@sema-agent/core 7.8.0 → 7.9.0

package/dist/core/hooks.d.ts

@@ -1022,22 +1022,27 @@ export interface PersistedRuleHitRule {
     readonly dots?: readonly import("./permission-rule-model.js").RuleDot[];
 }
 /**
- * design/252 G-2, re-formed by design/375 (BREAKING) — the structured answer a persisted-rule lane
- * gives: the COVERAGE SET that admits the call. A single rule admitting the whole command is a
- * one-element set (the historical case); a compound admitted by the conjunction of per-segment rules
- * (design/375 §5.1) is the set of those rules, in segment order. `rules` is non-empty by contract —
- * an empty set covers nothing and is not a hit (the normalizer reads it as a clean negative).
+ * design/252 G-2, re-formed by design/375 and again by the three-behavior model (BREAKING) — the
+ * structured answer a persisted-rule lane gives: WHICH behavior spoke for the call, and the rule set it
+ * stands on. For an `allow` the set is the COVERAGE SET that admits the call — a single rule admitting
+ * the whole command is a one-element set (the historical case); a compound admitted by the conjunction
+ * of per-segment rules (design/375 §5.1) is the set of those rules, in segment order. For a `deny` or an
+ * `ask` the set is the one rule of that behavior that reaches the call (the lane's precedence walk —
+ * deny > ask > allow — already chose it). `rules` is non-empty by contract — an empty set covers nothing
+ * and is not a hit (the normalizer reads it as a clean negative).
  *
- * Why dots and not an id: a persisted allow rule HAS no scalar id — it is a (text, scope) group whose
+ * Why dots and not an id: a persisted rule HAS no scalar id — it is a (behavior, text, scope) group whose
  * identity is the set of add dots that redeemed it, and two concurrently approved records for one text
  * each carry their own. The set is the identity; a joined string would not be one.
  *
- * The pre-375 single-rule object shape (`{ rule, dots? }`) is NOT accepted: on this loosening seam an
- * unrecognized answer degrades to a clean negative (more asks), never to a match — the safe failure
- * shape for a lane that missed the same-window upgrade.
+ * The pre-375 single-rule object shape (`{ rule, dots? }`) and the pre-behavior `{ rules }` shape are
+ * NOT accepted: on this loosening seam an unrecognized answer degrades to a clean negative (more asks),
+ * never to a match — the safe failure shape for a lane that missed the same-window upgrade.
  */
 export interface PersistedRuleHit {
-    /** The coverage set — every rule the decision stands on. Non-empty. */
+    /** What the deciding rule(s) say about the call — the closed set's word. */
+    readonly behavior: import("./permission-rule-model.js").RuleBehavior;
+    /** The rule set the verdict stands on. Non-empty. */
     readonly rules: readonly PersistedRuleHitRule[];
 }
 /**
@@ -1065,8 +1070,9 @@ export interface PersistedRuleUnreadable {
 export interface PersistedRuleCoverage {
     readonly segmentCoverage: readonly import("./permission-rule-model.js").SegmentCoverage[];
 }
-/** Every shape a lane may answer with. A bare string stays valid and unchanged. */
-export type PersistedRuleAnswer = string | PersistedRuleHit | PersistedRuleCoverage | PersistedRuleUnreadable | undefined;
+/** Every shape a lane may answer with. The retired bare-string form (a single allow rule's text) is read
+ *  by the normalizer as a clean negative, like every other unrecognized shape. */
+export type PersistedRuleAnswer = PersistedRuleHit | PersistedRuleCoverage | PersistedRuleUnreadable | undefined;
 /** Inputs to the two-phase tool gate. `adjudicate`/`resolveAsk` are pre-bound to the task abort
  *  signal; when the caller also supplies {@link ToolGateInput.callSignal}, the Runner's closures
  *  additionally bind their waits to that per-call signal (`AbortSignal.any` of the two), so a turn
@@ -1404,15 +1410,27 @@ export interface ToolGateInput {
      */
     isMarkedUnresolvable?: (toolCallId: string) => boolean;
     /**
-     * design/179 — the persisted allow-rule lane. Present only when a deployment wired a rule store; absent
-     * it, this whole step does not exist and the gate's decision path is byte-identical to what it was.
+     * design/179 — the persisted-rule lane. Present only when a deployment wired a rule store; absent it,
+     * this whole step does not exist and the gate's decision path is byte-identical to what it was.
      *
-     * A persisted rule is the standing form of ONE recorded human approval, so it resolves the asks a real
-     * person saying "allow" would have resolved — and nothing else. It sits post-fold, at the entry of the
-     * `ask` branch, BEFORE the classifier and AFTER every tighten: earlier and a tighten would simply put
-     * the ask back; later and the classifier would already have spoken.
+     * The lane answers with the BEHAVIOR that spoke ({@link PersistedRuleHit}), and the gate consumes the
+     * three behaviors at two different places — the upstream arbiter's order, deny > ask > allow, across
+     * the person's own standing rules:
+     *  · a DENY row refuses the call outright, on EVERY decision (an allow from the policy fold included):
+     *    it is the person's own "never run this" (their settings' deny list, imported), the personal-store
+     *    sibling of an org deny, and it runs right after the org layer — nothing downstream re-opens it;
+     *  · an ASK row is the person's standing "ask me each time": it turns a surviving allow into an ask
+     *    and stamps `matchedAskRule` on it (the same marker an explicit `ask` permission rule stamps), so
+     *    the ask's origin is `ask_rule` — the auto-mode classifier never answers it and a persisted ALLOW
+     *    never clears it; on a call that is already an ask it stamps the marker and leaves the rest;
+     *  · an ALLOW row is the standing form of ONE recorded human approval, so it resolves the asks a real
+     *    person saying "allow" would have resolved — and nothing else. It sits post-fold, at the entry of
+     *    the `ask` branch, BEFORE the classifier and AFTER every tighten: earlier and a tighten would
+     *    simply put the ask back; later and the classifier would already have spoken.
      *
-     * Its consumption predicate is its own, not the classifier's blanket flip:
+     * The deny/ask arms tighten and take no conjunct but the two structural ones every lane shares (the
+     * engine's own content-ask tool is exempt; the lane must be wired). The ALLOW arm's consumption
+     * predicate is its own, not the classifier's blanket flip:
      *  · `requiresRealApproval` asks are never consumed — the two integrity gates are the floor, and the
      *    same flag is what a v2 organization-level ask will carry;
      *  · a PreToolUse hook's ask is never consumed — that is the deployment's own adjudication, and a rule
@@ -1441,19 +1459,26 @@ export interface ToolGateInput {
      * bullets above are what keep integrity/hook/mandated asks out of that set.
      */
     persistedRules?: {
-        /** The rule COVERAGE that admits this call, or `undefined`. Must not throw: a store that cannot
-         *  be read answers "no rule" and discloses on its own channel (fail-closed = more asks).
+        /** The lane's verdict for this call — a {@link PersistedRuleHit} naming the behavior that spoke and
+         *  the rule set it stands on, a coverage-carrying clean negative, an unreadable-store report, or
+         *  `undefined` (the store was READ and no rule speaks). Must not throw — and a store that cannot be
+         *  read answers `{ unreadable: true }`, NEVER `undefined`: the gate reads the unreadable report as
+         *  fail-closed (an allow tightens to a real-approval ask of origin `rule_store_unavailable`), while
+         *  `undefined` is a successful no-match that leaves an allow standing. An adapter that answers
+         *  `undefined` on a read failure silently disarms every deny/ask row it holds.
          *
-         *  TWO ACCEPTED SHAPES (design/252 G-2 / design/375 BREAKING): the canonical rule TEXT (a
-         *  single-rule hit with no identity), or a {@link PersistedRuleHit} carrying the coverage SET —
-         *  each member's canonical text plus its add DOTS. A single rule admitting the whole command is a
-         *  one-element set; a compound admitted by the per-segment conjunction (design/375 §5.1) is the
-         *  set of the covering rules. The dots are a rule's durable identity, and the text is not one (it
-         *  reaches a card sanitized and capped); a lane that can name them lets the shadowed-ask evidence
-         *  say WHICH stored rules matched rather than merely what they looked like. The retired pre-375
-         *  single-rule object shape (`{ rule, dots? }`) is read as a clean negative by the normalizer —
-         *  a stale lane degrades toward asking, never toward an allow. */
-        admits: (req: ToolCallRequest) => Promise<PersistedRuleAnswer>;
+         *  For an ALLOW the set is the COVERAGE SET — each member's canonical text plus its add DOTS. A
+         *  single rule admitting the whole command is a one-element set; a compound admitted by the
+         *  per-segment conjunction (design/375 §5.1) is the set of the covering rules. The dots are a rule's
+         *  durable identity, and the text is not one (it reaches a card sanitized and capped); a lane that
+         *  can name them lets the shadowed-ask evidence say WHICH stored rules matched rather than merely
+         *  what they looked like. The retired shapes — a bare rule TEXT, the pre-375 `{ rule, dots? }` object,
+         *  a `{ rules }` hit without its behavior — are read as a clean negative by the normalizer: a stale
+         *  lane degrades toward asking, never toward an allow. Consulted on EVERY decision (a deny/ask row
+         *  must be able to tighten an allow), so the lane pays one store read per call on the tools it
+         *  speaks for; the runner's lane hands the org layer's read to it, so a governed deployment still
+         *  pays one. */
+        adjudicate: (req: ToolCallRequest) => Promise<PersistedRuleAnswer>;
         /** Observation sink for an ask a rule coverage resolved — the allow-side disclosure. `rules` is
          *  the coverage set's canonical texts in reporting order (design/375: a conjunction names every
          *  rule the decision stands on). Never affects the outcome. */

package/dist/core/permission-rule-consent.d.ts

@@ -27,11 +27,14 @@
  * this by editing a file backend's file. That is the settings-file trust model, stated rather than
  * defended against: for a file backend, host = user, no more and no less.
  */
-import { type EditedRuleBreadthWarning, type UncoveredSegmentDetail, type RuleOffer, type RuleRejectCode, type RuleScope, type RuleDot } from "./permission-rule-model.js";
+import { type EditedRuleBreadthWarning, type UncoveredSegmentDetail, type RuleBehavior, type RuleOffer, type RuleRejectCode, type RuleScope, type RuleDot } from "./permission-rule-model.js";
 import type { RuleOwner } from "./permission-rule-store.js";
 import { type PermissionRuleStoreProvider } from "./permission-rule-provider.js";
-/** One candidate rule inside an approval record: the exact text and where it would apply. */
+/** One candidate rule inside an approval record: what it says (`behavior`), the exact text and where it
+ *  would apply. A card mints `allow` candidates only (a card is one person's yes); the settings import
+ *  carries all three behaviors, each entry under the list it was read from. */
 export interface RuleCandidate {
+    behavior: RuleBehavior;
     rule: string;
     scope: RuleScope;
 }
@@ -95,9 +98,10 @@ export interface RuleApprovalRecord {
      * as {@link StaleRuleApprovalRecord}. `3` (design/382 §3.5, B8/B7): the card batch's
      * `uncoveredDetail` seat became REQUIRED and `edited.warnings` became storable — a `schema: 2`
      * row is read back stale exactly like the pre-stamp rows before it (the short-lived-pending
-     * bargain, unchanged).
+     * bargain, unchanged). `4`: every candidate carries its `behavior` (the settings import now carries
+     * the deny/ask lists too) — a `schema: 3` row is stale by the same equality gate.
      */
-    schema: 3;
+    schema: 4;
     kind: RuleApprovalKind;
     state: "pending" | "approved" | "redeemed";
     candidates: RuleCandidate[];
@@ -167,7 +171,7 @@ export interface RuleApprovalRecord {
 }
 /**
  * design/375 §4.5 — the minimal ENVELOPE a store hands back for a durable row that predates the
- * CURRENT (`schema: 3`) record form. A typed read cannot honestly return such a row as a
+ * CURRENT (`schema: 4`) record form. A typed read cannot honestly return such a row as a
  * {@link RuleApprovalRecord}, and dropping it at the store layer would misreport "stale" as
  * corruption — so the store contract is this variant instead: `staleSchema: true` plus the
  * IDENTITY fields, which are spelled the same way in every version and therefore safe to read.
@@ -375,7 +379,7 @@ export declare function confirmRuleApproval(opts: {
 /** Why a confirmation did not land. A closed set so a host can branch (re-present, re-fetch, give up).
  *  The two `record_*` members past `record_not_found` are the durable-row gates (design/375 §4.5/§4.7),
  *  disclosed to the record's own owner only — a non-owner gets `record_not_found` for every row:
- *   - `"record_schema_stale"` — the record predates the current (`schema: 3`) form; the decision it carried
+ *   - `"record_schema_stale"` — the record predates the current (`schema: 4`) form; the decision it carried
  *     is void, and the recovery path is re-triggering the command for a fresh card (no
  *     compatibility read, no migration — `detail.message` says so);
  *   - `"record_malformed"` — the record's offer structure failed the read-side integrity checks
@@ -443,7 +447,7 @@ export type EditedRuleTextPrecheck = {
  * for a surface that wants to answer while the person is still typing instead of after a round trip.
  *
  * It is the SAME body the confirmation arm runs (`checkEditedRuleText`), which is the whole point: a
- * boundary that re-implements the check — or calls `parseAllowRuleText` directly — installs a SECOND,
+ * boundary that re-implements the check — or calls `parseRuleText` directly — installs a SECOND,
  * STRICTER judge that refuses spellings the edit face accepts (the muscle-memory `Bash(adb *)` form is
  * exactly such a case: the validator alone refuses it as a wildcard; the edit face normalizes it first).
  *
@@ -476,6 +480,7 @@ export declare function precheckEditedRuleText(text: string, command: string): E
  *  durable revision is reporting, not the landing's identity). */
 export type RedeemResult = {
     status: "redeemed";
+    behavior: RuleBehavior;
     rule: string;
     scope: RuleScope;
     dot: RuleDot;
@@ -547,29 +552,13 @@ export interface ImportPreview {
         layer: ImportedSettingsLayer;
         found: boolean;
     }>;
+    /** The two SETTINGS LAYERS this version does not read at all. The three permission lists of the layers it
+     *  does read — allow, deny AND ask — are all imported (each candidate carries its `behavior`), so there
+     *  is no longer a "left in place" count beside them: an entry that did not become a candidate is in
+     *  `skipped` with its reason. */
     uncovered: {
         flagSettings: "not-imported-v1";
         policySettings: "not-imported-v1";
-        /**
-         * The deny/ask buckets of the layers actually read: how many entries are SITTING THERE, across all
-         * layers, that this import deliberately leaves in place (they are the tightening direction and have
-         * their own channel — importing them through a loosening lane would be the wrong door).
-         *
-         * Always present, zero when the buckets are absent or empty: "this settings file has 14 deny entries
-         * we did not touch" and "there was nothing there" are different facts, and a key that appears only in
-         * the first case makes them indistinguishable for a reader who sees one preview. The count is of
-         * ENTRIES IN PLACE, not of a decision — nothing here is skipped-and-lost; `skipped` stays the list of
-         * allow-bucket entries that did not become candidates.
-         *
-         * A bucket that is PRESENT but not an array cannot be counted; it contributes 0 and is disclosed in
-         * `skipped` under the layer's path, so a zero is never the report for something unreadable. Same for
-         * a layer whose whole `permissions` member is not an object — every bucket in it reads as absent,
-         * which is exactly the shape that would otherwise report two clean zeros.
-         */
-        denyAskBuckets: {
-            deny: number;
-            ask: number;
-        };
     };
 }
 /**
@@ -591,6 +580,7 @@ export interface ImportPreview {
  */
 export type RedeemedBatchMember = {
     readonly candidateIndex: number;
+    readonly behavior: RuleBehavior;
     readonly rule: string;
     readonly scope: RuleScope;
     readonly status: "persisted" | "deduped";
@@ -598,22 +588,25 @@ export type RedeemedBatchMember = {
     readonly dot: RuleDot;
 } | {
     readonly candidateIndex: number;
+    readonly behavior: RuleBehavior;
     readonly rule: string;
     readonly scope: RuleScope;
     readonly status: "refused";
     readonly reason: string;
 };
 /**
- * Read the allow buckets of the user-editable settings layers and produce a preview plus a PENDING
- * approval record. Nothing is stored until someone confirms that record and the batch is redeemed.
- * A preview with zero importable candidates returns NO `approvalId` — there is nothing to confirm,
- * and the absence says so (design/375 §4.1).
+ * Read the THREE permission lists (allow, deny, ask) of the user-editable settings layers and produce a
+ * preview plus a PENDING approval record. Nothing is stored until someone confirms that record and the
+ * batch is redeemed. A preview with zero importable candidates returns NO `approvalId` — there is nothing
+ * to confirm, and the absence says so (design/375 §4.1).
  *
- * Only the allow bucket is IMPORTED. The deny/ask buckets are the tightening direction and have their own
- * channel; importing them through a loosening lane would be the wrong door. They are still COUNTED and
- * reported (`preview.uncovered.denyAskBuckets`): by-design-not-imported and unnoticed look identical to
- * the person confirming the batch, and only one of them is true here — the same reason the non-Bash allow
- * entries are disclosed rather than dropped silently.
+ * Every list is read through the ONE validator under its own behavior: a deny/ask entry takes the
+ * tightening floor (`Bash(node:*)` as a deny is a legitimately wide tightening and imports), an allow
+ * entry the allow floor. A content-form deny/ask so imported is the person's own standing instruction
+ * and adjudicates in the persisted-rule lane beside their allows — deny > ask > allow — instead of
+ * being escorted by a shell into a bare tool-name ask that widens `Bash(rm -r:*)` into "every Bash call
+ * asks". An entry that does not import (a spelling with no rule form, a tool the lane does not speak
+ * for, a non-string) is DISCLOSED in `skipped` with its reason and stays in the settings file.
  */
 export declare function prepareCcImport(opts: {
     layers: CcImportLayer[];

package/dist/core/permission-rule-consent.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { escapeForDisclosure, hasUnrenderableCharacters, parseAllowRuleText, ruleAdmitsCommand, ruleBreadthWarningsOf, segmentCoverageOf, suggestRulesForCommand, } from "./permission-rule-model.js";
+import { escapeForDisclosure, hasUnrenderableCharacters, parseRuleText, ruleAdmitsCommand, ruleBreadthWarningsOf, segmentCoverageOf, suggestRulesForCommand, RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, isRuleBehavior, } from "./permission-rule-model.js";
 import { effectiveOrThrow } from "./permission-rule-provider.js";
 import { errText, isValidConsentScope, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
 export class InMemoryRuleApprovalRecordStore {
@@ -8,7 +8,7 @@ export class InMemoryRuleApprovalRecordStore {
         const r = this.rows.get(id);
         if (r === undefined)
             return undefined;
-        if (r.schema !== 3) {
+        if (r.schema !== 4) {
             return {
                 staleSchema: true,
                 id: r.id,
@@ -122,6 +122,12 @@ function approvalRecordDamageOf(rec) {
             if (typeof cand !== "object" || cand === null || typeof cand.rule !== "string") {
                 return `offer ${at} references candidate ${member}, which is not a candidate row`;
             }
+            if (!isRuleBehavior(cand.behavior)) {
+                return `offer ${at} references candidate ${member}, whose behavior is not one of ${RULE_BEHAVIORS.join("/")}`;
+            }
+            if (rec.kind === "card" && cand.behavior !== "allow") {
+                return `card offer ${at} references candidate ${member}, a ${cand.behavior} rule — a card mints allow candidates only`;
+            }
             if (!isValidConsentScope(cand.scope)) {
                 return `offer ${at} references candidate ${member}, whose scope is not a consent-face scope (global, project, or session)`;
             }
@@ -198,10 +204,11 @@ function approvalRecordDamageOf(rec) {
 }
 export function ruleOffersOfRecord(rec) {
     const tripleOf = (index) => {
-        const text = rec.candidates[index]?.rule;
-        if (text === undefined)
+        const cand = rec.candidates[index];
+        const text = cand?.rule;
+        if (cand === undefined || text === undefined)
             throw new Error(`approval-record offer references candidate ${index}, which the record does not carry`);
-        const parsed = parseAllowRuleText(text);
+        const parsed = parseRuleText(text, cand.behavior);
         if ("reject" in parsed) {
             throw new Error(`approval-record candidate ${index} does not parse as a rule (${parsed.reject.code}) — refusing to render it as one`);
         }
@@ -318,7 +325,7 @@ export async function prepareCardApproval(opts) {
         if (claimedBy.has(text))
             throw new Error(`engine defect: rule "${text}" was minted into two offers on one card`);
         const index = candidates.length;
-        candidates.push({ rule: text, scope });
+        candidates.push({ behavior: "allow", rule: text, scope });
         claimedBy.set(text, index);
         return index;
     };
@@ -336,7 +343,7 @@ export async function prepareCardApproval(opts) {
     const record = {
         id: mintId(opts.deps, "rar"),
         ...recordIdentityOf(owner),
-        schema: 3,
+        schema: 4,
         kind: "card",
         state: "pending",
         rev: 0,
@@ -427,7 +434,7 @@ function normalizeEditedSpelling(text) {
     return `${head}(${body}:*)`;
 }
 function parseSubmittedSpelling(text) {
-    return parseAllowRuleText(normalizeEditedSpelling(text));
+    return parseRuleText(normalizeEditedSpelling(text), "allow");
 }
 function checkEditedRuleText(text, command) {
     const parsed = parseSubmittedSpelling(text);
@@ -514,7 +521,7 @@ async function confirmEditedCandidate(rec, edit, deps) {
         ...rec,
         rev: rec.rev + 1,
         state: "approved",
-        candidates: [...rec.candidates, { rule: checked.canonicalRule, scope }],
+        candidates: [...rec.candidates, { behavior: "allow", rule: checked.canonicalRule, scope }],
         offers: [...rec.offers, { kind: "single", candidate: index }],
         selectedOffer: rec.offers.length,
         edited: { index, text: edit.text, at: nowIso(deps), ...(checked.warnings !== undefined ? { warnings: checked.warnings.map((w) => w.code) } : {}) },
@@ -559,7 +566,8 @@ export async function redeemRuleTicket(opts) {
     if (!offerMembersOf(chosenOffer).includes(parsed.index)) {
         return { status: "refused", reason: "the ticket names an option the person did not choose" };
     }
-    const parsedRule = parseAllowRuleText(candidate.rule);
+    const siblingsOf = candidate.behavior === "allow" ? { rec, offer: chosenOffer, index: parsed.index } : undefined;
+    const parsedRule = parseRuleText(candidate.rule, candidate.behavior);
     if ("reject" in parsedRule)
         return { status: "refused", reason: `${parsedRule.reject.code}: ${parsedRule.reject.message}` };
     let store;
@@ -587,12 +595,29 @@ export async function redeemRuleTicket(opts) {
             const theirs = again === undefined || isStale(again) ? undefined : again.redeemedDots?.[parsed.index];
             if (theirs === undefined)
                 return { status: "refused", reason: "the approval record changed state concurrently" };
-            return await applyRedemption({ deps: opts.deps, owner: caller, candidate, parsedRule: parsedRule.rule, dot: theirs, recordId: rec.id, kind: rec.kind, replay: true });
+            return await applyRedemption({ deps: opts.deps, owner: caller, candidate, parsedRule: parsedRule.rule, dot: theirs, recordId: rec.id, kind: rec.kind, replay: true, ...(siblingsOf !== undefined ? { siblingsOf } : {}) });
         }
     }
-    return await applyRedemption({ deps: opts.deps, owner: caller, candidate, parsedRule: parsedRule.rule, dot, recordId: rec.id, kind: rec.kind, replay: known !== undefined });
+    return await applyRedemption({ deps: opts.deps, owner: caller, candidate, parsedRule: parsedRule.rule, dot, recordId: rec.id, kind: rec.kind, replay: known !== undefined, ...(siblingsOf !== undefined ? { siblingsOf } : {}) });
 }
 const REDEEM_MAX_ATTEMPTS = 8;
+async function tighteningSiblingsStand(rec, offer, index, store, durableSnapshot) {
+    for (const member of offerMembersOf(offer)) {
+        if (member === index)
+            continue;
+        const sibling = rec.candidates[member];
+        if (sibling === undefined || sibling.behavior === "allow")
+            continue;
+        const dot = rec.redeemedDots?.[member];
+        if (dot === undefined)
+            return false;
+        const view = sibling.scope.kind === "session" ? await effectiveOrThrow(store, { sessionId: sibling.scope.sessionId }) : durableSnapshot;
+        const live = view.rules.some((r) => r.behavior === sibling.behavior && r.rule === sibling.rule && sameScope(r.scope, sibling.scope) && r.adds.some((a) => a.dot.actor === dot.actor && a.dot.counter === dot.counter));
+        if (!live)
+            return false;
+    }
+    return true;
+}
 async function applyRedemption(args) {
     let store;
     try {
@@ -608,7 +633,14 @@ async function applyRedemption(args) {
     for (let attempt = 0; attempt < REDEEM_MAX_ATTEMPTS; attempt++) {
         let rev;
         try {
-            rev = (await effectiveOrThrow(store)).rev;
+            const snapshot = await effectiveOrThrow(store);
+            rev = snapshot.rev;
+            if (args.siblingsOf !== undefined && !(await tighteningSiblingsStand(args.siblingsOf.rec, args.siblingsOf.offer, args.siblingsOf.index, store, snapshot))) {
+                return {
+                    status: "refused",
+                    reason: "withheld: this allow belongs to a batch whose deny/ask members do not all stand in the store — an allow must not stand wider than the list that was confirmed; redeem the batch (redeemRuleBatch) so the tightening members land first, or draw a fresh card",
+                };
+            }
         }
         catch (err) {
             return { status: "refused", reason: `could not read the permission-rule store: ${errText(err)}` };
@@ -617,6 +649,7 @@ async function applyRedemption(args) {
         try {
             res = await writer.apply({
                 kind: "redemption-add",
+                behavior: args.parsedRule.behavior,
                 rule: args.parsedRule.rule,
                 scope: args.candidate.scope,
                 tool: args.parsedRule.tool,
@@ -639,7 +672,7 @@ async function applyRedemption(args) {
             };
         }
         if (!("conflict" in res)) {
-            return { status: "redeemed", rule: args.parsedRule.rule, scope: args.candidate.scope, dot: args.dot, rev: res.rev, alreadyRedeemed: args.replay };
+            return { status: "redeemed", behavior: args.parsedRule.behavior, rule: args.parsedRule.rule, scope: args.candidate.scope, dot: args.dot, rev: res.rev, alreadyRedeemed: args.replay };
         }
     }
     return { status: "refused", reason: `optimistic-concurrency retries exhausted after ${REDEEM_MAX_ATTEMPTS} attempts` };
@@ -654,7 +687,6 @@ export async function prepareCcImport(opts) {
     const skipped = [];
     const translated = [];
     const layers = [];
-    const denyAskBuckets = { deny: 0, ask: 0 };
     for (const layer of opts.layers) {
         let raw;
         try {
@@ -700,66 +732,55 @@ export async function prepareCcImport(opts) {
             });
             continue;
         }
-        for (const bucket of ["deny", "ask"]) {
-            const entries = permissions?.[bucket];
-            if (Array.isArray(entries))
-                denyAskBuckets[bucket] += entries.length;
-            else if (entries !== undefined && entries !== null) {
+        const scope = layer.layer === "userSettings" ? { kind: "global" } : { kind: "project", root: layer.root };
+        for (const behavior of RULE_BEHAVIORS) {
+            const entries = permissions?.[behavior];
+            if (entries === undefined || entries === null)
+                continue;
+            if (!Array.isArray(entries)) {
                 skipped.push({
                     rule: layer.path,
-                    reason: `settings ${bucket} bucket is not an array — its entries could not be counted for the not-imported report (it stays in the settings file either way)`,
+                    reason: `settings ${behavior} bucket is not an array — no entry in it could be read (it stays in the settings file either way)`,
                 });
-            }
-        }
-        const allow = permissions?.allow;
-        if (!Array.isArray(allow))
-            continue;
-        const scope = layer.layer === "userSettings" ? { kind: "global" } : { kind: "project", root: layer.root };
-        for (const entry of allow) {
-            if (typeof entry !== "string") {
-                skipped.push({ rule: String(entry), reason: "settings entry is not a string" });
                 continue;
             }
-            if (entry.startsWith("Read(")) {
-                const parsed = parseAllowRuleText(entry);
-                if ("reject" in parsed) {
+            for (const entry of entries) {
+                if (typeof entry !== "string") {
+                    skipped.push({ rule: String(entry), reason: `settings ${behavior} entry is not a string` });
+                    continue;
+                }
+                if (behavior === "allow" && entry.startsWith("Read(") && "reject" in parseRuleText(entry, behavior)) {
                     skipped.push({
                         rule: entry,
                         reason: "unsupported.form: only the Read(//abs-dir/**) directory form imports in v1 — this entry stays in the settings file, unimported",
                     });
                     continue;
                 }
-                if (!candidates.some((c) => c.rule === parsed.rule.rule && sameScope(c.scope, scope))) {
-                    candidates.push({ rule: parsed.rule.rule, scope });
-                }
-                continue;
-            }
-            if (!entry.startsWith("Bash(")) {
-                const reason = /^[A-Za-z][A-Za-z0-9_]*\(.*\)$/.test(entry)
-                    ? "unsupported.tool: only Bash(...) command rules and Read(//abs-dir/**) directory rules import in v1 — this entry stays in the settings file, unimported"
-                    : /^[A-Za-z][A-Za-z0-9_-]*$/.test(entry)
+                if (!/^[A-Za-z][A-Za-z0-9_]*\(.*\)$/.test(entry)) {
+                    const reason = /^[A-Za-z][A-Za-z0-9_-]*$/.test(entry)
                         ? "unsupported.form: a bare tool-name entry is a name-set item, not a command rule — it stays in the settings file, unimported"
                         : "unsupported.form: not a command rule spelling this version imports — it stays in the settings file, unimported";
-                skipped.push({ rule: entry, reason });
-                continue;
-            }
-            const parsed = parseAllowRuleText(entry);
-            if ("reject" in parsed) {
-                skipped.push({ rule: entry, reason: `${parsed.reject.code}: ${parsed.reject.message}` });
-                continue;
+                    skipped.push({ rule: entry, reason });
+                    continue;
+                }
+                const parsed = parseRuleText(entry, behavior);
+                if ("reject" in parsed) {
+                    skipped.push({ rule: entry, reason: `${parsed.reject.code}: ${parsed.reject.message}` });
+                    continue;
+                }
+                if (candidates.some((c) => c.behavior === behavior && c.rule === parsed.rule.rule && sameScope(c.scope, scope)))
+                    continue;
+                candidates.push({ behavior, rule: parsed.rule.rule, scope });
             }
-            if (candidates.some((c) => c.rule === parsed.rule.rule && sameScope(c.scope, scope)))
-                continue;
-            candidates.push({ rule: parsed.rule.rule, scope });
         }
     }
-    const preview = { candidates, skipped, translated, layers, uncovered: { ...IMPORT_UNCOVERED_LAYERS, denyAskBuckets } };
+    const preview = { candidates, skipped, translated, layers, uncovered: { ...IMPORT_UNCOVERED_LAYERS } };
     if (candidates.length === 0)
         return { preview };
     const record = {
         id: mintId(opts.deps, "rar"),
         ...recordIdentityOf(owner),
-        schema: 3,
+        schema: 4,
         kind: "import",
         state: "pending",
         rev: 0,
@@ -785,15 +806,15 @@ export async function prepareStarterBatch(opts) {
     const owner = resolveCallerOwner(opts.principal, opts.owner, "prepareStarterBatch");
     const candidates = [];
     for (const text of STARTER_RULES) {
-        const parsed = parseAllowRuleText(text);
+        const parsed = parseRuleText(text, "allow");
         if ("reject" in parsed)
             throw new Error(`starter rule "${text}" is not a valid rule: ${parsed.reject.message}`);
-        candidates.push({ rule: parsed.rule.rule, scope: { kind: "global" } });
+        candidates.push({ behavior: "allow", rule: parsed.rule.rule, scope: { kind: "global" } });
     }
     const record = {
         id: mintId(opts.deps, "rar"),
         ...recordIdentityOf(owner),
-        schema: 3,
+        schema: 4,
         kind: "starter",
         state: "pending",
         rev: 0,
@@ -833,18 +854,30 @@ export async function redeemRuleBatch(opts) {
     }
     const members = [];
     let rev = 0;
-    for (const candidateIndex of offerMembersOf(chosenOffer)) {
+    const ordered = [...offerMembersOf(chosenOffer)].sort((a, b) => {
+        const ra = RULE_BEHAVIOR_PRECEDENCE[rec.candidates[a].behavior];
+        const rb = RULE_BEHAVIOR_PRECEDENCE[rec.candidates[b].behavior];
+        return ra !== rb ? ra - rb : a - b;
+    });
+    let tighteningFailed;
+    for (const candidateIndex of ordered) {
         const candidate = rec.candidates[candidateIndex];
-        const row = { candidateIndex, rule: candidate.rule, scope: candidate.scope };
+        const row = { candidateIndex, behavior: candidate.behavior, rule: candidate.rule, scope: candidate.scope };
+        if (candidate.behavior === "allow" && tighteningFailed !== undefined) {
+            members.push({ ...row, status: "refused", reason: `withheld: candidate ${tighteningFailed} (a deny/ask member of this batch) did not land, and an allow must not stand wider than the list that was confirmed — redeem the batch again once the store accepts the tightening member` });
+            continue;
+        }
         let alreadyThere = false;
         {
             try {
                 const snap = await effectiveOrThrow(store, candidate.scope.kind === "session" ? { sessionId: candidate.scope.sessionId } : undefined);
                 rev = snap.rev;
-                alreadyThere = snap.rules.some((r) => r.rule === candidate.rule && sameScope(r.scope, candidate.scope));
+                alreadyThere = snap.rules.some((r) => r.behavior === candidate.behavior && r.rule === candidate.rule && sameScope(r.scope, candidate.scope));
             }
             catch (err) {
                 members.push({ ...row, status: "refused", reason: `could not read the permission-rule store: ${errText(err)}` });
+                if (candidate.behavior !== "allow")
+                    tighteningFailed ??= candidateIndex;
                 continue;
             }
         }
@@ -855,8 +888,25 @@ export async function redeemRuleBatch(opts) {
         });
         if (res.status === "refused") {
             members.push({ ...row, status: "refused", reason: res.reason });
+            if (candidate.behavior !== "allow")
+                tighteningFailed ??= candidateIndex;
             continue;
         }
+        if (candidate.behavior !== "allow") {
+            let live = false;
+            try {
+                const snap = await effectiveOrThrow(store, candidate.scope.kind === "session" ? { sessionId: candidate.scope.sessionId } : undefined);
+                live = snap.rules.some((r) => r.behavior === candidate.behavior && r.rule === candidate.rule && sameScope(r.scope, candidate.scope) && r.adds.some((a) => a.dot.actor === res.dot.actor && a.dot.counter === res.dot.counter));
+            }
+            catch {
+                live = false;
+            }
+            if (!live) {
+                members.push({ ...row, status: "refused", reason: `this ${candidate.behavior} member's redeemed dot ${res.dot.actor}#${res.dot.counter} is not live in the store (removed since it was redeemed) — a removed rule is not re-landed by replaying its record; a new consent is required` });
+                tighteningFailed ??= candidateIndex;
+                continue;
+            }
+        }
         rev = candidate.scope.kind === "session" ? Math.max(rev, res.rev) : res.rev;
         members.push({ ...row, status: alreadyThere ? "deduped" : "persisted", alreadyRedeemed: res.alreadyRedeemed, dot: res.dot });
     }