@sema-agent/core 7.7.0 → 7.9.0

package/dist/core/runner/prepare-safety-scan.js

@@ -1,5 +1,8 @@
 import { NAMESPACED_NAME_SHAPES } from "../protocol-table.js";
-import { HAND_TOOL_EFFECTS } from "../../tools/fs/index.js";
+import { engineCardTypes, handBandEffects } from "../tool-registry.js";
+import { TOOL_CONTRACT_MAX_CHARS, TOOL_WIRE_NAME_MAX_CHARS } from "../tool-face.js";
+import { callerCardIdOf, offendingResultCard, schemaKeyBoundProblem } from "../tool-roster.js";
+import { toolFaceProblem } from "./tool-face-overlay.js";
 import { OFFLOAD_TOOL_NAME } from "../tool-result-store.js";
 import { PRESENT_PLAN_TOOL_NAME, ENTER_PLAN_MODE_TOOL_NAME } from "../present-plan-tool.js";
 export function prepareSafetyScan(input) {
@@ -13,6 +16,49 @@ export function prepareSafetyScan(input) {
     const axisExplicitNegatives = new Map();
     const reversibilityProbes = new Map();
     for (const t of spec.tools ?? []) {
+        if (t.name.length > TOOL_WIRE_NAME_MAX_CHARS) {
+            const e = new Error(`Tool name "${t.name.slice(0, 40)}…" is invalid: ${t.name.length} characters, the roster's bound is ${TOOL_WIRE_NAME_MAX_CHARS}.`);
+            e.code = "config.tool_name_too_long";
+            throw e;
+        }
+        for (const alias of t.aliases ?? []) {
+            if (alias.length > TOOL_WIRE_NAME_MAX_CHARS) {
+                const e = new Error(`Tool alias "${alias.slice(0, 40)}…" (of "${t.name}") is invalid: ${alias.length} characters, the roster's bound is ${TOOL_WIRE_NAME_MAX_CHARS}.`);
+                e.code = "config.tool_name_too_long";
+                throw e;
+            }
+        }
+        if (t.contract !== undefined && (t.contract.contractId.length > TOOL_CONTRACT_MAX_CHARS || t.contract.implementationRevision.length > TOOL_CONTRACT_MAX_CHARS)) {
+            const e = new Error(`Tool "${t.name}" declares a contract member over ${TOOL_CONTRACT_MAX_CHARS} characters (contractId ${t.contract.contractId.length}, implementationRevision ${t.contract.implementationRevision.length}) — the roster's bound.`);
+            e.code = "config.tool_contract_too_long";
+            throw e;
+        }
+        {
+            const keyProblem = schemaKeyBoundProblem(t.parameters);
+            if (keyProblem !== undefined) {
+                const e = new Error(`Tool "${t.name}" cannot ride a roster row: ${keyProblem}.`);
+                e.code = "config.tool_schema_bound";
+                throw e;
+            }
+            const declared = {
+                ...(t.family !== undefined ? { family: t.family } : {}),
+                ...(t.pathTarget !== undefined ? { pathTarget: t.pathTarget } : {}),
+                ...(t.ruleFace !== undefined ? { ruleFace: t.ruleFace } : {}),
+                ...(t.renderHints !== undefined ? { renderHints: t.renderHints } : {}),
+            };
+            const faceProblem = toolFaceProblem(declared, t.parameters);
+            if (faceProblem !== undefined) {
+                const e = new Error(`Tool "${t.name}" declares a face its schema cannot carry: ${faceProblem}.`);
+                e.code = "config.tool_face_invalid";
+                throw e;
+            }
+            const foreignCard = offendingResultCard(t.renderHints, callerCardIdOf(t), engineCardTypes());
+            if (foreignCard !== undefined) {
+                const e = new Error(`Tool "${t.name}" declares a result card outside its own namespace: ${JSON.stringify(foreignCard)} (a caller card is "${callerCardIdOf(t)}/<card>"; engine cards and other contracts' namespaces are reserved).`);
+                e.code = "config.tool_face_invalid";
+                throw e;
+            }
+        }
         if (t.name.includes("__")) {
             const e = new Error(`Tool name "${t.name}" is invalid: "__" is reserved for the engine's protocol tool namespaces (${NAMESPACED_NAME_SHAPES}) and must not appear in a caller tool name.`);
             e.code = "config.tool_name_invalid";
@@ -65,7 +111,7 @@ export function prepareSafetyScan(input) {
     }
     toolEffects.set(OFFLOAD_TOOL_NAME, "read");
     if (deps.executionEnvFactory || deps.executionEnv) {
-        for (const [name, effect] of Object.entries(HAND_TOOL_EFFECTS))
+        for (const [name, effect] of handBandEffects())
             toolEffects.set(name, effect);
         if (spec.handsReadOnly === true)
             toolEffects.set("Bash", "read");

package/dist/core/runner/prepare-task.js

@@ -71,6 +71,10 @@ import { selfOrchestrationFailClosedReason } from "../../orchestration/workflow-
 import { remainingBudgetMicroUsd } from "../checkpoint-store.js";
 import { durableParkGapFor } from "../park-selfcheck.js";
 import { deliverEngineNotice } from "../types.js";
+import { ToolRosterDeltaSeat } from "../tool-roster.js";
+import { faceOf } from "../tool-roster.js";
+import { catalogEntriesNamed, pathTargetOf } from "../tool-registry.js";
+import { createStructuredProjector } from "./tool-output-projection.js";
 function warnCompactionWindowHazard(tracer, spec, model, compModel, hostTaskId) {
     if (compModel === undefined)
         return;
@@ -363,7 +367,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         let readDenyAdditionsNormalized = [];
         let handsLessResolvedFace;
         const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, autoModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDecider, autoModeDenialTracking: () => autoModeDenialTracking, autoModeArming: () => autoModeArming, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
-        const { tools, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDecider, autoModeDenialTracking, autoModeArming, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
+        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDecider, autoModeDenialTracking, autoModeArming, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
+        const tools = roster.tools;
         const pausedRef = {};
         const remoteEnvFailures = [];
         const suspendLoopRef = { hit: false };
@@ -419,12 +424,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 catch {
                 }
             }
-            tools.push(createOutputTool(outputRef, spec.outputSchema, compiled.strict ? compiled.modelSchema : undefined));
+            roster.mount(createOutputTool(outputRef, spec.outputSchema, compiled.strict ? compiled.modelSchema : undefined), { source: "synthetic", mountedBy: "optional" });
         }
-        const { mcp, a2a, rebuildHarnessToolsRef, contentOriginWrapRef, toolCallGateArmedRef } = await prepareProtocolTools({ lockedPreflight, spec, deps, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, tools, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, abortController, rollback });
+        const rosterSeat = new ToolRosterDeltaSeat();
+        const { mcp, a2a, rebuildHarnessToolsRef, contentOriginWrapRef, toolCallGateArmedRef } = await prepareProtocolTools({ lockedPreflight, spec, deps, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, abortController, rollback });
         const callIssuedAtRef = {};
         const memoryWriteGateRef = {};
-        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, firstPartyOffload, tools, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
+        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
         const handsReadFace = handsEnabled ? await prepareHandsMount(handsReadFaceInput) : resolveHandsLessReadFace(handsReadFaceInput);
         const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher, envHandToolNames, sealReadStateSeat } = handsReadFace;
         resolvedReadFace = handsReadFace.resolvedReadFace;
@@ -432,16 +438,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         handsLessResolvedFace = handsReadFace.handsLessResolvedFace;
         shellGatedBash = handsReadFace.shellGatedBash;
         shellGatedMonitor = handsReadFace.shellGatedMonitor;
-        const { worktreeSessionRef } = prepareDelegationSurface({ spec, deps, internals, resume, sessionId, hostTaskId, taskScope, taskRootFinal, executionEnv, runnerSelf, backgroundTaskToolsActive, workflowToolsActive, peerLaneActive, peerSendMessageBuiltIn, peerLaneRefs, tools, toolEffects, axisExplicitNegatives, envHandToolNames, toolFaceSnapshot, firstPartyOffload, offloadStore, subagentRetain, enrichSpecToolCtx, handsCwdRef, wsSnapshot, rebaseWsPath, rebaseRestoredPath, workspaceStateSettle });
-        const { checkpointStore, liveQuestionFace, contentAskBindings, contentAskRoutable, lateStrandedAnswers, discloseStrandedAnswers, settleContentAskBindings, durableQuestionFace, questionToolMounted, mountedQuestionTool } = prepareQuestionFace({ frozenOnQuestion, spec, deps, runtimeCaps, resolvedInteractionPosture, resume, sessionId, tools, inheritedUnavailableAsks: () => inheritedUnavailableAsks });
+        const { worktreeSessionRef } = prepareDelegationSurface({ spec, deps, internals, resume, sessionId, hostTaskId, taskScope, taskRootFinal, executionEnv, runnerSelf, backgroundTaskToolsActive, workflowToolsActive, peerLaneActive, peerSendMessageBuiltIn, peerLaneRefs, roster, toolEffects, axisExplicitNegatives, envHandToolNames, toolFaceSnapshot, firstPartyOffload, offloadStore, subagentRetain, enrichSpecToolCtx, handsCwdRef, wsSnapshot, rebaseWsPath, rebaseRestoredPath, workspaceStateSettle });
+        const { checkpointStore, liveQuestionFace, contentAskBindings, contentAskRoutable, lateStrandedAnswers, discloseStrandedAnswers, settleContentAskBindings, durableQuestionFace, questionToolMounted, mountedQuestionTool } = prepareQuestionFace({ frozenOnQuestion, spec, deps, runtimeCaps, resolvedInteractionPosture, resume, sessionId, roster, inheritedUnavailableAsks: () => inheritedUnavailableAsks });
         if (spec.handsReadOnly !== true) {
             const sessionScope = sessionId ?? spec.principal ?? spec.taskId ?? "default";
-            tools.push(...createSchedulerTools(executionEnv, {
+            roster.mountAll(createSchedulerTools(executionEnv, {
                 scope: sessionScope,
                 ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
                 ...(sessionId !== undefined ? { sessionId } : {}),
                 requestStopAfterTurn,
-            }).map((t) => (envHandToolNames.add(t.name), t)));
+            }).map((t) => (envHandToolNames.add(t.name), t)), { source: "builtin", mountedBy: "scheduler" });
         }
         if (internals?.insideFork !== true &&
             runnerSelf &&
@@ -451,7 +457,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             deps.onError?.(new Error(`Fork DENIED for principal "${spec.principal ?? ""}" by runtimeCaps.allowFork=false ` +
                 `(per-principal entitlement governance, not a misconfiguration — Agent(subagent_type:"fork") will refuse honestly)`), { phase: "config", sessionId });
         }
-        const { lspDiagnostics, nudgeLspOnEdit, lspRunIdent } = prepareLsp({ spec, deps, executionEnv, taskRootFinal, handsEnabled, sessionId, handsCwdRef, tools, envHandToolNames });
+        const { lspDiagnostics, nudgeLspOnEdit, lspRunIdent } = prepareLsp({ spec, deps, executionEnv, taskRootFinal, handsEnabled, sessionId, handsCwdRef, roster, envHandToolNames });
         const memoryPairNameDomain = new Set();
         for (const t of tools) {
             memoryPairNameDomain.add(t.name);
@@ -503,7 +509,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const effect = (t.effect ?? toolEffects.get(t.name) ?? "write");
                     if (effect === "read")
                         return false;
-                    if (t.name !== "Write" && t.name !== "Edit" && t.name !== "NotebookEdit" && t.name !== "Bash")
+                    const face = faceOf(t);
+                    const pt = face.pathTarget ?? pathTargetOf(t.name);
+                    const family = face.family ?? catalogEntriesNamed(t.name)[0]?.face.family;
+                    if (!((pt !== undefined && pt.access !== "read") || family === "shell"))
                         return false;
                     return !(handsEnabled && isRemoteExecutionEnv(executionEnv));
                 }),
@@ -551,13 +560,22 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
             }
         }
-        const projectContext = await prepareProjectContext({ deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillScope, tools, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume });
+        const projectContext = await prepareProjectContext({ deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillScope, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume });
         const { memoryBlock: memoryBlockWithProject, instructionSources, projectInstructionContent, hasSkillManifest, skillsListing, sharedMemoryPairMounted, memoryEnginePairMounted } = projectContext;
         const { provider, featureFlags, userSystemPrompt, userAppendSystemPrompt, mcpInstructionsBlock, envFacts, tzValid, userTz, gitStatusRef } = await preparePromptInputs({ spec, deps, failClosedReason: selfOrchestrationFailClosedReason(spec, deps), lockedPreflight, selfOrchestrationActive, executionEnv, reminderMark, resolvedReadFace, toolFaceSnapshot, promptProfile, fableMitigations, internals, thinking, ownedEnv, delegation, resolvedRole, mcp, model, externalContentTargetActive, resume, handsEnabled, taskRootFinal, additionalRootsCanonical, additionalReadRootsCanonical, sessionId });
-        const { deferred, memoryBlock } = prepareDeferClassify({ spec, deps, tools, toolFaceSnapshot, handsEnabled, fullShellReachable, promptProfile, model, mcp, a2a, sharedMemoryPairMounted, memoryEnginePairMounted, memoryBlock: memoryBlockWithProject, memoryRecallSegment, onceLedger, sessionId });
-        prepareMemoryEngineSession({ memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mcp, sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, tools, contentOriginWrapRef });
+        const { deferred, memoryBlock } = prepareDeferClassify({ spec, deps, roster, toolFaceSnapshot, handsEnabled, fullShellReachable, promptProfile, model, mcp, a2a, sharedMemoryPairMounted, memoryEnginePairMounted, memoryBlock: memoryBlockWithProject, memoryRecallSegment, onceLedger, sessionId });
+        prepareMemoryEngineSession({ memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mcp, sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef });
         const { systemPromptSeat, renderWithDate, systemBlocks, promptManifest, epochDeclaredSections, epochArtifactDigestForSnapshot, buildAssembleInputs, centerAdoptionRef } = await preparePromptAssembly({ session, deps, internals, resume, provider, userSystemPrompt, userAppendSystemPrompt, featureFlags, mcpInstructionsBlock, memoryBlock, envFacts, promptProfile, fableMitigations, tools, model, sessionId, reminderMark, onceLedger });
-        const { activeTools, fpRef, turnSnapshotRef, harnessTools, toolsDeltaRef, toolMaterializeStatic, deferDirectCall, staticFaceForRef, listingRideRef } = await prepareToolDisclosureMount({ spec, deps, session, resume, deferred, tools, onceLedger, mcp, promptManifest, offloadReachableToolsRef, contentOriginWrapRef, rebuildHarnessToolsRef, harnessRef });
+        const { activeTools, fpRef, turnSnapshotRef, harnessTools, toolsDeltaRef, toolMaterializeStatic, deferDirectCall, staticFaceForRef, listingRideRef, toolSearch } = await prepareToolDisclosureMount({ spec, deps, session, resume, deferred, tools, onceLedger, mcp, promptManifest, offloadReachableToolsRef, contentOriginWrapRef, rebuildHarnessToolsRef, harnessRef });
+        if (toolSearch !== undefined)
+            roster.mountEngineLane(toolSearch, { source: "builtin", mountedBy: "optional" });
+        const rosterFacts = { effects: toolEffects, egress: egressTools, irreversibilityTier, reversibilityProbes, deferred, trustedTools: new Set(spec.memory?.trustedTools ?? []) };
+        const toolRoster = roster.snapshot(rosterFacts);
+        rosterSeat.arm(toolRoster, () => roster.snapshot(rosterFacts));
+        const structuredProjector = createStructuredProjector({
+            declaredCards: toolRoster.entries.flatMap((e) => e.renderHints?.resultCards ?? []),
+            onUndeclared: (type) => deliverEngineNotice(deps.onNotice, { code: "config.tool_card_undeclared", message: `a tool minted a \`details.type\` card ${JSON.stringify(type)} its definition never declared — dropped from tool_end.structured (declare it on the definition's catalog row or the caller's renderHints.resultCards)`, detail: { type, sessionId, runId } }),
+        });
         const { agentListing, announcedListingsRef, dateChange } = prepareListings({ spec, tools, onceLedger, sessionId, toolFaceSnapshot, activeTools, resume, skillsListing, listingRideRef, renderWithDate, envFacts, tzValid, userTz });
         const lastBrainContextRef = {};
         const requestLossyRef = { current: false };
@@ -614,7 +632,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(spec.streamingToolExecution === true ? { streamingToolExecution: true } : {}),
             env: executionEnv,
             session,
-            tools: harnessTools,
+            tools: [...harnessTools],
             model,
             thinkingLevel: thinking ?? "off",
             systemPrompt: systemPromptSeat.current,
@@ -652,7 +670,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
         }
         const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, ownToolNames, shellGatedBash, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
-        const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation });
+        const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster });
         if (fileHistoryBoundary !== undefined) {
             harness.on("tool_call", async () => {
                 await fileHistoryBoundary.settle();
@@ -662,13 +680,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash });
         const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, inheritedParentConstraints, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, autoModeIntent, autoModeDecider, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
-        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedBash, shellGatedMonitor, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
-        prepareGateStations({ askLane, parkAsk, tools, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedBash, shellGatedMonitor, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash });
+        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedBash, shellGatedMonitor, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
+        prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedBash, shellGatedMonitor, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash });
         const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, requestLossyRef, trimPressureRef });
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
-        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, gateStopRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, gateStopRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         rollback.commit();
         const prepared = buildPrepared();
         preparedHolder.current = prepared;

package/dist/core/runner/prepare-tool-disclosure-mount.d.ts

@@ -36,7 +36,7 @@ export interface PrepareToolDisclosureMountInput {
     deferred: ReadonlySet<string>;
     /** borrowed-readonly — the run's shared roster (`Prepared.tools`): READ here — the registry build, the reserved-name
      *  check, the live resolution the placeholders and the static face perform at call time. Never written by this phase. */
-    tools: AgentTool[];
+    tools: readonly AgentTool[];
     /** borrowed-readonly — the once-per-session ledger's failed-server projection (current failures minus the pairs this
      *  session already announced). */
     onceLedger: {
@@ -87,7 +87,10 @@ export interface PrepareToolDisclosureMountResult {
     };
     /** owned — the list the harness is built from: the roster with placeholders in the deferred slots plus ToolSearch (or the
      *  roster itself when nothing is deferred). */
-    harnessTools: AgentTool[];
+    harnessTools: readonly AgentTool[];
+    /** owned — the ToolSearch instance the deferred arm appended to the harness list (absent when nothing is deferred): the
+     *  driver mounts it on the roster's ENGINE LANE so the roster carries every name the model can call. */
+    toolSearch?: AgentTool;
     /** owned — the boundary delta ref (`Prepared.toolsDeltaRef`), minted when anything is deferred OR a server failed. */
     toolsDeltaRef: Prepared["toolsDeltaRef"];
     /** owned — the effective strategy (`Prepared.toolMaterializeStatic`). */

package/dist/core/runner/prepare-tool-disclosure-mount.js

@@ -31,6 +31,7 @@ export async function prepareToolDisclosureMount(input) {
     const fpRef = {};
     const turnSnapshotRef = {};
     let harnessTools = tools;
+    let toolSearchMounted;
     const failedMcpServers = onceLedger.mcpFailuresToAnnounce(mcp.statuses);
     let toolsDeltaRef;
     let toolMaterializeStatic = false;
@@ -204,6 +205,7 @@ export async function prepareToolDisclosureMount(input) {
             serializeActivation,
         });
         harnessTools = buildToolList(activeTools);
+        toolSearchMounted = toolSearch;
     }
     else {
         rebuildHarnessToolsRef.current = async () => {
@@ -215,5 +217,5 @@ export async function prepareToolDisclosureMount(input) {
             turnSnapshotRef.current?.refreshTools(toolsToFingerprintInputs(list));
         };
     }
-    return { activeTools, fpRef, turnSnapshotRef, harnessTools, toolsDeltaRef, toolMaterializeStatic, deferDirectCall, staticFaceForRef, listingRideRef };
+    return { activeTools, fpRef, turnSnapshotRef, harnessTools, toolsDeltaRef, toolMaterializeStatic, deferDirectCall, staticFaceForRef, listingRideRef, ...(toolSearchMounted !== undefined ? { toolSearch: toolSearchMounted } : {}) };
 }

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -29,6 +29,7 @@ import { type OnAsk, type ToolPolicy } from "../tool-policy.js";
 import type { GateOutcome } from "../gate-outcome.js";
 import type { RunnerDeps, RuntimeCaps, TaskSpec, ToolEffect, ToolExecuteContext } from "../types.js";
 import { type UsageWindow } from "../usage-window-store.js";
+import type { ToolRoster } from "../tool-roster.js";
 import { type AutoModeArmReason, type WiringManifest, type WiringManifestMcpEntry } from "../wiring-manifest.js";
 import type { AnnounceOnceSink, Prepared, PrepareResume, RunInternals, UsageGovernance } from "./contracts.js";
 export interface PrepareWiringManifestInput {
@@ -102,6 +103,9 @@ export interface PrepareWiringManifestInput {
     sessions: SessionStore;
     /** borrowed-readonly — the model gate's per-leg read face, or undefined. */
     modelGateManifest: WiringManifest["modelGate"];
+    /** borrowed-readonly — the leg's minted tool roster (design/388): rides the manifest's `tools` section and is the
+     *  source of the hand band's write-capable names for the ungated-write warning (what actually MOUNTED). */
+    toolRoster: ToolRoster;
     /** borrowed-readonly — the arming outcome the caps phase minted (the manifest's auto-mode face). */
     autoModeArmReason: AutoModeArmReason;
     /** borrowed-readonly — the frozen preflight; only `mcp` (the declared servers the manifest face joins). */

package/dist/core/runner/prepare-wiring-manifest.js

@@ -1,5 +1,4 @@
 import { bindPeerLaneDrain } from "../../agents/peer-session-drain.js";
-import { HAND_TOOL_EFFECTS } from "../../tools/fs/index.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { createHookEnvCapabilities, mintHookInvocationIdentity } from "../hooks.js";
 import { isRemoteExecutionEnv, missingRestoreSurface } from "../remote-env.js";
@@ -109,14 +108,9 @@ function announceDurableGateUnavailable(args) {
     });
 }
 export function prepareWiringManifest(input) {
-    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation } = input;
+    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster } = input;
     const onAsk = spec.onAsk ?? deps.onAsk;
-    const handWriteTools = handsEnabled && spec.handsReadOnly !== true
-        ? Object.keys(HAND_TOOL_EFFECTS).filter((name) => {
-            const eff = HAND_TOOL_EFFECTS[name];
-            return eff === "write" || eff === "idempotent";
-        })
-        : [];
+    const handWriteTools = toolRoster.entries.filter((e) => e.mountedBy === "hands" && (e.effect === "write" || e.effect === "idempotent")).map((e) => e.name);
     const hasEffectAwareGate = Boolean(policyLayers.length > 0 || (hooks?.preToolUse !== undefined && !preToolUseObservational));
     const destructiveMcpUngated = mcp.tools.some((t) => !irreversibleTools.has(t.name) && !egressTools.has(t.name) && (toolEffects.get(t.name) ?? "write") !== "read");
     const firstPartyWriteUngated = (spec.tools ?? [])
@@ -207,6 +201,7 @@ export function prepareWiringManifest(input) {
         ...(modelGateManifest !== undefined ? { modelGate: modelGateManifest } : {}),
         autoMode: { armed: autoModeArmReason === "armed", reason: autoModeArmReason },
         mcp: mcpManifestEntries(lockedPreflight.mcp, mcp.statuses),
+        tools: toolRoster,
     });
     peerLaneRefs.askEffective = wiringManifest.ask.effective;
     if (peerLaneActive && internals?.onTaskNotification !== undefined) {

package/dist/core/runner/resume-admission.d.ts

@@ -0,0 +1,53 @@
+/**
+ * design/393 S3 — the resume ladder's ADMISSION rung (E1) and the wake's shaping (E2), verbatim from
+ * `Runner.resumeStream`: the outcome container's domain, the one-read snapshots of the caller's config and
+ * the trusted internals bag, the store resolution, the row read and its terminal-status confirm, the
+ * same-process parent-constraint re-supply, then the wake pre-ladder (gate purity, pendingAction purity,
+ * the message's persist-time validation) and the one read of the outcome discriminant and the signal slot.
+ *
+ * Async (two store reads); every refusal throws a typed `CheckpointError` pre-CAS. It ends by handing what it
+ * admitted to the rung after it (`next`) in its LAST continuation — no suspension point between the
+ * registry read and the wake pre-ladder's first read of the row — and returns what that rung returns.
+ * The same seat shape the tool gate's fold uses to enter its lanes (gate-fold.ts `afterFold`).
+ */
+import { type Checkpoint, type CheckpointStore, type CheckpointToken, type PendingSteerEntry, type ResumeOutcome } from "../checkpoint-store.js";
+import type { InheritedGate, ResumeTaskConfig, RunInternals, RunnerDepsSeat } from "./contracts.js";
+/** What the admission rung was called with. */
+export interface ResumeAdmissionInput<R> {
+    /** borrowed-readonly — the checkpoint token the caller is redeeming. */
+    token: CheckpointToken;
+    /** borrowed-readonly — the caller's outcome object, read exactly where the driver read it (the container test,
+     *  the discriminant once, the wake message once); never stored, never handed on as itself. */
+    outcome: ResumeOutcome;
+    /** borrowed-readonly — the caller's config bag; snapshotted ONCE here (own enumerable fields), the snapshot is what
+     *  every later rung and the resumed leg read. */
+    taskConfig: ResumeTaskConfig;
+    /** borrowed-readonly — the trusted run-internals bag as the caller supplied it; shallow-snapshotted here, the
+     *  snapshot (with the parked chain re-supplied when the registry holds it) is what the ladder reads. */
+    internals: RunInternals | undefined;
+    /** borrowed-readonly — the Runner's deployment deps, read LIVE through the Runner (the store resolution reads `checkpointStore`); the one home of why it is a
+     *  seat and not a captured object is {@link RunnerDepsSeat}. */
+    runner: RunnerDepsSeat;
+    /** borrowed-readonly — the Runner's same-process parked-constraint registry; read for this token (never written here). */
+    parentConstraintRegistry: ReadonlyMap<CheckpointToken, NonNullable<InheritedGate["parentConstraints"]>>;
+    /** borrowed-readonly — the rung after admission, entered in this rung's last continuation with what it admitted. */
+    next: (admitted: ResumeAdmissionResult) => Promise<R>;
+}
+/** What admission established — the constants every later rung reads. */
+export interface ResumeAdmissionResult {
+    /** The caller's config, snapshotted once (own enumerable fields). */
+    config: ResumeTaskConfig;
+    /** The trusted internals snapshot, with the parked parent chain re-supplied when this Runner spawned the leg. */
+    internals: RunInternals | undefined;
+    /** The checkpoint store the row lives in. */
+    store: CheckpointStore;
+    /** The pending row, read once; a non-pending snapshot was refused before this result existed. */
+    cp: Checkpoint;
+    /** The ONE read of the outcome's discriminant. */
+    outcomeGate: ResumeOutcome["gate"];
+    /** The ONE read of the config's signal slot (`.aborted` stays a live read on this object). */
+    resumeSignal: AbortSignal | undefined;
+    /** The validated wake message (wake outcomes that carried one), never the caller's object. */
+    wakeMessage: Omit<PendingSteerEntry, "seq"> | undefined;
+}
+export declare function resumeAdmission<R>(input: ResumeAdmissionInput<R>): Promise<R>;

package/dist/core/runner/resume-admission.js

@@ -0,0 +1,83 @@
+import { CheckpointError, readPendingSteerQueue, resolveCheckpointStore, validatePendingSteer } from "../checkpoint-store.js";
+import { describeSuppliedValue } from "./decide-continuation.js";
+export async function resumeAdmission(input) {
+    const { token, outcome, taskConfig, runner, parentConstraintRegistry } = input;
+    let internals = input.internals;
+    if (outcome === null || typeof outcome !== "object") {
+        throw new CheckpointError("checkpoint.invalid_outcome", `resume outcome must be an object naming its gate (got ${outcome === null ? "null" : typeof outcome})`);
+    }
+    const config = typeof taskConfig === "object" && taskConfig !== null ? { ...taskConfig } : taskConfig;
+    internals = internals !== undefined ? { ...internals } : undefined;
+    const store = resolveCheckpointStore(config, runner.deps);
+    if (!store) {
+        throw new CheckpointError("checkpoint.not_found", "no CheckpointStore wired — cannot resume (set RunnerDeps.checkpointStore or taskConfig.checkpointStore)");
+    }
+    let cp = await store.get(token);
+    if (!cp) {
+        throw new CheckpointError("checkpoint.not_found", "no checkpoint found for the supplied token");
+    }
+    if (cp.status !== "pending") {
+        const live = await store.get(token);
+        if (live?.status === "pending") {
+            throw new CheckpointError("checkpoint.reopened_concurrently", "checkpoint changed concurrently (a resolve/reopen cycle landed between this resume's read of the row and its state check) — nothing was validated or executed; re-resume against the current state");
+        }
+        throw new CheckpointError("checkpoint.already_resolved", `checkpoint is ${describeSuppliedValue(live?.status ?? cp.status)} — the token is consumed, so this resume was neither validated nor executed (idempotent); a different outcome cannot redeem it`);
+    }
+    if ((internals?.inheritedGate?.parentConstraints?.length ?? 0) === 0) {
+        const parked = parentConstraintRegistry.get(token);
+        if (parked !== undefined) {
+            internals = {
+                ...(internals ?? {}),
+                inheritedGate: { ...(internals?.inheritedGate ?? {}), parentConstraints: parked },
+            };
+        }
+    }
+    let wakeMessage;
+    const outcomeGate = outcome.gate;
+    const resumeSignal = config.signal;
+    let suppliedMessage;
+    if (outcomeGate === "wake") {
+        suppliedMessage = outcome.message;
+        const gk = cp.gate.kind;
+        const decideEntry = gk === "human" || gk === "irreversible_ask"
+            ? 'a `policy_ask` outcome (decision allow/deny bound to the pending tool call)'
+            : gk === "needs_review"
+                ? 'a `dry_run_review` outcome (decision approve/reject)'
+                : gk === "plan_review"
+                    ? 'a `plan_review` outcome (decision approve/edit/reject)'
+                    : gk === "resource_limit"
+                        ? 'a `resource_limit` outcome (decision "continue")'
+                        : undefined;
+        if (gk !== "task_done") {
+            throw new CheckpointError("wake.gate_pending", `cannot wake: this checkpoint awaits a pending gate decision (gate "${gk}") — wake is not a decision ` +
+                `channel; resume it with ${decideEntry ?? "its own gate outcome"} instead`);
+        }
+        const pa = cp.pendingAction;
+        switch (pa.kind) {
+            case "task_done":
+                break;
+            case "tool_approval":
+            case "resource_limit":
+            case "review":
+            case "plan_review": {
+                throw new CheckpointError("wake.gate_pending", `cannot wake: this checkpoint still carries a pending gate-typed action (pendingAction "${pa.kind}" ` +
+                    `on a "${gk}" gate — inconsistent row) — wake is not a decision channel; resolve it through its ` +
+                    `own decide entry instead`);
+            }
+            default: {
+                const _exhaustive = pa;
+                void _exhaustive;
+                throw new CheckpointError("wake.gate_pending", `cannot wake: this checkpoint carries an unrecognized pendingAction kind "${pa.kind}" ` +
+                    `(newer-version row?) — fail-closed: wake only serves a pure park (pendingAction "task_done")`);
+            }
+        }
+        if (suppliedMessage !== undefined) {
+            wakeMessage = validatePendingSteer(suppliedMessage);
+        }
+        else if (readPendingSteerQueue(cp.state).length === 0) {
+            throw new CheckpointError("wake.nothing_to_deliver", "cannot wake: no message was supplied and the checkpoint holds no parked pendingSteer — an empty " +
+                "wake would burn the checkpoint on a blank continuation; supply `message` or park a steer first");
+        }
+    }
+    return await input.next({ config, internals, store, cp, outcomeGate, resumeSignal, wakeMessage });
+}

package/dist/core/runner/resume-apply.d.ts

@@ -0,0 +1,50 @@
+import { type Checkpoint, type PendingSteerEntry, type ResumeOutcome } from "../checkpoint-store.js";
+import type { ResumeRun, ResumeTaskConfig, RunInternals, RunnerDepsSeat } from "./contracts.js";
+export interface ResumeApplyInput<R> {
+    /** borrowed-readonly — the pending row (session id, pending call, inherited chain, ledger, hands cwd). */
+    cp: Checkpoint;
+    /** borrowed-readonly — the config snapshot (`hooks`, `taskId`, `signal`, the policy seats). */
+    config: ResumeTaskConfig;
+    /** borrowed-readonly — the internals snapshot (delegation identity facts for the screen's envelope). */
+    internals: RunInternals | undefined;
+    /** borrowed-readonly — the ONE read of the outcome discriminant. */
+    outcomeGate: ResumeOutcome["gate"];
+    /** borrowed-readonly — the validated wake message the screen judges. */
+    wakeMessage: Omit<PendingSteerEntry, "seq"> | undefined;
+    /** borrowed-readonly — the ONE signal read from admission; the screen and the edit legs are bounded by it. */
+    resumeSignal: AbortSignal | undefined;
+    /** borrowed-readonly — the window verdict to re-assert after the screen's await (undefined when unarmed). */
+    recheckGovernanceWindow: (() => Promise<void>) | undefined;
+    /** borrowed-readonly — the approval lane's twin (its edit is what the rechecks judge; the settlement is minted onto a copy). */
+    plainPolicyOutcome: Extract<ResumeOutcome, {
+        gate: "policy_ask";
+    }> | undefined;
+    /** borrowed-readonly — the review lane's twin. */
+    plainReviewOutcome: Extract<ResumeOutcome, {
+        gate: "plan_review" | "dry_run_review";
+    }> | undefined;
+    /** borrowed-readonly — the tool-less park lanes' twin. */
+    plainParkOutcome: Extract<ResumeOutcome, {
+        gate: "wake" | "resource_limit";
+    }> | undefined;
+    /** borrowed-readonly — the Runner's deployment deps, read LIVE through the Runner (reads `hooks`, `onError`, `lockedConfig`, `basePolicyForResumeEdit`, `toolPolicy` — the last three AFTER this rung's awaits); the one home of why it is a
+     *  seat and not a captured object is {@link RunnerDepsSeat}. */
+    runner: RunnerDepsSeat;
+    /** borrowed-readonly — the orchestrator's delegation-facts fold (a lane may not name the orchestrator; the driver hands it in). */
+    effectiveDelegationFacts: (internals: Pick<RunInternals, "isDelegatedChild" | "insideFork"> | undefined, seedIsDelegatedChild: boolean | undefined) => {
+        isDelegatedChild: boolean;
+    };
+    /** borrowed-readonly — the rung after apply, entered in this rung's last continuation. */
+    next: (applied: ResumeApplyResult) => Promise<R>;
+}
+export interface ResumeApplyResult {
+    /** The screen's `additionalContext` for the wake message, when a screen ran and supplied one. */
+    wakeHookContext: string | undefined;
+    /** The approval lane's twin WITH its minted settlement record (undefined on every other lane). */
+    plainPolicyOutcome: Extract<ResumeOutcome, {
+        gate: "policy_ask";
+    }> | undefined;
+    /** The twin the store persists and the resumed leg reads — exactly one lane captured it. */
+    outcomeForStore: ResumeRun["outcome"];
+}
+export declare function resumeApply<R>(input: ResumeApplyInput<R>): Promise<R>;