@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/allow-entry.js

@@ -1,11 +1,12 @@
 import { heldBy } from "./tool-name-readings.js";
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, ruleIssue } from "./permission-rules.js";
-import { parsePermissionRule, ruleSpellingOf } from "./permission-rule-syntax.js";
-import { judgeRuleToolName, splitNamespacedName } from "./tool-name-aliases.js";
+import { ruleIssue } from "./permission-rules.js";
+import { isCoveringRuleName, ruleNameCovers } from "./namespaced-rule-name.js";
+import { ruleSpellingOf } from "./permission-rule-syntax.js";
+import { splitNamespacedName, toolNameFaultOf } from "./tool-name-aliases.js";
 import { catalogToolNames, isShellFaceToolName } from "./tool-registry.js";
 import { ALLOW_RULE_MEMBERS } from "./allow-rule-shadow.js";
 import { callHostTargetOf } from "./host-target.js";
-import { COMMAND_RULE_TOOL, adjudicatePersistedDomainRules, adjudicatePersistedNameRules, commandCoverageOf, laneToolNamesOf, ruleContentOf, noticeRuleText, parseRuleText, programRunReachOf, ruleToolGrammarOf, commandPatternMayRun } from "./permission-rule-model.js";
+import { adjudicatePersistedDomainRules, wholeToolRuleReaches, adjudicatePersistedNameRules, commandCoverageOf, laneToolNamesOf, ruleContentOf, noticeRuleText, parseRuleText, programRunReachOf, ruleToolGrammarOf, commandPatternMayRun } from "./permission-rule-model.js";
 import { pathRuleLaneAnswer } from "./runner/permission-rule-lanes.js";
 import { callTargetReadingOf } from "./effective-path-target.js";
 import { splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
@@ -24,30 +25,12 @@ export function nonListValueLabel(read) {
 function ruleRowOf(parsed) {
     return { ...parsed, scope: { kind: "global" }, adds: [{ dot: { actor: "list", counter: 1 }, origin: "user", createdAt: "" }] };
 }
-function mountedSpellingOf(name, roster) {
-    const folded = name.toLowerCase();
-    for (const mounted of roster)
-        if (mounted.toLowerCase() === folded)
-            return mounted;
-    return undefined;
-}
-export function nearMissSpellingOf(name, roster) {
-    if (roster.has(name) || catalogToolNames().has(name) || splitNamespacedName(name) !== undefined)
-        return undefined;
-    return mountedSpellingOf(name, roster);
-}
 export function rootFacingToolNames(carried) {
     return new Set([...catalogToolNames(), ...carried]);
 }
 function toolNameReading(name, roster, behavior) {
-    const verdict = judgeRuleToolName(name, roster, behavior);
-    if (verdict.kind === "unprefixed_namespace")
-        return { kind: "inert", reason: "tool_name", verdict: verdict.kind };
-    if (verdict.kind !== "current") {
-        return { kind: "inert", reason: "tool_name", verdict: verdict.kind, guidance: verdict.guidance, ...(verdict.currentName !== undefined ? { currentName: verdict.currentName } : {}) };
-    }
-    const mounted = nearMissSpellingOf(name, roster);
-    return mounted === undefined ? undefined : { kind: "inert", reason: "near_miss", currentName: mounted };
+    const fault = toolNameFaultOf(name, roster, behavior);
+    return fault === undefined ? undefined : { kind: "inert", ...fault };
 }
 export function readRuleEntry(raw, behavior, roster) {
     const inert = (reason) => ({ kind: "inert", reason });
@@ -58,7 +41,7 @@ export function readRuleEntry(raw, behavior, roster) {
     if (parsed === undefined)
         return inert("grammar");
     const name = parsed.toolName;
-    if (name === "*")
+    if (name === "*" && behavior === "allow")
         return inert("wildcard_all");
     if (roster !== undefined) {
         const stale = toolNameReading(name, roster, behavior);
@@ -66,14 +49,10 @@ export function readRuleEntry(raw, behavior, roster) {
             return stale;
     }
     if (ruleContentOf(parsed) === undefined) {
-        const split = splitNamespacedName(name);
-        if (split !== undefined) {
-            if (split.peer.includes("*"))
-                return isNamespacedCoveringRuleName(name, behavior) ? row({ kind: "namespace", pattern: name }) : inert("namespace_wildcard");
-            if (isNamespacedCoveringRuleName(name))
-                return row({ kind: "namespace", pattern: name });
-            return row({ kind: "tool", name });
-        }
+        if (isCoveringRuleName(name, behavior))
+            return row({ kind: "covering", pattern: name });
+        if (name.includes("*"))
+            return inert(splitNamespacedName(name) !== undefined ? "namespace_wildcard" : "grammar");
         return row(isShellFaceToolName(name) ? { kind: "shell", name } : { kind: "tool", name });
     }
     const grammar = ruleToolGrammarOf(name);
@@ -94,7 +73,7 @@ export function compiledEntryName(compiled) {
         case "tool":
         case "shell":
             return compiled.name;
-        case "namespace":
+        case "covering":
             return compiled.pattern;
         default:
             return compiled.rule.tool;
@@ -104,11 +83,10 @@ function inertReasonOf(code) {
     return code === "unsupported.tool" ? "content_unsupported" : "grammar";
 }
 export function compileAllowList(entries, behavior, roster) {
-    const voided = behavior === "allow" && entries.some(namesWholeRoster);
     const rows = [];
     const inert = [];
     for (const entry of entries) {
-        const read = typeof entry !== "string" || !voided ? readRuleEntry(entry, behavior, roster) : { kind: "inert", reason: "wildcard_all" };
+        const read = readRuleEntry(entry, behavior, roster);
         if (read.kind === "row")
             rows.push({ entry, compiled: read.compiled });
         else {
@@ -119,9 +97,6 @@ export function compileAllowList(entries, behavior, roster) {
     }
     return { rows, inert };
 }
-function namesWholeRoster(entry) {
-    return typeof entry === "string" && entry === entry.trim() && parsePermissionRule(entry).toolName === "*";
-}
 function answersTo(req, has) {
     return heldBy("allowEntry.names", { has }, req);
 }
@@ -160,7 +135,7 @@ export function autoStripped(compiled, call) {
             return call !== undefined && answersTo(call, isShellFaceToolName);
         case "command":
             return compiled.rule.match === "pattern" ? commandPatternMayRun(compiled.rule.command, AUTO_STRIPPED_PROGRAMS) : shellContentStripped(shellRuleContent(compiled.rule));
-        case "namespace":
+        case "covering":
         case "path":
         case "name":
         case "domain":
@@ -172,12 +147,22 @@ export function autoStripped(compiled, call) {
     }
 }
 export function autoStrippedRule(rule, call) {
-    return rule.behavior === "allow" && rule.tool === COMMAND_RULE_TOOL && autoStripped({ kind: "command", rule }, call);
+    if (rule.behavior !== "allow")
+        return false;
+    const entry = entryOfRow(rule);
+    return entry !== undefined && autoStripped(entry, call);
+}
+function entryOfRow(rule) {
+    if (rule.match === "tool")
+        return isShellFaceToolName(rule.tool) ? { kind: "shell", name: rule.tool } : { kind: "tool", name: rule.tool };
+    const grammar = ruleToolGrammarOf(rule.tool);
+    return grammar === undefined ? undefined : { kind: grammar, rule };
 }
 const NO_LEADS = new Map();
 function nameRowReaches(compiled, req) {
-    const covers = compiled.kind === "namespace" ? (n) => namespacedRuleNameCovers(compiled.pattern, n) : compiled.kind === "tool" || compiled.kind === "shell" ? (n) => n === compiled.name : undefined;
-    return covers !== undefined && answersTo(req, covers);
+    if (compiled.kind === "tool" || compiled.kind === "shell")
+        return wholeToolRuleReaches(compiled.name, req);
+    return compiled.kind === "covering" && answersTo(req, (n) => ruleNameCovers(compiled.pattern, n));
 }
 function commandOf(req) {
     const tool = laneToolNamesOf(req).find((n) => ruleToolGrammarOf(n) === "command");
@@ -348,6 +333,16 @@ export function allowRuleShadowOf(member, entries) {
     const shown = entries.slice(0, SHADOW_ENTRIES_MAX).map((e) => inlineUntrusted(e, SHADOW_ENTRY_MAX_CHARS));
     return { member, entries: shown, ...(entries.length > shown.length ? { omitted: entries.length - shown.length } : {}) };
 }
+export function withAllowRuleShadow(list, shadow) {
+    const at = list.findIndex((s) => s.member === shadow.member);
+    if (at < 0)
+        return [...list, shadow];
+    const held = list[at];
+    const entries = [...held.entries, ...shadow.entries];
+    const shown = entries.slice(0, SHADOW_ENTRIES_MAX);
+    const omitted = (held.omitted ?? 0) + (shadow.omitted ?? 0) + (entries.length - shown.length);
+    return list.map((s, i) => (i === at ? { member: held.member, entries: shown, ...(omitted > 0 ? { omitted } : {}) } : s));
+}
 const MEMBER_SET = new Set(ALLOW_RULE_MEMBERS);
 export function readAllowRuleShadows(value) {
     try {
@@ -432,10 +427,11 @@ export function allowRuleShadowSentence(shadows, ask) {
 }
 export function cardDisclosureOf(decision, fallbackMessage) {
     const base = decision.message ?? fallbackMessage;
+    const outlet = decision.editRewritten !== undefined ? { editRewritten: decision.editRewritten } : {};
     const shadows = readAllowRuleShadows(decision.allowRuleShadowed);
     if (shadows === undefined)
-        return { message: base };
-    return { message: `${base} (${allowRuleShadowSentence(shadows, decision)})`, allowRuleShadowed: shadows };
+        return { message: base, ...outlet };
+    return { message: `${base} (${allowRuleShadowSentence(shadows, decision)})`, allowRuleShadowed: shadows, ...outlet };
 }
 export const ALLOWED_TOOL_NOT_GRANTED_CODE = "permission.allowed_tool_not_granted";
 const NOTICE_ENTRIES_SHOWN = 5;
@@ -486,7 +482,7 @@ export function allowedToolsNotGrantedNotice(inert, sessionId) {
     return {
         code: ALLOWED_TOOL_NOT_GRANTED_CODE,
         message: `${inert.length} allowed-tools entr${inert.length === 1 ? "y grants" : "ies grant"} or refuse${inert.length === 1 ? "s" : ""} nothing — ${shown.join("; ")}${rest > 0 ? `; and ${rest} more` : ""}. ` +
-            "A list holding `*` voids the list, `mcp__*` names no server, a rule the grammar refuses (`grammar`) or one on a tool with no such rule form (`content_unsupported`: an allow by path is an `Edit(…)` or `Read(…)` rule) grants nothing, and a tool name must be spelled as the tool is mounted; name the tools (or `mcp__<server>`) instead." +
+            "On an allow list a `*` outside a protocol name's tool segment (`*`, `Re*d`, `mcp__*`) names no scope and grants nothing — the entries beside it still grant — and a rule the grammar refuses (`grammar`) or one on a tool with no such rule form (`content_unsupported`: an allow by path is an `Edit(…)` or `Read(…)` rule) grants nothing; a tool name must be spelled as the tool is mounted; name the tools (or `mcp__<server>`) instead." +
             (refusing ? " Such an entry in a disallowed-tools list keeps its Skill from activating: a refusal that reads as nothing is not dropped." : ""),
         detail: { ...(sessionId !== undefined ? { sessionId } : {}), entries: inert.map((e) => ({ ...e, entry: noticeRuleText(e.entry) })) },
     };

package/dist/core/allow-rule-shadow.d.ts

@@ -8,9 +8,9 @@
  *  `TaskSpec.allowedTools`. The closed set {@link AllowRuleShadow.member} names. */
 export declare const ALLOW_RULE_MEMBERS: readonly ["hook", "deployment", "persisted", "skill", "request"];
 export type AllowRuleMember = (typeof ALLOW_RULE_MEMBERS)[number];
-/** One allow-layer member that matched a call and could not clear its ask: the member, and the entries it matched as their
- *  source spells them (sanitized and capped at the mint; a hook names none — its word is about the call, not an entry).
- *  `omitted` counts entries beyond the cap, never dropped silently. */
+/** One allow-layer member that matched a call and could not clear its ask — one record per member: the member, and the
+ *  entries it matched as their source spells them (sanitized and capped at the mint; the hook member names the registrations
+ *  that spoke). `omitted` counts entries beyond the cap, never dropped silently. */
 export interface AllowRuleShadow {
     readonly member: AllowRuleMember;
     readonly entries: readonly string[];

package/dist/core/approval-object.d.ts

@@ -1,6 +1,7 @@
 import type { PendingAction } from "./checkpoint-store.js";
 import type { CallTargetReading } from "./effective-path-target.js";
 import { type SkillGrantSource } from "./skill-grant.js";
+import type { ReadLanding } from "../tools/fs/shell-read-identity.js";
 import type { ToolCallPathTarget, ToolFamily, ToolHostTarget } from "./tool-face.js";
 import { type ToolRosterEntry } from "./tool-roster.js";
 type ParkedApproval = Extract<PendingAction, {
@@ -16,6 +17,15 @@ export type ApprovalTargetRole = (typeof APPROVAL_TARGET_ROLES)[number];
 export type ApprovalTargets = {
     readonly [R in ApprovalTargetRole]?: string | null;
 };
+/** The row's `targetReads` member: per read candidate the shell read station judged for the parked bytes (its key's
+ *  digest), where it landed (its settled targets' digest — a pattern lands on a set). A sibling of `targets`, not a key
+ *  inside it: a reader that knows only the path roles reads an unknown key there as damage and spends the approval, where
+ *  a member of its own carries its own word and that reader refuses the row unread (`version_newer`). Present exactly when
+ *  the station judged the parked bytes — `{}` when it found no read candidate: a candidate appearing by the resume is a
+ *  read the card did not cover. */
+export type ApprovalTargetReads = {
+    readonly [candidate: string]: string;
+};
 /** The tool member as the row carries it: every member optional (a row is read, never trusted to be whole). */
 export interface ApprovalTool {
     readonly capabilityId?: string;
@@ -29,17 +39,21 @@ export interface ApprovalTool {
 export interface ApprovalObject {
     /** Absent on a row minted before the identity members (all four absent): such a row binds the tool's name alone. */
     readonly tool?: ApprovalTool;
-    /** The row's member as stored — read, validated, by the judge. */
+    /** The row's two target members as stored — read, validated, by the judge. */
     readonly targets?: unknown;
+    readonly targetReads?: unknown;
     readonly grants?: string;
 }
 /** The view of one parked approval's object. */
 export declare function approvalObjectOf(row: ParkedApproval): ApprovalObject;
-/** The `targets` member of a reading: per role, the canonical view, or `null` for a view the environment was asked for
- *  and did not answer; nothing when no role was read either way (or no reading was taken). The park mints it from the
- *  gate's reading of the parked bytes; the execution station reads the bytes that will run the same way. */
-export declare function approvalTargetsOf(reading: CallTargetReading | undefined): {
+/** The TARGETS of a reading — the one mint of both members, for the row and for the live call alike: `targets` per role,
+ *  the canonical view, or `null` for a view the environment was asked for and did not answer (nothing when no role was read
+ *  either way, or no reading was taken); `targetReads` per read candidate the shell read station judged, where it landed
+ *  (nothing when the station judged no candidate of these bytes). The park mints them from the gate's readings of the parked
+ *  bytes; the execution station reads the bytes that will run the same way. */
+export declare function approvalTargetsOf(reading: CallTargetReading | undefined, reads?: readonly ReadLanding[]): {
     targets?: ApprovalTargets;
+    targetReads?: ApprovalTargetReads;
 };
 /** Where a resume judges the object: before the claim (the decided bytes), before the session is touched (the live
  *  tool), right before the execution (the tool as mounted then — a host's re-dial can replace it between the two — and the
@@ -71,6 +85,8 @@ export interface LiveApprovalObject {
     readonly skillToolName?: string;
     /** execution: the reading of the bytes that will run, taken at this station (`undefined`: none could be taken). */
     readonly targetReading?: CallTargetReading | undefined;
+    /** execution: where this leg's shell read station found those bytes' reads land (`undefined`: it holds no judgment of them). */
+    readonly reads?: readonly ReadLanding[] | undefined;
     /** execution: the bytes the decision rewrote the call to, as the tool reads them; absent when it rewrote nothing. When
      *  the row's binding does not cover them ({@link licenseCovers}, the one judge of "are these the approved bytes") the
      *  person approved bytes whose target the row never recorded, and the targets member is not judged. */

package/dist/core/approval-object.js

@@ -5,22 +5,23 @@ import { toolIdentityOf } from "./tool-roster.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export const APPROVAL_TARGET_ROLES = Object.freeze(["protective", "declared"]);
 export function approvalObjectOf(row) {
-    const { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget, hostTarget, targets, boundGrantDigest } = row;
+    const { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget, hostTarget, targets, targetReads, boundGrantDigest } = row;
     const carried = [capabilityId, contractId, shapeDigest, implementationRevision].some((m) => m !== undefined);
     return {
         ...(carried ? { tool: { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget, hostTarget } } : {}),
         ...(targets !== undefined ? { targets } : {}),
+        ...(targetReads !== undefined ? { targetReads } : {}),
         ...(boundGrantDigest !== undefined ? { grants: boundGrantDigest } : {}),
     };
 }
-export function approvalTargetsOf(reading) {
+export function approvalTargetsOf(reading, reads) {
     const targets = {};
     for (const role of APPROVAL_TARGET_ROLES) {
         const view = reading?.[role];
         if (view?.kind === "path" && (view.canonical !== undefined || view.unread === true))
             targets[role] = view.canonical ?? null;
     }
-    return Object.keys(targets).length > 0 ? { targets } : {};
+    return { ...(Object.keys(targets).length > 0 ? { targets } : {}), ...(reads !== undefined ? { targetReads: Object.fromEntries(reads.map((r) => [r.key, r.landing])) } : {}) };
 }
 export const APPROVAL_STATION_MEMBERS = Object.freeze({
     claim: Object.freeze(["grants"]),
@@ -52,22 +53,48 @@ function judgeTool(row, live) {
     return { member: "tool", disposition: "veto", code: "resume.target_moved", message: vetoed(row.toolName, "the tool's face (its display family, or the path target or URL slot it declares) changed after the approval") };
 }
 function judgeTargets(row, live) {
-    const bound = row.targets;
-    if (bound === undefined || ("decided" in live && !licenseCovers(row.boundInputHash, live.decided)))
+    if ((row.targets === undefined && row.targetReads === undefined) || ("decided" in live && !licenseCovers(row.boundInputHash, live.decided)))
         return undefined;
-    const roles = typeof bound === "object" && bound !== null && !Array.isArray(bound) ? Object.entries(bound) : [];
-    const whole = roles.length > 0 && roles.every(([k, v]) => APPROVAL_TARGET_ROLES.includes(k) && (v === null || (typeof v === "string" && v.length > 0)));
-    if (!whole)
-        return { member: "targets", disposition: "veto", code: "resume.target_moved", message: vetoed(row.toolName, "the target member of the approval on its checkpoint row is damaged (not a reading → resolved location record)") };
-    const now = approvalTargetsOf(live.targetReading).targets ?? {};
-    const where = (p) => (p === null ? "did not resolve" : `resolved to ${shown(p)}`);
-    for (const [role, was] of roles) {
-        const is = now[role];
-        if (is === was)
-            continue;
-        return { member: "targets", disposition: "veto", code: "resume.target_moved", message: vetoed(row.toolName, is === undefined ? `where its target resolves (it ${where(was)} when the card was asked) could not be established on this leg` : `its target ${is === null ? "does not resolve" : `resolves to ${shown(is)}`} now and ${where(was)} when the card was asked`) };
+    const why = landedElsewhere(row.targets, row.targetReads, live);
+    return why === undefined ? undefined : { member: "targets", disposition: "veto", code: "resume.target_moved", message: vetoed(row.toolName, why) };
+}
+const DIGEST = /^[0-9a-f]{64}$/;
+function landedElsewhere(bound, boundReads, live) {
+    if (bound !== undefined) {
+        const roles = typeof bound === "object" && bound !== null && !Array.isArray(bound) ? Object.entries(bound) : [];
+        const whole = roles.length > 0 && roles.every(([k, v]) => APPROVAL_TARGET_ROLES.includes(k) && (v === null || (typeof v === "string" && v.length > 0)));
+        if (!whole)
+            return "the target member of the approval on its checkpoint row is damaged (not a reading → resolved location record)";
+        const now = approvalTargetsOf(live.targetReading).targets ?? {};
+        const where = (p) => (p === null ? "did not resolve" : `resolved to ${shown(p)}`);
+        for (const [role, was] of roles) {
+            const is = now[role];
+            if (is === was)
+                continue;
+            return is === undefined ? `where its target resolves (it ${where(was)} when the card was asked) could not be established on this leg` : `its target ${is === null ? "does not resolve" : `resolves to ${shown(is)}`} now and ${where(was)} when the card was asked`;
+        }
     }
-    return undefined;
+    if (boundReads === undefined)
+        return undefined;
+    const record = typeof boundReads === "object" && boundReads !== null && !Array.isArray(boundReads);
+    const reads = record ? Object.entries(boundReads) : [];
+    if (!record || !reads.every(([k, v]) => DIGEST.test(k) && typeof v === "string" && DIGEST.test(v)))
+        return "the read member of the approval on its checkpoint row is damaged (not a read → landing record)";
+    if (live.reads === undefined)
+        return `where its reads land (the read station judged ${reads.length} when the card was asked) could not be established on this leg`;
+    const was = new Map(reads);
+    const now = new Map(Object.entries(approvalTargetsOf(undefined, live.reads).targetReads ?? {}));
+    const named = (key) => live.reads?.find((r) => r.key === key);
+    const added = [...now.keys()].find((k) => !was.has(k));
+    if (added !== undefined || [...was.keys()].some((k) => !now.has(k)))
+        return `this leg reads the command differently than when the card was asked (${added !== undefined ? `${shown(named(added)?.raw ?? "?")} is read now at a place or in a form the card did not cover` : "a read the card covered is not read now"})`;
+    const movedKey = [...now.keys()].find((k) => now.get(k) !== was.get(k));
+    const moved = movedKey === undefined ? undefined : named(movedKey);
+    if (movedKey === undefined)
+        return undefined;
+    const targets = moved?.targets ?? [];
+    const at = targets.length === 0 ? "cannot be placed" : `lands on ${shown(targets[0])}${targets.length > 1 ? ` (and ${targets.length - 1} more)` : ""}`;
+    return `its read ${shown(moved?.raw ?? "?")} ${at} now, not where it landed when the card was asked`;
 }
 function judgeGrants(row, live, station) {
     const refusal = parkedSkillApprovalRefusal(row, live.args, live.skills ?? [], live.skillToolName ?? "", station);

package/dist/core/ask-origin.d.ts

@@ -25,6 +25,7 @@
  * the ask). Both stay where they are and are consumed beside the origin, not folded into it.
  */
 import type { PermissionResult } from "./tool-policy.js";
+import { type EngineAttestation } from "./engine-attestation.js";
 import type { ContainmentFace } from "../tools/fs/containment-face.js";
 /**
  * The closed set, in AUTHORITY order — the order {@link askOriginOf} resolves a fold in when several
@@ -93,6 +94,12 @@ export type AssertAllKeysHandled<T extends never> = T;
  *  itself. Every member is a plain boolean/word read ONCE by the gate, so the derivation is a pure
  *  function that a test can drive arm by arm. */
 export interface AskOriginFacts {
+    /** The call these facts are about — the one an engine record on the decision must be bound to for the derivation to read it
+     *  ({@link import("./engine-attestation.js").attestationOf}): a record handed back for another call reads as absent. */
+    readonly call: {
+        readonly toolCallId: string;
+        readonly toolName: string;
+    };
     /** The call is on the reserved question tool. */
     readonly contentQuestion: boolean;
     /** The call is marked unresolvable by an ancestor (see the gate's `isMarkedUnresolvable` seat). */
@@ -148,7 +155,7 @@ export declare function askOriginOf(decision: Extract<PermissionResult, {
  * word, so a site that stamped without it would be a second, quieter answer to one question.
  * The same stamp writes the ask's CLASS members (`askClass` / `classes`, {@link askClassMembersOf} over the
  * `classification` the caller derived from this decision under these facts): the word and the class leave the
- * gate on one object, and a value a policy put on either is replaced.
+ * gate on one object. No policy states either (the decision receipt refuses a stamp member).
  */
 export declare function stampAskOrigin<T extends Extract<PermissionResult, {
     action: "ask";
@@ -196,8 +203,8 @@ export type RuleOffersAbsence = (typeof RULE_OFFERS_ABSENCES)[number];
  * class row's `ruleMayClear` ({@link classifyAsk} — every door below is a class there), read once by the gate's allow layer.
  *  · `word` — the DISCLOSED reason ({@link RuleOffersAbsence}), first door wins, in the display order the card has always
  *    used (governance, the outranked allow, the hook, the ask rule, the two ancestor doors, then the marks). Display
- *    only. A structural door the offer factory owns (no lane wired, a tool it does not speak for, a
- *    task that cannot hold a rule) is decided BEFORE this and is deliberately silent;
+ *    only. The structural door the offer factory owns (no rule speaks for the call: no lane wired, a
+ *    task that cannot hold a rule, a call the lane does not judge) is decided BEFORE this and is deliberately silent;
  *  · `mandated` — the FACT the ask carries as its own member. Read off the whole mandate set, so which
  *    door is DISPLAYED cannot change it: an ask that is both outranked and mandated is mandated;
  *  · `mandate` — WHICH table word the bit stands on, only when the MARKS family is its whole reason (no
@@ -237,10 +244,14 @@ export interface RuleClearanceFacts {
     /** The ask is being resolved at an ANCESTOR's frozen approver (the three inherited-lane mint sites
      *  pass it literally) — this task's rule lane never adjudicates it. */
     ancestorResolved?: boolean;
-    /** The classes of the contributors the policy fold carried under this ask (see {@link import("./tool-policy.js").PermissionResult});
-     *  a member whose row no rule may clear keeps the question a person's. */
-    foldedAskClasses?: readonly AskClass[];
+    /** The classes of the contributors the policy fold carried under this ask — the decision's engine record's
+     *  ({@link EngineAttestation.foldedClasses}), filled in by the builder of these facts ({@link withFoldedOf}); a member whose row
+     *  no rule may clear keeps the question a person's. */
+    foldedClasses?: readonly AskClass[];
 }
+/** `facts` with the folded contributors' classes the decision's record carries for its call — the one way a builder of
+ *  {@link RuleClearanceFacts} fills them (a decision carries no such member: the record is their one carrier). */
+export declare function withFoldedOf<F extends RuleClearanceFacts>(facts: F, record: EngineAttestation | undefined): F;
 /** The ask FACE's mandate members — the bit and its table word, spread at the four mint stations and the
  *  park row. The stations hand it the SAME facts object they hand the rule-offer factory, so the card's word
  *  and these members are readings of one derivation and cannot drift. The tool SEAT is not re-judged here:
@@ -265,10 +276,11 @@ export declare function withProbeMandate<D extends Extract<PermissionResult, {
 }>>(decision: D, account: string | undefined): D;
 /** The clearance facts of an ask the engine did not construct (a policy's verdict), each member read ONCE into
  *  an engine-owned value — for a station that keeps the answer past its own side effects, where the verdict's
- *  accessors must not run again. The members a verdict may carry that narrow what may clear it. */
+ *  accessors must not run again. The members a verdict may carry that narrow what may clear it, and the folded classes its
+ *  record carries for `call`. */
 export declare function ownedClearanceFacts(d: Extract<PermissionResult, {
     action: "ask";
-}>): RuleClearanceFacts;
+}>, call: AskOriginFacts["call"]): RuleClearanceFacts;
 /**
  * Which origins IMPLY the `requiresRealApproval` bit, and WHERE that implication is verified — the
  * consistency table {@link askOriginOf} reads. An ask of a must-carry origin exists so that no automatic
@@ -813,16 +825,22 @@ export declare function askClassMembersOf(c: AskClassification): AskClassMembers
  *  first member in {@link ASK_CLASSES} order. The copy returned is fresh and frozen, never the caller's array. */
 export declare function screenAskClassMembers(askClass: unknown, classes: unknown): AskClassMembers | undefined;
 /**
- * The DECISION half of the class derivation — what ONE ask says about itself through its own members, read
- * per contributing ask at the policy fold so a member the fold does not copy (a guard mark, the unreadable-rule
- * fact) is not lost behind the ask that won the slot. The bare-bit rules are applied over THIS ask's own set:
- * `requiresRealApproval` with no explaining class is `policy_rra`; a self-declared `mandated` with no other
- * class is `operator_forced` (a deployment probe's own mandate, read conservatively). Returns the specific
- * classes only — an empty set is "nothing but hesitation", which the caller reads as `ordinary`.
+ * The OWN half of the class derivation — what ONE ask says about itself through its own members, and the integrity guards
+ * its engine record carries for its call (`record`, read by the caller through {@link attestationOf}): the guards are engine
+ * findings, never a member, so a policy cannot move a real-approval question into a guard's class. The bare-bit rules are
+ * applied over THIS ask's own set: `requiresRealApproval` with no explaining class is `policy_rra`; a self-declared
+ * `mandated` with no other class is `operator_forced` (a deployment probe's own mandate, read conservatively). Returns the
+ * specific classes only — an empty set is "nothing but hesitation", which the caller reads as `ordinary`.
  */
+export declare function ownAskClassesOf(d: Extract<PermissionResult, {
+    action: "ask";
+}>, record: EngineAttestation | undefined): Set<AskClass>;
+/** The DECISION's classes as the policy fold reads a contributing ask: its own ({@link ownAskClassesOf}) and the classes of the
+ *  asks a fold already collapsed into it ({@link EngineAttestation.foldedClasses}) — both off its record for `call`, so a
+ *  fact the fold does not copy is not lost behind the ask that won the slot. */
 export declare function decisionAskClassesOf(d: Extract<PermissionResult, {
     action: "ask";
-}>): Set<AskClass>;
+}>, call: AskOriginFacts["call"]): Set<AskClass>;
 /** Fold a class set onto one row: `bypassImmune` and `hookAskFloor` by OR (any immune member keeps the ask; any floored
  *  member floors a hook's ask), the three permissive switches by AND (one refusing member withholds the lane). An empty
  *  set is `ordinary`. The two faces the ask was raised under enter HERE and nowhere else, so every reader of the folded row
@@ -865,9 +883,36 @@ export declare function dontAskRefusalMessage(input: {
  *  asked (`approvalReach: "none"`), whatever is wired. Absent in the input reads as `absent` (the posture the function was
  *  written for). */
 export type HeadlessApproverSeat = "absent" | "unavailable" | "declared_none";
+/** The kinds of way out a refusal carries as DATA: `approver` — a person who can answer becomes reachable (the sentence's approver clause);
+ *  `permission_mode` — a mode that releases the ask with nobody answering it (`bypassPermissions`, unless the deployment's caps deny it:
+ *  a denied bypass folds to `default`). A host renders a kind or leaves it unrendered; the sentence a user reads never teaches the release. */
+export declare const APPROVAL_REMEDY_KINDS: readonly ["approver", "permission_mode"];
+export type ApprovalRemedyKind = (typeof APPROVAL_REMEDY_KINDS)[number];
+/** Membership test for {@link ApprovalRemedyKind} — the word rides a notice detail across process boundaries. */
+export declare function isApprovalRemedyKind(v: unknown): v is ApprovalRemedyKind;
+/** One way out, discriminated by `kind` ({@link APPROVAL_REMEDY_KINDS}). `permission_mode` names the mode (`value`: `bypassPermissions`, the one
+ *  mode that releases an ask a person did not answer) and where the release is disclosed (`disclosedOn`: the allowed disposition's `released`
+ *  member on the call's `tool_end.gate`) — the disclosure a host shows beside the offer. */
+export type ApprovalRemedy = {
+    readonly kind: "approver";
+} | {
+    readonly kind: "permission_mode";
+    readonly value: "bypassPermissions";
+    readonly disclosedOn: "gate.disposition.released";
+};
+/** One {@link ApprovalRemedy} read from `v`, as a fresh plain object holding only the fields its kind owns — or `undefined` when `v` is not exactly
+ *  one (a kind outside the closed set, a member missing, a member beyond the kind's own, any field inherited rather than own). Each field is read
+ *  once; the notice mint copies through this and refuses what it cannot read. */
+export declare function readApprovalRemedy(v: unknown): ApprovalRemedy | undefined;
+/** The headless remedy: `sentence` — the user-facing way out, which names the approver and never offers the bypass release — and `remedies` — every way out as data, the approver first. */
+export interface HeadlessApprovalRemedy {
+    readonly sentence: string;
+    readonly remedies: readonly ApprovalRemedy[];
+}
 /**
- * The ONE sentence a headless auto-deny (an ask that reached its final deny because no approver is wired) adds
- * after its refusal: the caller-side change that would have let this call run. Read off the effective mode, the
+ * The ONE answer a headless auto-deny (an ask that reached its final deny because no approver is wired) adds
+ * after its refusal: the caller-side change that would have let this call run, as a sentence (`sentence`) and as the
+ * ways out in data (`remedies`, {@link ApprovalRemedy}: the approver in every arm). Read off the effective mode, the
  * ask's folded class row and whether the call is a covered write (the mode write gate's own question):
  *  · a class no permission mode releases (`bypassImmune`) — only a person can answer it: wire an approver;
  *  · the plan mode's own question (`mode`) — leave plan (steer the mode, or approve the plan) or wire an approver;
@@ -875,11 +920,12 @@ export type HeadlessApproverSeat = "absent" | "unavailable" | "declared_none";
  *    directories through without asking;
  *  · the same ask under `acceptEdits` — the target lies outside the working directories: add its directory to
  *    `additionalDirectories`;
- *  · any other releasable ask — `bypassPermissions` releases it (disclosed on the call).
+ *  · any other releasable ask, and a tool that states no permission of its own — `bypassPermissions` releases it (disclosed on the call):
+ *    the sentence does not say so; `remedies` carries it as a `permission_mode` member for a host that chooses to offer it.
  * Every arm also names the approver, in the clause of the seat's own state ({@link HeadlessApproverSeat}): none wired ⇒
  * wire one; one wired that answered `unavailable` for this ask ⇒ make a person reachable through it (a wired approver is
  * never told to be wired); the run declared nobody can be asked ⇒ run it where a person can be, or park it. The refusal's tool text and the `delegation.ask_unresolvable` notice both carry this sentence —
- * they call this function, neither spells it.
+ * they call this function, neither spells it — and the notice carries `remedies` beside it.
  * Under `dontAsk` (the mode answers no ask: {@link dontAskRefusalMessage} carries this arm) the one question is whether an allow
  * rule may clear the ask — the folded row's `ruleMayClear`, the allow layer's own reading: yes ⇒ add an allow rule covering the
  * call, in the tool's rule shape (`ruleShape`, the caller's reading of the call's grammar — never a rule minted for the call), or
@@ -894,7 +940,7 @@ export declare function headlessApprovalRemedy(input: {
     };
     readonly approverSeat?: HeadlessApproverSeat;
     readonly ruleShape?: string;
-}): string;
+}): HeadlessApprovalRemedy;
 /** The reference implementation's sentence for a `cp` / `mv` the mode will not answer because it carries option
  *  words — the approval card's message under `acceptEdits` and the head of the headless remedy. */
 export declare function fileCommandOptionsSentence(program: "cp" | "mv"): string;