (`restoredAbsPathsOf`,
- * the refusal's epoch-tail wording helper, `adoptForkedFileHistory` with its per-store carry memo,
+ * The module-level helpers below the phase (`adoptForkedFileHistory` with its per-store carry memo,
  * `createFileHistoryBoundarySeat`, `resolveFileHistoryCoordinates` / `resolveFileHistoryScope` /
  * `fileHistoryFilesystemIdentity`, `childScopeRewindRefusal`) moved with it unchanged; the two the test
- * suite reaches through the driver are re-exported from there.
+ * suite reaches through the driver are re-exported from there. The restore itself and the reading of its
+ * answer live in `./file-history-restore.ts`, shared with the out-of-run rewind (`./rewind-files.ts`), which
+ * also reaches down here for the coordinates and the fork carry — a rewind outside a run is the same history
+ * operation as the one this phase runs.
  */
 import type { ExecutionEnv } from "../../internal/harness.js";
 import type { StoredSession } from "../../engine/session/session.js";
 import type { RunnerDeps, TaskResult, TaskSpec, TrackFileEditHook } from "../types.js";
+import type { FileHistoryStore } from "../file-history-store.js";
 import type { FileHistoryBoundarySeat, RunInternals } from "./contracts.js";
 import type { FileHistoryRequest } from "./file-history-request.js";
 export interface PrepareFileHistoryInput {
@@ -36,8 +39,9 @@ export interface PrepareFileHistoryInput {
      *  acquired: every refusal the request and the deployment's seats decide on their own has already thrown. */
     request: FileHistoryRequest;
     /** borrowed-readonly — the trusted lineage a delegating parent handed this run (absent for a root run
-     *  and for a host's own fork), read for the recording-scope decision only. */
-    internals: Pick<RunInternals, "fileHistoryLineage"> | undefined;
+     *  and for a host's own fork), read for the recording-scope decision only; and the Runner's session
+     *  read-state seats, whose restore channel the restore writes the paths it moved into. */
+    internals: Pick<RunInternals, "fileHistoryLineage" | "sessionReadStates"> | undefined;
     /** borrowed-readonly — the run's resolved env (owned or static or the stub); every history verb runs
      *  against ITS filesystem ops. Never rebound or destroyed here. */
     executionEnv: ExecutionEnv;
@@ -60,9 +64,6 @@ export interface PrepareFileHistoryResult {
     /** borrowed-readonly — the turn-start boundary seat runtask drives; `undefined` when not live or when
      *  this run records into its ROOT session's scope (a child mints no boundaries). */
     fileHistoryBoundary: FileHistoryBoundarySeat | undefined;
-    /** borrowed-readonly — the absolute paths the restore MUTATED (empty when no restore ran), for the
-     *  read-face phase's read-state invalidation. */
-    restoredFilePaths: string[];
     /** borrowed-mutable — the non-fatal rewind disclosures (`TaskResult.rewindNotes`). Mutation owners after
      *  this call: none — every push happens inside this phase; the driver only reads it into `Prepared`. */
     rewindNotes: NonNullable<TaskResult["rewindNotes"]>;
@@ -79,6 +80,45 @@ export interface PrepareFileHistoryResult {
     historyFs: string;
 }
 export declare function prepareFileHistory(input: PrepareFileHistoryInput): Promise<PrepareFileHistoryResult>;
+/**
+ * Carry a forked session's file history from its parent scope (the seat §5 names).
+ * Never throws and never fails the turn: a store that cannot carry leaves the fork with an empty
+ * history, which is DEGRADED (a pre-fork boundary is not restorable from the new session) and not
+ * wrong (nothing is silently mis-restored — the restore seat answers "no boundary" honestly).
+ */
+export declare function adoptForkedFileHistory(store: FileHistoryStore, session: {
+    getMetadata(): Promise<{
+        forkedFrom?: string;
+    }>;
+}, sessionId: string, onError: RunnerDeps["onError"]): Promise<void>;
+/**
+ * The run's two file-history COORDINATES, resolved once where store/env/root meet (module-level per
+ * the body ratchet):
+ *  - `historyRoot` — ONE canonical root coordinate for every history verb: capture keys (rel-under-root
+ *    vs absolute, DV-6) must agree with the canonical containment keys the hands band mints — a
+ *    symlinked root spelling (macOS /var → /private/var) would otherwise record in-root files as
+ *    absolute and un-tether them from the root they live in.
+ *  - `historyScope` — WHICH scope this run's first-touch records land in. A top-level run owns its own
+ *    (its sessionId). A delegated child that was handed a {@link RunInternals.fileHistoryLineage} and
+ *    runs on the SAME canonical root records into the lineage's scope — the root session's — so the
+ *    edits a child makes on the user's behalf are part of the ONE history the user rewinds from
+ *    (before this, a child's first touch minted its baseline in a scope no rewind ever read, and the
+ *    parent's own later first touch of that file recorded the child-modified bytes as pristine). A
+ *    child on a DIFFERENT root keeps its own scope: keys are root-relative and carry no root, so a
+ *    record minted under a worktree re-joined against the root session's tree would converge a file
+ *    that run never edited — the structural out-of-scope guarantee the store contract opens with.
+ *    Same-tree equality is judged on TWO coordinates, both minted here: the CANONICAL root spelling
+ *    both sides minted their keys against, and the FILESYSTEM the env is a view of
+ *    ({@link fileHistoryFilesystemIdentity}) — a path string alone is not a tree (two per-task
+ *    sandboxes can both spell `/workspace` and hold unrelated files).
+ * With no live history store there is nothing to coordinate: own scope, uncanonicalized root, no
+ * filesystem identity (nothing reads any of them).
+ */
+export declare function resolveFileHistoryCoordinates(enabled: boolean, env: ExecutionEnv, taskRoot: string, lineage: RunInternals["fileHistoryLineage"], sessionId: string): Promise<{
+    historyRoot: string;
+    historyScope: string;
+    historyFs: string;
+}>;
 /** The ONE reading of {@link RunInternals.fileHistoryLineage} (see {@link resolveFileHistoryCoordinates}):
  *  the lineage's scope iff BOTH tree coordinates match; otherwise the run's own session. */
 export declare function resolveFileHistoryScope(lineage: RunInternals["fileHistoryLineage"], historyRoot: string, historyFs: string, sessionId: string): string;

package/dist/core/runner/prepare-file-history.js

@@ -1,8 +1,9 @@
 import { NodeExecutionEnv } from "../../engine/execution-env/node-execution-env.js";
 import { isRemoteExecutionEnv } from "../remote-env.js";
-import { FILE_HISTORY_ERROR_CODES, FileHistoryStoreError, resolveTrackKey } from "../file-history-store.js";
+import { FILE_HISTORY_ERROR_CODES, FileHistoryStoreError } from "../file-history-store.js";
 import { readMember, thrownText } from "../thrown-value.js";
 import { isGovernanceRetryClass } from "../governance-codes.js";
+import { fileHistoryRestoreLedgerLine, settleFileHistoryRestore } from "./file-history-restore.js";
 export async function prepareFileHistory(input) {
     const { deps, spec, request, internals, executionEnv, taskRootFinal, handsEnabled, sessionId, session, abortController } = input;
     const rewindNotes = [];
@@ -45,25 +46,10 @@ export async function prepareFileHistory(input) {
             });
         }
     }
-    let restoredFilePaths = [];
     if (rewindTarget !== undefined && fileHistoryStore !== undefined && handsEnabled) {
         const restoreSignal = spec.signal ? AbortSignal.any([abortController.signal, spec.signal]) : abortController.signal;
-        const restored = await fileHistoryStore.restore(sessionId, rewindTarget, executionEnv, historyRoot, restoreSignal);
-        const ledgerLine = (r) => `applied ${r.filesChanged.length}, identical ${r.identicalSkipped.length}, refused ${r.refused.length}${r.refused.length > 0 ? ` (${r.refused.map((f) => `${f.path}: ${f.reason}`).join("; ")})` : ""}, failed ${r.failed.length}${r.failed.length > 0 ? ` (${r.failed.map((f) => `${f.path}: ${f.reason}`).join("; ")})` : ""}`;
-        if (restored.outcome === "failed") {
-            if (restored.error?.code === "not_found") {
-                if (rewindBefore)
-                    throw beforeWithoutBoundaryRefusal(rewindTarget, sessionId);
-                const e = new Error(`rewind-files: no file-history boundary exists for entry "${rewindTarget}" on session "${sessionId}" — the working tree was NOT rewound. ${rewindRefusalTail()}`);
-                e.code = "rewind_snapshot.unresolvable";
-                throw e;
-            }
-            const e = new Error(`rewind-files restore failed (${restored.error?.code ?? "restore_failed"}): ${restored.error?.message ?? "unknown"} — ledger: ${ledgerLine(restored)}`);
-            e.code = "rewind.restore_failed";
-            if (restored.error !== undefined)
-                e.detail = { code: restored.error.code, ...(isGovernanceRetryClass(restored.error.permanence) ? { permanence: restored.error.permanence } : {}) };
-            throw e;
-        }
+        const restored = await settleFileHistoryRestore({ store: fileHistoryStore, sessionId, target: rewindTarget, before: rewindBefore, env: executionEnv, root: historyRoot, signal: restoreSignal, readStates: internals?.sessionReadStates });
+        const ledgerLine = fileHistoryRestoreLedgerLine;
         if (restored.outcome === "partial") {
             if (spec.acceptPartialRestore === true) {
                 rewindNotes.push({
@@ -77,7 +63,6 @@ export async function prepareFileHistory(input) {
                 throw e;
             }
         }
-        restoredFilePaths = restoredAbsPathsOf(restored, historyRoot);
     }
     const trackFileEdit = fileHistoryEnabled
         ? async (req) => {
@@ -115,24 +100,7 @@ export async function prepareFileHistory(input) {
         ? createFileHistoryBoundarySeat({ store: fileHistoryStore, sessionId, env: executionEnv, root: historyRoot, onError: deps.onError })
         : undefined;
     const fileHistoryFact = fileHistoryEnabled ? "on" : "disabled";
-    return { trackFileEdit, fileHistoryBoundary, restoredFilePaths, rewindNotes, fileHistoryEnabled, fileHistoryFact, historyScope, historyRoot, historyFs };
-}
-function restoredAbsPathsOf(restored, root) {
-    const out = [];
-    for (const key of [...restored.filesChanged, ...restored.failed.map((f) => f.path)]) {
-        const abs = resolveTrackKey(root, key);
-        if (abs.ok)
-            out.push(abs.abs);
-    }
-    return out;
-}
-function rewindRefusalTail() {
-    return `Boundaries are keyed by a turn's INITIAL entry and exist only for turns that recorded history (a RunnerDeps.fileHistoryStore wired, capture on, and the run's file history not disabled); a boundary from the retired whole-tree snapshot era is not restorable by this seat, and reaped boundaries have none.`;
-}
-function beforeWithoutBoundaryRefusal(target, sessionId) {
-    const e = new Error(`rewind-files: entry "${target}" has no file-history boundary on session "${sessionId}" — a before-restore needs the target's own boundary and never crosses into an earlier turn, so the working tree was NOT rewound. ${rewindRefusalTail()}`);
-    e.code = "rewind_snapshot.unresolvable";
-    return e;
+    return { trackFileEdit, fileHistoryBoundary, rewindNotes, fileHistoryEnabled, fileHistoryFact, historyScope, historyRoot, historyFs };
 }
 const FILE_HISTORY_BOUNDARY_TIMEOUT_MS = 30_000;
 const FILE_HISTORY_LIVENESS_MEMO = new WeakMap();
@@ -160,7 +128,7 @@ function answerOf(call, code) {
         return { ok: false, error: { code: known, message: text, ...(isGovernanceRetryClass(permanence) ? { permanence } : {}) } };
     }, (value) => unanswered(`the history store threw: ${thrownText(value)}`, { value }));
 }
-async function adoptForkedFileHistory(store, session, sessionId, onError) {
+export async function adoptForkedFileHistory(store, session, sessionId, onError) {
     const memo = FILE_HISTORY_CARRY_MEMO.get(store) ?? { settled: new Set(), disclosed: new Set(), inFlight: new Map() };
     FILE_HISTORY_CARRY_MEMO.set(store, memo);
     const discloseOnce = (err) => {
@@ -242,7 +210,7 @@ function createFileHistoryBoundarySeat(opts) {
         },
     };
 }
-async function resolveFileHistoryCoordinates(enabled, env, taskRoot, lineage, sessionId) {
+export async function resolveFileHistoryCoordinates(enabled, env, taskRoot, lineage, sessionId) {
     if (!enabled)
         return { historyRoot: taskRoot, historyScope: sessionId, historyFs: "" };
     const canonRoot = await env.canonicalPath(taskRoot);

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -108,7 +108,7 @@ export interface PrepareGateStationsInput {
     complianceDenies: ReadonlySet<ComplianceCapability>;
     /** borrowed-mutable — the built harness. Writer here: `on("tool_call")` / `on("tool_result")` — the registrations this
      *  phase exists for, in this order, after the driver's boundary-lease handler. */
-    harness: Pick<AgentHarness, "on">;
+    harness: Pick<AgentHarness, "on" | "isBatchSafe">;
     /** borrowed-mutable — the blocked/suspended call ids (`Prepared.blockedToolCalls`). Writers here: the head-of-evaluation
      *  hygiene `delete`, the two short-circuits' and the gate outcome's `add`, the `tool_result` station's one-shot `delete`. */
     blockedToolCalls: Set<string>;

package/dist/core/runner/prepare-gate-stations.js

@@ -13,6 +13,8 @@ import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
 import { callFaceSeat, rosterToolName, toolCallFaceOf } from "../tool-roster.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 import { createApprovedCallScreen, createToolResultStation } from "./call-hook-stations.js";
+import { extensionCallOf } from "../mods/extension-call.js";
+import { extensionCallOverlap } from "../mods/tool-call.js";
 const PEER_MESSAGE_NAMES = new Set([SEND_MESSAGE_TOOL_NAME]);
 function screenGateResult(result) {
     if (result.suspend !== undefined)
@@ -123,7 +125,7 @@ export function prepareGateStations(input) {
                         toolFaceOf: (name) => toolCallFaceOf(toolRosterDeltas.current, name === e.toolName ? called.toolName : name),
                         adjudicate,
                         resolveAsk: (...args) => toolOccurrences.whileAwaitingUser(args[1].toolCallId, () => resolveAskBound(...args)),
-                        suspendAsk,
+                        ...(extensionCallOf(modBus, e.toolCallId) === undefined ? { suspendAsk } : {}),
                         resolveContentAsk: (...args) => toolOccurrences.whileAwaitingUser(args[0].toolCallId, () => resolveContentAsk(...args)),
                         egress: heldBy("gate.egress", egressTools, call),
                         peerMessage: heldBy("gate.peerMessage", PEER_MESSAGE_NAMES, call),
@@ -236,6 +238,13 @@ export function prepareGateStations(input) {
                     }
                     return { block: true, reason: result.reason, ...details };
                 }
+                const overlap = result.suspend === undefined && extensionCallOf(modBus, e.toolCallId) !== undefined ? extensionCallOverlap({ occurrences: toolOccurrences, toolCallId: e.toolCallId, toolName: e.toolName, args: result.finalInput ?? e.input, batchSafe: (n, a) => harness.isBatchSafe(n, a) }) : undefined;
+                if (overlap !== undefined) {
+                    toolOccurrences.refuse(e.toolCallId, "hook");
+                    if (blockedTracked)
+                        blockedToolCalls.add(e.toolCallId);
+                    return { block: true, reason: formatHookFeedback(overlap, reminderMark) };
+                }
                 if (result.suspend === undefined)
                     toolOccurrences.release(e.toolCallId);
                 return result.updatedInput !== undefined ? { updatedInput: result.updatedInput } : undefined;

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -2,7 +2,7 @@ import { type BeforeWriteHook, type CwdRef, type PathRuleDenyRow, type Containme
 import { type ReadFileState } from "../../tools/fs/safety.js";
 import { type PathTablesFacade, type PersonPathRows, type ReadRootsSeat } from "./person-path-rows.js";
 import type { HeadLeads } from "../path-rule-binding.js";
-import { type ShellReadAdmission, type ShellReadCheck } from "../../tools/fs/shell-read-check.js";
+import { type ShellReadAdmission, type ShellReadCheck, type ShellReadLandings } from "../../tools/fs/shell-read-check.js";
 import type { ShellReadBoundary } from "../../tools/fs/shell-read-judge.js";
 import type { RunnerDeps, ShellGateDoctrine, TaskSpec } from "../types.js";
 import type { Model } from "../../internal/llm.js";
@@ -96,7 +96,8 @@ export interface PrepareHandsReadFaceInput {
     deps: Pick<RunnerDeps, "onError" | "onNotice" | "tracer" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "agentConfigDir" | "readFace" | "writeFace" | "permissionRuleStore" | "hands">;
     /** borrowed-readonly — the trusted spawn-side seats the band forwards: the finished-command
      *  notification lane, the mid-flight detach hub, and the Runner's per-session
-     *  read-state seats (absent on a standalone prepare ⇒ the transcript-replay rung covers alone). */
+     *  read-state seats and their restore channel (absent on a standalone prepare ⇒ the transcript-replay rung
+     *  covers alone, and no restore is owed a check — the channel is the Runner's). */
     internals: Pick<RunInternals, "onTaskNotification" | "detachHub" | "sessionReadStates"> | undefined;
     /** borrowed-mutable — the harness seat, read LIVE by the band's queued-human-input predicate (the shell's
      *  auto-backgrounding leg asks it mid-command). Late-bound: the band is built here, the harness later. */
@@ -110,13 +111,6 @@ export interface PrepareHandsReadFaceInput {
     };
     /** borrowed-mutable — the leg's occurrence table; writer here: the shell read station's refused-admission callback. */
     toolOccurrences: ToolOccurrenceTable;
-    /** borrowed-readonly — ABSOLUTE paths this prepare's restore wrote, deleted,
-     *  or failed to write. Every read-state seed above describes the PRE-restore tree, so these keys are
-     *  dropped from the map: the engine replaced those bytes itself, and a surviving entry makes the
-     *  next refusal blame "the user or a linter" for the engine's own write. Absent (the common case)
-     *  when no file restore ran. Fail-closed by construction — dropping a read record only ever
-     *  produces refusals. */
-    restoredFilePaths?: readonly string[];
     /** borrowed-readonly — the memory write gate the memory phase minted (it runs BEFORE this phase: the memory root
      *  must be known before the toolkit compiles), composed into the band's beforeWrite below; undefined for a
      *  memory-less run (every write passes the engine half). */
@@ -221,6 +215,8 @@ export interface PrepareHandsReadFaceResult {
     /** owned — the same station's pre-spawn ADMISSION, published for the P11 face that spawns a shell command
      *  and mounts LATER than the band (`Monitor`): the SAME function the band's shell faces got. ⇔ a real shell. */
     shellReadAdmission: ShellReadAdmission | undefined;
+    /** owned — the same station's landings of a judged call (`ShellReadStation.landings`): the park binds them, the resumed leg's execution station compares. ⇔ a real shell. */
+    shellReadLandings: ShellReadLandings | undefined;
     /** owned — the file read station's admission (`FileReadStation.admitted`) the band's read tools got, for the read tools mounted later (LSP). */
     readAdmission: ((toolCallId: string | undefined, canonicalKey: string) => boolean) | undefined;
     /** write-back (D-3 hold) — the run's RESOLVED read face where hands mount; undefined ⇔ no hands

package/dist/core/runner/prepare-hands-readface.js

@@ -86,6 +86,7 @@ export function resolveHandsLessReadFace(input) {
         shellReadCheck: undefined,
         shellReadStationArmed: false,
         shellReadAdmission: undefined,
+        shellReadLandings: undefined,
         readAdmission: undefined,
         resolvedReadFace: undefined,
         resolvedWriteFace: undefined,
@@ -260,22 +261,23 @@ export async function prepareHandsMount(input) {
                 }
             }
         }
-        if (input.restoredFilePaths !== undefined) {
-            for (const abs of input.restoredFilePaths) {
-                const k = await judgeKey(abs);
-                if (k === undefined)
-                    continue;
-                const entry = readFileState.get(k);
-                if (entry === undefined || entry.seededFromContext === true)
-                    continue;
-                const cur = await executionEnv.readTextFile(abs);
-                if (cur.ok && entry.hash === sha256(normalizeFileText(cur.value)))
-                    continue;
-                readFileState.delete(k);
-            }
+        const restoredOwed = sessionSeats?.pendingRestored(sessionId) ?? [];
+        for (const abs of restoredOwed) {
+            const k = await judgeKey(abs);
+            if (k === undefined)
+                continue;
+            const entry = readFileState.get(k);
+            if (entry === undefined || entry.seededFromContext === true)
+                continue;
+            const cur = await executionEnv.readTextFile(abs);
+            if (cur.ok && entry.hash === sha256(normalizeFileText(cur.value)))
+                continue;
+            readFileState.delete(k);
         }
-        if (seatLeafId !== undefined)
+        if (seatLeafId !== undefined) {
             sessionSeats?.adopt(sessionId, readFileState, seatLeafId);
+            sessionSeats?.settleRestored(sessionId, restoredOwed);
+        }
         sealReadStateSeat =
             sessionSeats !== undefined && seatLeafId !== undefined
                 ? (ownCommittedTailEntryId) => {
@@ -410,6 +412,7 @@ export async function prepareHandsMount(input) {
         shellReadCheck: onPinnedRead(input.personRows, [...(shellReadStation !== undefined ? [{ check: shellReadStation.check, tools: shellReadTools }] : []), ...(fileReadStation !== undefined ? [fileReadStation] : [])]),
         shellReadStationArmed: shellReadStation !== undefined,
         shellReadAdmission: shellReadStation?.admit,
+        shellReadLandings: shellReadStation?.landings,
         readAdmission: fileReadStation?.admitted,
         resolvedReadFace,
         resolvedWriteFace,

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -62,6 +62,8 @@ export interface PrepareInheritedGateInput {
     checkpointSeat: import("../checkpoint-seat.js").CheckpointSeat | undefined;
     /** borrowed-readonly — this leg's checkpoint scope (the driver's one `checkpointScopeOf` derivation): the ctx's `checkpointScopeForChildren`, which every delegation lane copies into its children's internals. */
     checkpointScope: string;
+    /** borrowed-readonly — the deployment's host floor as the config doors compiled it (`RunnerDeps.hostFloor`): the ctx's `hostFloor`, absent when none is declared. */
+    hostFloor: import("../host-floor.js").HostFloor | undefined;
     /** borrowed-readonly — the deployment seats: `autoMode.denialLimit` (the rebuilt trackers' bounds), `memoryScopeAdmission` /
      *  `deploymentMemoryScopes` / `compliancePostureResolver` (the governed-provenance bit), `onError` (the screening-face crash
      *  lane), `onNotice` (the stop seat's notice), `executionEnv` (the hook-env identity predicate), `delegationEntryCaps` (resolved
@@ -109,8 +111,8 @@ export interface PrepareInheritedGateInput {
     mountsCallerTool: (tool: ToolSpec) => boolean;
     /** borrowed-readonly — the ctx's `mountedMcp` seat: the MCP surface the run mounts right now (call-time; the roster is minted after this phase). Present iff the run declared a server. */
     mountedMcp?: () => import("../mounted-mcp.js").MountedMcp;
-    /** borrowed-readonly — the resolved prompt profile (ctx seat). */
-    promptProfile: ToolExecuteContext["promptProfile"];
+    /** borrowed-readonly — the task-level lean switch (ctx seat; absent ⇒ no key). */
+    promptLean: ToolExecuteContext["promptLean"];
     /** borrowed-readonly — the resolved interaction posture (ctx seat; absent ⇒ no key). */
     resolvedInteractionPosture: ToolExecuteContext["interactionPosture"];
     /** borrowed-readonly — the task's own permission-mode key, screened and snapshotted before the first await (undefined =
@@ -160,7 +162,8 @@ export interface PrepareInheritedGateInput {
     /** borrowed-readonly — LATE-BOUND: the per-principal entitlements the caps phase resolves after this one; read only inside
      *  `inheritedGateForChildren` (the two mandate tests), at spawn time. */
     runtimeCaps: () => RuntimeCaps | undefined;
-    /** borrowed-readonly — the leg's mods bus: the chain assembly mints this leg's screening entry over its `classic.PreToolUse` chain. */
+    /** borrowed-readonly — what the leg hands its descendants of its mods bus (`LegMods.handedDown`: without the skills' own
+     *  registrations): the chain assembly mints this leg's screening entry over its `classic.PreToolUse` chain. */
     modBus: LegModBus;
     /** borrowed-readonly — this leg's chain identity as its admission recorded it (`chainOfBus`) — the installation identity's chain term. */
     ownModChain: readonly ModChainLink[];

package/dist/core/runner/prepare-inherited-gate.js

@@ -1,3 +1,4 @@
+import { principalNameOf } from "../principal-name.js";
 import { forkGovernanceDenial, resolveDelegationEntryCaps } from "../../agents/subagent.js";
 import { isLiveQuestionFace } from "../ask-question.js";
 import { parentSpecSeatOf } from "../parent-spec-seat.js";
@@ -16,7 +17,7 @@ import { frozenSkillGrants } from "../skill-grant.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 import { valveLeaves } from "../../agents/tool-filter.js";
 export function prepareInheritedGate(input) {
-    const { spec, deps, askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, pathRuleAnchors, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
+    const { spec, deps, askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, pathRuleAnchors, toolFaceSnapshot, mountsCallerTool, promptLean, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
     const liveInheritedGate = internals?.inheritedGate;
     const seedInheritedGate = resume?.seed.inheritedGate;
     const inheritedAncestorRules = (() => {
@@ -221,7 +222,7 @@ export function prepareInheritedGate(input) {
             deferTools: toolFaceSnapshot.defer,
             alwaysLoadTools: toolFaceSnapshot.alwaysLoad,
             ...(toolFaceSnapshot.restoreGated !== undefined ? { restoreGatedTools: toolFaceSnapshot.restoreGated } : {}),
-            promptProfile,
+            ...(promptLean !== undefined ? { promptLean } : {}),
             ...(spec.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: spec.memoryPersistenceCapable } : {}),
             get memoryCaptureOptedOut() {
                 return input.memoryEngineSession()?.captureOptOut?.optedOut() ?? false;
@@ -238,6 +239,7 @@ export function prepareInheritedGate(input) {
             },
             getApiKeyAndHeaders: spec.getApiKeyAndHeaders,
             parentCwd: taskRootFinal,
+            ...(input.hostFloor !== undefined ? { hostFloor: input.hostFloor } : {}),
             ...(fileHistoryEnabled ? { fileHistoryLineage: { scope: historyScope, root: historyRoot, fs: historyFs } } : {}),
             reminderMark,
             reminderDisclosureCounts,
@@ -264,7 +266,7 @@ export function prepareInheritedGate(input) {
             ...(sessions.fork !== undefined
                 ? {
                     hostSessionFork: async () => {
-                        const forked = (await sessions.fork(sessionId, spec.principal ?? null)) ?? null;
+                        const forked = (await sessions.fork(sessionId, principalNameOf(spec.principal) ?? null)) ?? null;
                         if (forked === null)
                             return null;
                         return {

package/dist/core/runner/prepare-memory-engine-session.js

@@ -7,7 +7,7 @@ import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { fileArgPath } from "../tool-registry.js";
 import { RosterBuilder } from "../tool-roster.js";
-import { isNotStartedDelegationResult } from "../../agents/subagent.js";
+import { isNotStartedDelegationResult } from "../delegation-not-started.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareMemoryEngineSession(input) {
     const { memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mountedMcp, sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef } = input;

package/dist/core/runner/prepare-park-ask.d.ts

@@ -102,6 +102,8 @@ export interface PrepareParkAskInput {
     handsRoot: string | undefined;
     /** borrowed-readonly — the live gate's target-reading stamp ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.stampCallTarget}). */
     stampCallTarget: CallTargetStamp | undefined;
+    /** borrowed-readonly — where the leg's shell read station found a judged call's reads land (the approval object's targets). */
+    shellReadLandings: import("../../tools/fs/shell-read-check.js").ShellReadLandings | undefined;
     /** borrowed-readonly — the SAME seat the live gate stamps from ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.advertisedWritableDirs}): a parked call's projection re-adjudication asks one question about one call, so it must ask it against the same admitted list. Read at park time, not written here. */
     advertisedWritableDirs: Pick<AdvertisedWritableDirs, "roots"> | undefined;
     /** borrowed-readonly — the leg's ONE exempt root, the SAME list the live gate stamps ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.exemptRoots}). */

package/dist/core/runner/prepare-park-ask.js

@@ -2,7 +2,7 @@ import { callTargetReadingOf } from "../effective-path-target.js";
 import { approvalTargetsOf } from "../approval-object.js";
 import { uuidv7 } from "../../engine/session/uuid.js";
 import { Value } from "typebox/value";
-import { classifyQuestionOutcome, validateAskQuestions } from "../ask-question.js";
+import { classifyQuestionOutcome, isEngineQuestionFace, validateAskQuestions } from "../ask-question.js";
 import { hasBackgroundShell, sweepBackgroundShells, sweepRunBoundaryBackgroundShells } from "../background-shell.js";
 import { boundInputHashOf, exactBoundInputHashOf } from "../canonical-json.js";
 import { buildRiskDescriptor, debitLedger, encodeAtFidelity, mintCheckpointId, mintCheckpointToken, resolveDeclaredFidelity, } from "../checkpoint-store.js";
@@ -17,7 +17,7 @@ import { raceAbort, raceSettlementAgainstSignal } from "./abort-race.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { DEFAULT_UNATTENDED_APPROVAL_TTL_MS, publishCommittedSuspend, sanitizedTtlMs } from "./park-commit.js";
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
-import { approvalCardMemberOf, callFaceSeat, engineCardOf, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
+import { approvalCardMemberOf, callFaceSeat, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
 import { seatOf } from "../tool-name-readings.js";
 class ParkRefusal extends Error {
     constructor(message, options) {
@@ -29,7 +29,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, checkpointScope, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot, stampCallTarget, advertisedWritableDirs, exemptRoots, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, checkpointScope, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot, stampCallTarget, shellReadLandings, advertisedWritableDirs, exemptRoots, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -112,7 +112,7 @@ export function prepareParkAsk(input) {
     };
     const suspendAsk = parkLaneArmed && checkpointStore !== undefined
         ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, allowRuleShadowed, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated, carry) => {
-            const contentAsk = engineCardOf(req) === "question";
+            const contentAsk = isEngineQuestionFace(req.face);
             const syncFirstEligible = contentAsk ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
             if (syncFirstEligible &&
                 runtimeCaps?.forceDurableGate !== true &&
@@ -179,7 +179,7 @@ export function prepareParkAsk(input) {
                         return undefined;
                     if (reprojectedRaced.tag === "threw")
                         throw reprojectedRaced.error;
-                    const reprojected = refuseOutOfContractDecision(reprojectedRaced.value);
+                    const reprojected = refuseOutOfContractDecision(reprojectedRaced.value, { call: req });
                     const filedAsHeld = ownArgs(parkedArgs);
                     const rewroteTheFiledValue = reprojected.updatedInput !== undefined && !(filedAsHeld.ok && samePlainValue(reprojected.updatedInput, filedAsHeld.value));
                     if (reprojected.action === "deny" || rewroteTheFiledValue) {
@@ -188,7 +188,7 @@ export function prepareParkAsk(input) {
                             `refusing to file a row whose executable form nothing adjudicated`);
                     }
                     if (reprojected.action === "ask")
-                        storedShapeFacts = ownedClearanceFacts(reprojected);
+                        storedShapeFacts = ownedClearanceFacts(reprojected, req);
                 }
                 const rowRealApproval = realApproval ?? (storedShapeFacts?.requiresRealApproval === true ? { origin: carry?.origin ?? wordlessDemand(req.toolName) } : undefined);
                 if (offloadStore && isVolatileOffloadStore(offloadStore) && !offloadStore.isEmpty()) {
@@ -311,7 +311,7 @@ export function prepareParkAsk(input) {
                         toolCallId: req.toolCallId,
                         toolName: req.toolName,
                         ...parkedToolIdentity(toolRosterDeltas.current, req.toolName), ...parkedToolFace(toolRosterDeltas.current, req),
-                        ...approvalTargetsOf(licenseCovers(parkedHash, req.args) ? callTargetReadingOf(req) : undefined),
+                        ...(licenseCovers(parkedHash, req.args) ? approvalTargetsOf(callTargetReadingOf(req), shellReadLandings?.(req.toolCallId)) : {}),
                         args: parkedArgs,
                         ...(() => {
                             const p = approvalPreviewOf(req.toolName, parkedArgs);

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -6,8 +6,8 @@
  * inherited-unavailable marker channel, the grant record, the sandbox-admission mode's arming and its three
  * sideband maps, the source-identity and risk-axes factories, the two permission-rule lanes and the rule-offer
  * factory, the approved-edit re-check, the inherited-constraint wrappers (the same-instance adapter and the true
- * wrapper), the rewrite-emitter index and the instrumented chain, the integrity guards, the fold, and the final-form
- * re-check that is the effective policy. The advised-names dedupe pair only this section reads moved with it.
+ * wrapper), the instrumented chain, the integrity guards, the fold, and the same-instance arbitration refresh that is the
+ * effective policy. The advised-names dedupe pair only this section reads moved with it.
  * The interface is the dependency list the segment had implicitly.
  *
  * ASYNC PHASE: the stretch awaits the session-policy store (the task's own rules and each ancestor's live re-read)
@@ -42,7 +42,10 @@ import { type ModeGateSeats, type PermissionModeController } from "../mode-polic
 import { type InheritedAskGrant } from "./inherited-ask-grants.js";
 import { createRuleOffersOf, type PermissionRuleLanes } from "./permission-rule-lanes.js";
 import type { ToolCallLike } from "../tool-registry.js";
+import { type HostFloor } from "../host-floor.js";
 export interface PreparePolicyChainInput {
+    /** borrowed-readonly — the deployment's host floor as the config doors compiled it: the leading narrowing layer when declared. */
+    hostFloor: HostFloor | undefined;
     /** borrowed-readonly — the REBOUND spec. Read: `sessionId` / `principal` (the session-rule read and the lanes' identity),
      *  `durableApproval` / `checkpointStore` (the mandate-park facility test and the sandbox arming's park prerequisites), `taskId` (the late-ask observer's detail),
      *  `tools` (the names the caller mounted, for the name audit). Never mutated. */
@@ -202,7 +205,7 @@ export interface PreparePolicyChainResult {
     };
     /** owned — the caller-facing policy layers (the wiring manifest reads their COUNT). */
     policyLayers: ToolPolicy[];
-    /** owned — THE effective policy the gate station adjudicates with (the fold plus its final-form re-check), or undefined. */
+    /** owned — THE effective policy the gate station adjudicates with (the fold, plus the same-instance arbitration refresh), or undefined. */
     effectivePolicy: ToolPolicy | undefined;
     /** borrowed-mutable — the inherited-unavailable marker channel. Writers: the inherited arms here (mark); the gate station
      *  (the lifecycle-end sweep) and the park lane's consumers (delete on consumption). */