@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/tool-policy.d.ts

@@ -1,4 +1,5 @@
 import { type AskOrigin, type AssertAllKeysHandled } from "./ask-origin.js";
+import { type EngineAttestation } from "./engine-attestation.js";
 import { type ReadRootGrantScreen } from "./read-root-grant-screen.js";
 import { type Settlement } from "./gate-outcome.js";
 export { policyCannotAnswer, rowDemandsAPerson } from "./real-approval.js";
@@ -36,7 +37,8 @@ export interface ToolCallFace {
     approvalCard?: import("./tool-face.js").ToolApprovalCard;
     /** Present (`true`) iff one of the ENGINE's own mount sites mounted the tool the call dispatches to — a built-in or synthetic tool
      *  the engine minted for the leg, never a caller's `TaskSpec.tools` entry or a protocol peer's tool (`engineMountedRow`). The one
-     *  identity a caller cannot wear: a name and a contract id can be declared. Absent on a face rebuilt from a park row. */
+     *  identity a caller cannot wear: a name and a contract id can be declared. A face rebuilt from a park row carries it when the row does
+     *  (the member the park wrote off the roster entry); absent on a row minted before the member. */
     engineMounted?: true;
 }
 export interface ToolCallRequest {
@@ -227,81 +229,7 @@ export declare function exemptRootsSeat(exemptRoots: readonly string[]): {
 /** Declared beside the receipt's list (decision-receipt.ts) — a new member added to either side is a compile error rather
  *  than a silent drift between the type and the screen; re-exported here, the module every consumer of the decision reads. */
 export type { DecisionReason };
-/**
- * The engine's ATTESTATION record — the one carrier of what an engine station knows about a decision and a policy cannot
- * state: WHO settled the call's wait and WHICH question that answered (the settlement, the ask's origin word and class set,
- * the digest of the arguments the answer licenses), and the facts the classifier stations, the in-fold unresolvable arms
- * and the policy fold record. It rides the decision as its `attestation` member and is read through {@link attestationOf}
- * alone; the decision object's identity carries nothing.
- *
- * Minted only by {@link mintAttestation} and combined only by {@link mergeAttestation}: both freeze the record and enter it
- * in a module-private brand set, so a value a caller composed — a literal, a copy, a structured clone — is not a record, and
- * the receipt refuses a decision carrying one. A record is bound to the call it was minted for (`toolCallId` + `toolName`):
- * handed back for another call it reads as absent. A spread of a decision keeps its record, and the record still says only
- * what the engine minted — a refusal record on an allow is a contradiction the gate's exit refuses, and a resolution's
- * answer binds the arguments it licensed (`inputDigest`).
- */
-export interface EngineAttestation {
-    readonly toolCallId: string;
-    readonly toolName: string;
-    /** What ended the call's wait. The answer group — `settlement`, `origin`, `classes`, `inputDigest` — travels as one. */
-    readonly settlement?: Settlement;
-    /** The settled ask's origin word. */
-    readonly origin?: AskOrigin;
-    /** The settled ask's class set (`ASK_CLASSES` order), when the minting station held one. */
-    readonly classes?: readonly import("./ask-origin.js").AskClass[];
-    /** `exactBoundInputHashOf` of the arguments the settlement licenses (an approver's edit, the snapshot shown, or the asked
-     *  args); absent when they have none (outside the bindable domain) — such a record licenses no bytes. */
-    readonly inputDigest?: string;
-    /** The FORM of a classifier round that did not rule (a classifier deny's cause). */
-    readonly classifierCause?: import("./gate-outcome.js").ClassifierDenyCause;
-    /** WHICH model answered a classification, on either arm. */
-    readonly classifierRound?: import("./auto-mode.js").AutoModeClassifierRound;
-    /** Why an in-fold deny refused an ask nobody could resolve. */
-    readonly unresolvableCause?: import("./ask-unresolvable-notice.js").AskUnresolvableCause;
-    /** The classes of the asks a policy fold collapsed — the proof behind a decision's `foldedAskClasses`. */
-    readonly foldedClasses?: readonly import("./ask-origin.js").AskClass[];
-    /** Where a path deny row refused the call — the row, the view of the target it met, the face the call is on. The gate's
-     *  exit mints the refusal's card from it; the judge that found the row is its only writer. */
-    readonly pathDenial?: import("../tools/fs/safety.js").PathDenialEvidence;
-    /** A seat refused the call's arguments because no approval can be bound to them ({@link bindableArgsOf}): the refusal's
-     *  sentence, carried by the refusal itself — the gate's deny exit reads it (the remedy it gives) instead of judging again. */
-    readonly bindingRefusal?: string;
-}
-/** The members a station attests — everything but the call binding. */
-export type AttestationMembers = Omit<EngineAttestation, "toolCallId" | "toolName">;
-/** Mint a record for `call`. Engine stations only: not re-exported from `src/index.ts`. The values are DETACHED snapshots, so a
- *  caller that later mutates the settlement object it was handed cannot rewrite what the engine attests. */
-export declare function mintAttestation(call: {
-    toolCallId: string;
-    toolName: string;
-}, members: AttestationMembers): EngineAttestation;
-/** Is `v` a record the engine minted (the brand alone — no binding)? The receipt's test. */
-export declare function isEngineAttestation(v: unknown): v is EngineAttestation;
-/** THE read: the record `d` carries FOR `call` — a branded record bound to that call, else `undefined` (a record bound to
- *  another call is a replayed one and reads as absent). Read off the own data member, never through an accessor. */
-export declare function attestationOf(d: unknown, call: {
-    toolCallId: string;
-    toolName: string;
-}): EngineAttestation | undefined;
-/**
- * Combine two records for `call`, member GROUP by group: the later record's group stands where it has one, the earlier's
- * fills a group the later lacks. A record not bound to `call` contributes nothing. `answer` scope is the veto's merge: the
- * earlier record contributes ONLY its answer, and only when the later carries none — a person's yes rides a later layer's
- * deny (invariant I3) while the refusing station's own facts stay its own.
- */
-export declare function mergeAttestation(call: {
-    toolCallId: string;
-    toolName: string;
-}, earlier: EngineAttestation | undefined, later: EngineAttestation | undefined, scope?: "all" | "answer"): EngineAttestation | undefined;
-/** `d` with `members` attested for `call`, merged over the record it already carries for that call (the new members' groups
- *  win). Always a fresh object — the receipt hands out frozen ones. */
-export declare function attest<T extends object>(d: T, call: {
-    toolCallId: string;
-    toolName: string;
-}, members: AttestationMembers): T;
-/** `d` carrying `record` (a fresh object), or `d` itself when there is no record to put on it. */
-export declare function withAttestation<T extends object>(d: T, record: EngineAttestation | undefined): T;
+export { attest, attestationOf, isEngineAttestation, mergeAttestation, mintAttestation, withAttestation, type AttestationMembers, type EngineAttestation } from "./engine-attestation.js";
 /** The `no_approver`-attested deny an engine policy answers on a request that states nobody can be asked about it
  *  ({@link ToolCallRequest.approvalReach}) instead of reaching a seat — read by a probe as "would ask an approver". */
 export declare function noApproverSeatDeny(req: {
@@ -349,7 +277,7 @@ export declare function screenApproverAttribution(v: unknown): {
     approver?: string;
     defect?: string;
 };
-/** An integrity guard an ask stands on ({@link PermissionResult}'s `guards`). */
+/** An integrity guard an ask stands on — an engine finding, carried on the ask's record ({@link EngineAttestation.guards}). */
 export type AskGuard = "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "artifact_shared_read";
 /**
  * A three-state permission decision for a tool call (design/37). Upgrades the old two-state
@@ -416,9 +344,9 @@ export type PermissionResult = {
     classifierNoRuling?: import("./auto-mode.js").AutoModeFallbackCause;
     /** The allow layer's DISCLOSURE: the members that MATCHED this call and could not clear the ask (it is a class
      *  no allow rule clears — a mandated, governance, hook, ask-rule or mode question — or the call reached the layer
-     *  marked), one record per member ({@link AllowRuleShadow}). ENGINE-STAMPED by the allow layer, overwriting a
-     *  policy's own value; a DISPLAY member: the approval card and the park row render it, nothing reads it to
-     *  decide, and the classifier never sees it (it is not part of `message`). Absent ⇒ no member matched. */
+     *  marked), one record per member ({@link AllowRuleShadow}). Written by the allow layer alone (a STAMP member: a
+     *  decision that states it is refused at the receipt); a DISPLAY member: the approval card and the park row render it,
+     *  nothing reads it to decide, and the classifier never sees it (it is not part of `message`). Absent ⇒ no member matched. */
     allowRuleShadowed?: readonly import("./allow-rule-shadow.js").AllowRuleShadow[];
     /** backlog #239 disclosure (additive): WHY the reversibility probe did not clear this call, in the
      *  probe's own words. ENGINE-STAMPED at the irreversibility tighten (which constructs this decision
@@ -429,6 +357,11 @@ export type PermissionResult = {
      *  {@link allowRuleShadowed}: a policy that self-declares it can only put its own prose on its
      *  own card — nothing reads this member to decide anything, so it is not an authority channel. */
     probeReason?: string;
+    /** This ask puts a person's edit back to the person: the restriction chain would not run it as written and accepts it
+     *  only as {@link import("./rewrite-rejudge.js").EditRewritten.acceptableForm}, the bytes this ask presents. ENGINE-MINTED by
+     *  the approved-edit pass (a policy's self-declared value is a display claim about its own card); carried onto the
+     *  approval request as {@link AskRequest.editRewritten}. */
+    editRewritten?: import("./rewrite-rejudge.js").EditRewritten;
     /** backlog #239 disclosure (additive): the STRUCTURED cause, for a probe whose verdict this engine
      *  understands (see {@link import("./checkpoint-store.js").ProbeCause}). Engine-stamped and
      *  validated at the irreversibility tighten; same display-only posture as the prose sibling. */
@@ -457,8 +390,8 @@ export type PermissionResult = {
      *  set, and a policy self-declaring it only opts its own ask OUT of automatic answering. Carried
      *  onto the approval request as {@link AskRequest.mandated}. */
     mandated?: true;
-    /** The TABLE WORD the {@link mandated} bit stands on — see {@link AskRequest.mandate}. ENGINE-STAMPED at
-     *  the same origin stamp as the bit; a policy's self-declared value is dropped there. */
+    /** The TABLE WORD the {@link mandated} bit stands on — see {@link AskRequest.mandate}. A STAMP member, written at the
+     *  same origin stamp as the bit. */
     mandate?: import("./ask-origin.js").PersistedRuleMandate;
     /** The probe named a directory that would clear this ask
      *  ({@link import("./types.js").ReversibilityVerdict.readRootCandidate}). Display metadata like the two
@@ -479,47 +412,33 @@ export type PermissionResult = {
      *  list) that leaves it unset gets `policy` there, indistinguishable from hesitation. */
     matchedAskRule?: string;
     /** design/252 G-2 (additive): the RULE-PROVENANCE evidence behind this ask — see
-     *  {@link AskRuleEvidence}. ENGINE-STAMPED inside the gate, once, after the org layer and the
-     *  persisted-rule lane have both spoken; a policy that self-declares it is overwritten there
-     *  (the member is a record of what the ENGINE's own governance layers did, so a layer's claim
-     *  about itself is not evidence). Carried onto the approval request by the gate's own ask mint
-     *  site. Display/reconciliation metadata, never adjudication input. */
+     *  {@link AskRuleEvidence}. A STAMP member, written inside the gate once, after the org layer and the
+     *  persisted-rule lane have both spoken (the member is a record of what the ENGINE's own governance layers
+     *  did, so a layer's claim about itself is not evidence). Carried onto the approval request by the gate's own
+     *  ask mint site. Display/reconciliation metadata, never adjudication input. */
     ruleEvidence?: AskRuleEvidence;
     /** design/375 §5.2②: the per-segment coverage table behind this surviving ask — which segments
      *  of a compound an eligible persisted rule already admits, read off the SAME store read that
-     *  adjudicated the call (snapshot = adjudication snapshot). ENGINE-STAMPED at the gate's one
-     *  stamp point whenever the persisted-rule lane reported one (overwriting a policy's claim);
-     *  consumed only by the offer factory, which puts on the batch offer exactly the segments this
-     *  table calls uncovered. Absent ⇒ all segments read as uncovered (over-offer, the safe way).
-     *  Same display-only posture as {@link allowRuleShadowed}: never adjudication input, and a
-     *  value nobody stamps over can only shrink or annotate the card's ADVISORY offers — every
-     *  offered rule still passes the validator at redemption. */
+     *  adjudicated the call (snapshot = adjudication snapshot). A STAMP member, written at the gate's one
+     *  stamp point when the persisted-rule lane reported one; consumed only by the offer factory, which puts on
+     *  the batch offer exactly the segments this table calls uncovered. Absent ⇒ all segments read as uncovered
+     *  (over-offer, the safe way). */
     segmentCoverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
     /** WHICH AUTHORITY raised this ask — one word from the closed {@link import("./ask-origin.js").AskOrigin}
      *  set (org rule / org unavailable / hook / explicit ask rule / the classifier's denial-limit
-     *  fallback / the reserved question tool / a marked call / plain policy). ENGINE-STAMPED inside the
+     *  fallback / the reserved question tool / a marked call / plain policy). A STAMP member, written inside the
      *  gate at the same single stamp point as `ruleEvidence`, derived from what the gate's own layers
-     *  did ({@link import("./ask-origin.js").askOriginOf}) — a policy that self-declares it is overwritten
-     *  there, so the member is never a channel a policy can loosen through. A DISCLOSURE word: the lanes
-     *  read the ask's class set ({@link import("./ask-origin.js").classifyAsk}), an approval surface may
-     *  render the card by it. Optional on the TYPE only because a decision is caller-composable; every ask
-     *  the gate hands to its resolver carries it. */
+     *  did ({@link import("./ask-origin.js").askOriginOf}). A DISCLOSURE word: the lanes read the ask's class set
+     *  ({@link import("./ask-origin.js").classifyAsk}), an approval surface may render the card by it. Optional on the
+     *  TYPE only because the gate writes it after a policy answers; every ask the gate hands to its resolver carries it. */
     origin?: import("./ask-origin.js").AskOrigin;
-    /** The ask's CLASS — the first member of {@link classes} (see {@link AskRequest.askClass}). ENGINE-STAMPED at the
-     *  same single stamp as {@link origin}, from the class set the gate's lanes read; a policy that self-declares it is
-     *  overwritten there, and no lane reads it back (they read the classification itself). */
+    /** The ask's CLASS — the first member of {@link classes} (see {@link AskRequest.askClass}). A STAMP member, written at
+     *  the same single stamp as {@link origin}, from the class set the gate's lanes read; no lane reads it back (they read
+     *  the classification itself). */
     askClass?: import("./ask-origin.js").AskClass;
     /** The ask's whole class set, in {@link import("./ask-origin.js").ASK_CLASSES} order (see
      *  {@link AskRequest.classes}). Stamped beside {@link askClass}, under the same rule. */
     classes?: readonly import("./ask-origin.js").AskClass[];
-    /** WHICH integrity guards stand behind this ask — a removal of a protected location, an unverifiable recursive delete,
-     *  shell text the engine cannot read (or an environment that did not answer the read station), the session-transcript
-     *  write. A set: one ask may stand on several, and each keeps its class. ENGINE-STAMPED by the guard policies and the
-     *  gate fold; a fold-internal fact the class derivation reads ({@link import("./ask-origin.js").classifyAsk}) so the
-     *  guards, which mint the same `requiresRealApproval` ask, are told apart by a fact and not by their prose. Never
-     *  copied onto the approval request or the park row. Replaces the one-word `guard`, which a decision no longer carries:
-     *  a decision that still does is refused by name ({@link RETIRED_DECISION_MEMBERS}). */
-    guards?: readonly AskGuard[];
     /** The call could not be READ against a rule that may reach it — a content-form deny row, a content-form
      *  ask row, a persisted-rule row (the lexer's word), or rows the shell read station's boundary stands on that
      *  could not be read (`persisted_rows`). ENGINE-STAMPED at the four unreadable mint sites;
@@ -533,13 +452,6 @@ export type PermissionResult = {
      *  every ask). Public: a host composing such a policy sets it; {@link combinePolicies} carries it onto the
      *  surviving ask (tighten-only). Not on the approval request — the card shows `origin` / `mandate`. */
     authoredBy?: "deployment";
-    /** The classes of the OTHER asks a policy fold collapsed into this one
-     *  ({@link import("./ask-origin.js").decisionAskClassesOf} per contributing ask, unioned), so a member the
-     *  fold does not copy — a guard mark, an unreadable-rule fact, a bare real-approval bit — is not lost behind
-     *  the ask that won the slot. ENGINE-WRITTEN by {@link combinePolicies}, which attests the list it wrote
-     *  ({@link EngineAttestation.foldedClasses}); the receipt refuses the member unless the decision's record carries that very
-     *  list (a policy's own, an edited list are refused). Fold-internal, never on the request. */
-    foldedAskClasses?: readonly import("./ask-origin.js").AskClass[];
     attestation?: EngineAttestation;
 } | {
     action: "deny";
@@ -781,40 +693,24 @@ export interface ToolPolicyProjection {
     readonly requiresLiveRemainder: boolean;
 }
 /**
- * The entries of a tool-NAME list whose reach is a set of names rather than one name — the covering
- * spellings (`<ns>__<peer>`, `<ns>__<peer>__<glob>`) of ANY protocol namespace, which CC's rule
- * matcher resolves and an exact-membership test silently cannot. Every name-keyed lane in this file
- * consults these ALONGSIDE its exact set: a covering spelling can never equal a minted tool name (`*`
- * is outside the minted charset and a minted name always carries a tool segment), so leaving it in the
- * exact set too costs nothing and keeps the projection/audit faces reporting the operator's own spelling.
- *
- * Namespace-generic on purpose: the covering grammar is a property of the shared `<prefix><peer>__<tool>`
- * name shape, not of MCP, and keying it to one prefix made every sibling-namespace covering rule
- * (`a2a__<peer>__*`) compile clean and match nothing — inert in the deny half, and in an ALLOW list the
- * removal of that peer's whole tool set.
- *
- * The list is usually empty, which is why every call site tests it before scanning.
- *
- * `behavior` = what the list does with a call it reaches: `deny` / `ask` (restricting) lists also read the whole-protocol
- * spelling (`mcp__*`, `mcp__*__*`) as a covering entry — every tool of the namespace — and an `allow` list does not (the
- * spelling names no peer there; the constructors and the prepare-time audit refuse it, and a stored allowlist reads it as nothing).
- *
- * Exported for the OTHER name-keyed lane in this engine — the persisted session/ancestor rules in
- * `session-rule-policy.ts`. Not part of the public API (`src/index.ts` re-exports by name and does not
- * list these two): every publisher of {@link ToolPolicyNameSets} must resolve a covering entry the same
- * way, because the prepare-time audit's exemption for these spellings speaks for ALL published name sets
- * at once — the four in-engine lanes do so by sharing this module's matcher. That premise is NOT
- * structural for an OUT-OF-ENGINE publisher (a host compiling its own settings into an exact-match ask
- * closure is fail-open on these spellings while the audit stays silent) — which is why the underlying
- * judgment predicates (`isNamespacedCoveringRuleName` / `namespacedRuleNameCovers`) ARE exported from
- * the package index: an external lane either compiles through `createPermissionRulePolicy` or
- * self-checks with those.
+ * The entries of a tool-NAME list whose reach is a set of names rather than one name — the covering spellings
+ * ({@link isCoveringRuleName}): a `*` anywhere in the name on a list that restricts (`Re*d`, `mcp__*`, the lone `*` — every tool),
+ * only in the tool segment after a literal `<ns>__<peer>__` on one that grants, and a protocol peer (`<ns>__<peer>`) on either —
+ * which CC's rule matcher resolves and an exact-membership test silently cannot. Every name-keyed lane in this file consults these
+ * ALONGSIDE its exact set: a covering spelling can never equal a mounted tool name (no mounted name holds a `*`, and a minted name
+ * always carries a tool segment), so leaving it in the exact set too costs nothing and keeps the projection/audit faces reporting
+ * the operator's own spelling. The list is usually empty, which is why every call site tests it before scanning.
+ *
+ * `behavior` = what the list does with a call it reaches. Exported for the in-engine name-keyed lanes; an OUT-OF-ENGINE publisher
+ * of {@link ToolPolicyNameSets} compiles through `createPermissionRulePolicy` or self-checks with the root-exported predicates
+ * (`isCoveringRuleName` / `ruleNameCovers`) — the prepare-time audit's exemption for these spellings speaks for every published
+ * name set at once, so a lane keying them exactly is fail-open in the "tool runs unasked" direction while the audit stays silent.
  */
-export declare function namespacedCoveringEntries(entries: readonly string[] | undefined, behavior: RuleBehavior): readonly string[];
+export declare function coveringRuleEntries(entries: readonly string[] | undefined, behavior: RuleBehavior): readonly string[];
 /** Does any covering entry reach the call — under ANY name it answers to, the same reading the exact lists take through
  *  `nameListHolds` (a covering entry and an exact entry in one list are one rule: it reaches the call iff its name is on the
- *  list)? See {@link namespacedCoveringEntries}. */
-export declare function namespacedCoveringHit(covering: readonly string[], call: Pick<ToolCallRequest, "toolName" | "face">): boolean;
+ *  list)? See {@link coveringRuleEntries}. */
+export declare function coveringRuleHit(covering: readonly string[], call: Pick<ToolCallRequest, "toolName" | "face">): boolean;
 /**
  * The tool names a projection component is keyed on, and the member that holds them: a `tool_deny` / `tool_allowlist`'s
  * `names`, a `shell_command`'s `tools` (its `deny` / `allow` are command names, not tool names). A frozen chain holds them only
@@ -944,53 +840,12 @@ export declare function constraintChainDigest(chain: readonly ConstraintChainEnt
  *  present one must sit on an arm its row holds. Not re-exported from `src/index.ts`. */
 export type DecisionMember = PermissionResult extends infer U ? (U extends unknown ? keyof U : never) : never;
 export declare const DECISION_MEMBERS: readonly DecisionMember[];
-/**
- * The RECEIPT of a permission decision — the one point at which the engine takes a decision in from whoever composed it,
- * on every lane: each layer of {@link combinePolicies}' fold, the gate's adjudication entry and its approved-edit re-check,
- * the inherited lane's receipts of an ancestor policy's decision, the final-form re-check, the direct `check()` rechecks
- * (the resume edit, the park re-projection, the changed-files probe), and the PreToolUse hook's result seam (its own
- * reach, below). NOT re-exported from `src/index.ts`: an internal screen on inputs the engine receives.
- *
- * WHAT COMES BACK is the engine's own frozen copy, never the caller's object. A decision is caller-supplied data: a
- * stateful accessor, a Proxy, or a policy that keeps and mutates an object it returned could otherwise answer two
- * consumers with two values, and which consumer read which value would decide the call. So the caller's object is read
- * ONCE, here, and every station after the receipt (the fold's ranking, the origin stamp, the classifier's eligibility, the
- * mode arbitration, the approval request, the rewrite that executes) reads the copy; a copy handed to the screen again
- * comes back as it is, unread (so does the engine's own refusal, {@link isEngineRefusal}). In order: (1) the CARRIER's type — a decision that is not an object (a string, a function
- * holding the members) has no `action`; (2) the ONE READ — ONE function ({@link receiveContract}) for the decision and for the
- * records it nests (`receiveNestedRecords`, decision-receipt.ts), on an ORDINARY object (a Proxy, as the carrier or anywhere on its prototype
- * chain, is refused before a trap of its could run): each contract member absent or an own enumerable DATA property, its value
- * taken off the carrier's own descriptor (a member outside the contract is neither read nor carried — a policy's self-declared
- * record on another name finds no reader); any other spelling refused by name — an accessor (never invoked), a member the
- * prototype or a non-enumerable property supplies unless that descriptor spells absence (an `undefined` data value) — judged by
- * descriptor, never read; (3) a retired member ({@link RETIRED_DECISION_MEMBERS}: `reason`, `guard`) carried by the same presence law as a contract
- * member — own, held by an accessor, or supplied by the prototype — judged without a read (ignoring it silently dropped the policy's text or the ask's guard); (4) the VALUES, off the engine's
- * one-read record, never a second read of the caller's object — the retired window absent, `action` in
- * its closed set (`screenContractValues`, decision-receipt.ts — every closed-set member is held to its set there; a consumer ranks a decision by testing two of its words, so any other value used to rank as an
- * allow; a `canUseTool` result outside its set is a failure in CC) and `decisionReason` in {@link DECISION_REASONS} when
- * present (absence stays legal); (5) the DETACH —
- * the contract members' values structured-cloned ({@link tryCloneArgs}; one that cannot be, a function inside a rewrite,
- * is refused), the engine's `attestation` record re-attached by reference after its brand check, the copy frozen and
- * marked as this module's. A refusal is a deny in the screen's words, one code for every arm (`decisionReason: "rule"`),
- * carrying no `updatedInput` from the refused object (a rewrite from an EARLIER, contract-shaped layer still rides out of
- * {@link combinePolicies}' deny path). `null` / `undefined` carry nothing and take the carrier's refusal (the caller's own
- * read of `.action` would throw instead, and that throw was being reported as an aborted check).
- *
- * SCOPE: the receipt runs NONE of the carrier's code — a Proxy (its traps are the caller's code) is refused unread, and on an
- * ordinary object descriptor looks and `Object.getPrototypeOf` invoke nothing. What the receipt does not reach: code inside a
- * member's VALUE, run by the detach itself (an accessor inside a rewrite is invoked by the structured clone, and what it answers
- * there is what is cloned and what runs — one read, consistent) and by a refusal's rendering of a foreign word (`String(v)` on an
- * out-of-set `action`, after the deny is decided). Same-process JavaScript has no trust boundary a function can enforce.
- *
- * `reasonIsNonInput` (the HOOK seam): the same receipt, with the two differences the seam's consumers imply — a hook's
- * `decisionReason` is DISCARDED there (every mint point downstream re-stamps `"hook"`) and so is not held to its set, and a
- * hook result may leave `action` out (no opinion; the policy still adjudicates). `undefined`, `null` and `false` are no
- * opinion (what a hook body yields when it has nothing to say). A refusal the receipt mints at this seam is the ENGINE's
- * decision ({@link isEngineRefusal}) and exits through the engine's fail-closed arm (the deny observer), never as the hook's
- * own deny.
- */
 export declare function refuseOutOfContractDecision(d: PermissionResult, opts?: {
     reasonIsNonInput?: boolean;
+    call?: {
+        readonly toolCallId: string;
+        readonly toolName: string;
+    };
 }): PermissionResult;
 /** The raw tool-name lists a name-keyed policy was built from (audit feed, see block note above). */
 export interface ToolPolicyNameSets {
@@ -1015,9 +870,9 @@ export declare function toolPolicyNameSets(p: ToolPolicy | undefined): readonly
  * mode's unstated question; consent is an allow entry (`RunnerDeps.allowedTools` / `TaskSpec.allowedTools`). Without
  * `allow`, everything not in `deny` gets no objection. Each entry is read by the rule
  * syntax (`ruleSpellingOf`): a name, or `Tool()` / `Tool(*)` — the bare `Tool`, as every list reader reads them, once however
- * many spellings write it; any other spelling is not a tool name (`onInvalidName`), and neither is the wildcard `*` (`*`,
- * `*()`, `*(*)`) in `deny`: it names no tool, and the entry would be kept and never match. In `allow` it is one entry no tool
- * carries — the list admits what else it names, and nothing for it.
+ * many spellings write it; any other spelling is not a tool name (`onInvalidName`). A `*` in a name is a glob over the whole
+ * name in `deny` (`Re*d`, `mcp__*`; the lone `*` denies every tool), and in `allow` only in the tool segment after a literal
+ * `<ns>__<peer>__` (`mcp__srv__get_*`) — any other `*` in `allow` names no scope it widens and is not a tool name either.
  * Carries {@link NamedToolPolicy.nameSets} (the names as read) so the host can audit the lists against the mounted
  * pool ([c209-E] advisory); enforcement semantics are unchanged.
  */
@@ -1026,7 +881,7 @@ export declare function createAllowDenyPolicy(opts: {
     deny?: string[];
     /**
      * What to do with an entry that is not a tool NAME: a rule CONTENT form (`Bash(ps:*)`, `Edit(src/**)`), a spelling
-     * the rule syntax reads no tool name in (`" Bash"`, `Bash\t(*)`, `-deploy`), or the wildcard `*` in the deny list.
+     * the rule syntax reads no tool name in (`" Bash"`, `Bash\t(*)`, `-deploy`), or a `*` the allow list does not read (`*`, `Re*d`, `mcp__*`).
      * `"throw"` (default, matching {@link createPermissionRulePolicy}'s posture toward a rule it cannot
      * compile) refuses at construction; `"skip"` drops the entry and reports it. Under BOTH, the entry never
      * silently narrows the allowlist.
@@ -1113,6 +968,13 @@ export declare function createApprovalPolicy(opts: {
  * no longer covers what runs. For a tool whose permission seat is `passthrough` the gate puts the mode's question to a
  * combined allow unless an answer covers the bytes that run ({@link answeredFor}) — the allow layer answers it there.
  *
+ * **A rewrite is judged by every layer that judged earlier bytes.** A layer's `updatedInput` cascades into the layers after
+ * it; the layers BEFORE the latest rewrite judged other bytes, so each is asked once more about the bytes that run, and that
+ * answer is its verdict (a deny there refuses the call; a different form handed back there refuses it too — a rewrite is
+ * judged once, never chased). The latest rewriter is not asked again: its verdict is bound to its own output. An `updatedInput`
+ * that reads as the bytes it was handed is no rewrite; and a layer's rewrite that is a person's edit (its own approver's,
+ * licensed by that person's yes) is not replaced by a later layer — that layer's rewrite refuses the call.
+ *
  * **Idempotency requirement:** because the fold continues past an `ask` to look for a later `deny`, a
  * policy's `check()` can be invoked even after an earlier policy returned `ask`. `check()` MUST be
  * idempotent — repeated calls with the same {@link ToolCallRequest} return the same decision and
@@ -1263,7 +1125,8 @@ export declare function createUnverifiableDeletePolicy(opts?: {
 export declare function createTranscriptIntegrityPolicy(opts?: {
     /** Transcript directories to protect. Default: `($AGENT_DATA_DIR ?? ~/.ai-agent)/sessions`. */
     sessionsDirs?: readonly string[];
-    /** argv[0] allowlist for read-only access to the transcript dir (default {@link BASH_READONLY_DEFAULT_ALLOW}). */
+    /** The programs a read-only command over the transcript dir may run (default {@link BASH_READONLY_DEFAULT_ALLOW}); it only
+     *  narrows the read-only reader — a listed program whose call writes still asks. */
     readAllow?: readonly string[];
     /** Override the shell tool names this gate parses (default {@link COARSE_SHELL_TOOLS}, the shell face). */
     tools?: string[];
@@ -1312,6 +1175,10 @@ export interface AskRequest {
      *  `RiskDescriptor.probeReason`. Neutralized + length-capped by the gate. UNTRUSTED-for-display,
      *  never adjudication input. */
     readonly probeReason?: string;
+    /** Present ⇔ this card puts a person's edit back to them: the restriction chain would not run the edit as written and
+     *  accepts it only as `acceptableForm` — the `args` this card presents. Approving as it stands runs exactly those bytes;
+     *  editing again starts a new pass; a no refuses. Engine-minted; display and outlet only, never adjudication input. */
+    readonly editRewritten?: import("./rewrite-rejudge.js").EditRewritten;
     /** The STRUCTURED cause behind the tighten — a machine-readable code plus the operand
      *  families as arrays with honest totals, so this surface renders its OWN sentence rather than one the
      *  engine had to write before the check's edge cases were known. See
@@ -1338,6 +1205,10 @@ export interface AskRequest {
      *  RECONCILIATION metadata, never adjudication input. */
     readonly ruleEvidence?: AskRuleEvidence;
     toolCallId: string;
+    /** An extension's own call (`$.tool.call`): who asked for it, for the card's line of origin ("extension X wants to run …").
+     *  A display fact — the ask is the run's, put to the run's approver and judged exactly as a model's call is; absent for a
+     *  call a model message carried. Minted by the engine at the ask's mint; never adjudication input. */
+    readonly requestedBy?: import("./task-event.js").ExtensionRequester;
     /** The (post-rewrite) args the tool would run with. */
     args: unknown;
     /** the tool's approval display projection of {@link args} (AgentTool.approvalPreview),
@@ -1458,13 +1329,16 @@ export interface AskRequest {
      *    command whose exact form the validator refuses offers nothing rather than promoting a lone
      *    prefix to index 0 — see `suggestRulesForCommand`). The seat says "this card has no rule to
      *    offer you", which is true of both; it does not claim the grammar is empty, and a surface must
-     *    not word it as though no rule could ever be written for the command.
+     *    not word it as though no rule could ever be written for the command. It is also the word of a
+     *    card whose tool's form mints no offer: a path tool's, a shell-face sibling's, and a tool that
+     *    answers to one of those under an alias.
      *
      * ABSENT is not a claim, exactly as {@link previewWithheld}'s absence is not: it also covers the
-     * ordinary "there are offers" case and the three STRUCTURAL doors that answer with silence on
-     * purpose (no rule lane wired, a tool the lane does not speak for, a task that cannot hold a rule at
-     * all) — a reason line on every ask of a deployment that never had the feature would be noise about
-     * a lane that does not exist. Read presence, never absence.
+     * ordinary "there are offers" case and the STRUCTURAL door that answers with silence on purpose — no
+     * rule speaks for this call: no rule lane wired, a task that cannot hold a rule at all, or a call the
+     * lane does not judge (a content-routing tool the engine mounts) — a reason line on every ask of a
+     * deployment that never had the feature would be noise about a lane that does not exist. Read
+     * presence, never absence.
      *
      * ADVISORY disclosure metadata, never adjudication input: it changes nothing about what is allowed,
      * and a surface that ignores it renders exactly the card it rendered before. The durable park row