@sema-agent/core 7.8.0 → 7.9.1

package/dist/core/gate-lanes.js

@@ -2,7 +2,9 @@ import { decisionText, describeThrown } from "./tool-policy.js";
 import { askOriginOf, classifierMayAnswer } from "./ask-origin.js";
 import { denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
+import { isRuleBehavior } from "./permission-rule-model.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
+import { applyPersistedTightening, disclosedRuleSet } from "./persisted-rule-arms.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 import { exitGate, traceHookCrash } from "./runner/gate-exit.js";
 function isPlainOwnRecord(x) {
@@ -68,7 +70,9 @@ export function normalizeOrgGateVerdict(answer, unreadable) {
     const rule = ownDataValue(verdict, "rule");
     if ((behavior !== "deny" && behavior !== "ask") || typeof rule !== "string")
         return clean({ status: "unavailable", disclosures: [unreadable] });
-    return clean({ status: "available", verdict: clean({ behavior: behavior, rule }), ...revisionCell });
+    const reason = ownDataValue(verdict, "unreadable");
+    const unreadableCell = behavior === "ask" && typeof reason === "string" ? { unreadable: reason } : {};
+    return clean({ status: "available", verdict: clean({ behavior: behavior, rule, ...unreadableCell }), ...revisionCell });
 }
 function copiedUsableDots(dots) {
     let copied;
@@ -89,12 +93,12 @@ function copiedUsableDots(dots) {
     return usable ? { dots: copied } : {};
 }
 export function normalizePersistedRuleHit(hit) {
-    if (typeof hit === "string")
-        return { hit: { rules: [{ rule: hit }] } };
     if (!isPlainOwnRecord(hit))
         return {};
-    if (ownDataValue(hit, "unreadable") === true)
-        return { unreadable: true };
+    if (ownDataValue(hit, "unreadable") === true) {
+        const reason = ownDataValue(hit, "reason");
+        return typeof reason === "string" ? { unreadable: true, reason } : { unreadable: true };
+    }
     const rulesRaw = ownDataValue(hit, "rules");
     if (rulesRaw === undefined) {
         const coverageRaw = ownDataValue(hit, "segmentCoverage");
@@ -132,7 +136,10 @@ export function normalizePersistedRuleHit(hit) {
         return {};
     if (!members.every((m) => typeof m.rule === "string"))
         return {};
-    return { hit: { rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })) } };
+    const behavior = ownDataValue(hit, "behavior");
+    if (!isRuleBehavior(behavior))
+        return {};
+    return { hit: { behavior, rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })) } };
 }
 export function persistedRuleMandateOf(marks) {
     return marks.probeMandated === true
@@ -153,10 +160,11 @@ function parkWith(suspendAsk, parkArgs, carry) {
 export async function runGateLanes(pass) {
     const { input, toolName, toolCallId, callSignal, ledger, notifier, screening, adjudicate, resolveAsk, suspendAsk } = pass;
     let orgRealApprovalRequired = false;
-    const askOriginFacts = (org) => ({
+    const askOriginFacts = (org, ruleStore) => ({
         contentQuestion: toolName === ASK_USER_QUESTION_TOOL_NAME,
         markedUnresolvable: input.isMarkedUnresolvable?.(input.event.toolCallId) === true,
         org,
+        ...(ruleStore !== undefined ? { ruleStore } : {}),
         tightened: pass.tightenedBy,
     });
     let orgTightenCount = 0;
@@ -215,7 +223,7 @@ export async function runGateLanes(pass) {
             orgEvidence = { ...revisionCell, ruleAbsent: "no_match" };
             return { decision: decided, org: undefined };
         }
-        const { behavior, rule } = answer.verdict;
+        const { behavior, rule, unreadable } = answer.verdict;
         orgEvidence = { ...revisionCell, rule };
         if (behavior === "deny") {
             orgTightenCount += 1;
@@ -231,7 +239,9 @@ export async function runGateLanes(pass) {
                 ? { ...decided, requiresRealApproval: true }
                 : {
                     action: "ask",
-                    message: `an organization policy rule (${rule}) requires approval for this call`,
+                    message: unreadable !== undefined
+                        ? `an organization policy rule (${rule}) may reach this call, which could not be read against it (${unreadable}) — a person must decide`
+                        : `an organization policy rule (${rule}) requires approval for this call`,
                     decisionReason: ORG_RULE_DECISION_REASON,
                     requiresRealApproval: true,
                 },
@@ -240,6 +250,24 @@ export async function runGateLanes(pass) {
     };
     const orgAnswer = await applyOrgLayer(pass.decision, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput);
     pass.decision = orgAnswer.decision;
+    const readPersistedRules = async (req) => {
+        let pendingHit;
+        try {
+            pendingHit = Promise.resolve(input.persistedRules?.adjudicate(req));
+        }
+        catch {
+            return { unreadable: true };
+        }
+        return await settleOrgVerdictWithin(pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true })), { unreadable: true }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
+    };
+    const laneReq = { ...pass.req, ...(pass.policyRewrite !== undefined ? { args: pass.policyRewrite } : {}) };
+    const laneAnswer = input.persistedRules !== undefined && pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME ? await readPersistedRules(laneReq) : undefined;
+    {
+        const tightened = applyPersistedTightening(pass.decision, laneAnswer);
+        pass.decision = tightened.decision;
+        if (tightened.tightened === "deny")
+            pass.deniedBy = "persisted_rule";
+    }
     if (pass.decision.action === "ask") {
         if (pass.policyRewrite !== undefined) {
             pass.currentInput = pass.policyRewrite;
@@ -252,6 +280,8 @@ export async function runGateLanes(pass) {
             probeMandated: pass.decision.action === "ask" && pass.decision.probeMandated === true,
         });
         let personalEvidence = { dotsAbsent: input.persistedRules === undefined ? "not_wired" : "not_adjudicated" };
+        if (laneAnswer?.unreadable === true)
+            personalEvidence = { dotsAbsent: "unavailable" };
         let laneCoverage;
         if (input.persistedRules &&
             !orgRealApprovalRequired &&
@@ -260,24 +290,10 @@ export async function runGateLanes(pass) {
             pass.decision.decisionReason !== "hook" &&
             pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true) {
-            const answer = await (async () => {
-                let pendingHit;
-                try {
-                    pendingHit = Promise.resolve(input.persistedRules?.admits(pass.req));
-                }
-                catch {
-                    return { unreadable: true };
-                }
-                return await settleOrgVerdictWithin(pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true })), { unreadable: true }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
-            })();
-            const hitRules = answer.hit?.rules;
+            const answer = laneAnswer ?? {};
+            const hitRules = answer.hit?.behavior === "allow" ? answer.hit.rules : undefined;
             laneCoverage = answer.coverage;
             personalEvidence = { dotsAbsent: answer.unreadable === true ? "unavailable" : "no_match" };
-            const disclosedRuleSet = (rules) => {
-                const shown = rules.slice(0, 5).map((r) => inlineUntrusted(r.rule, 200));
-                const rest = rules.length - shown.length;
-                return rest > 0 ? `${shown.join(", ")} and ${rest} more` : shown.join(", ");
-            };
             const unionDotsOf = (rules) => {
                 const seen = new Set();
                 const union = [];
@@ -294,6 +310,8 @@ export async function runGateLanes(pass) {
                 }
                 return { dots: union };
             };
+            if (answer.hit?.behavior === "ask")
+                personalEvidence = unionDotsOf(answer.hit.rules);
             if (hitRules !== undefined && persistedRuleMandate === undefined && pass.decision.matchedAskRule === undefined) {
                 pass.decision = {
                     action: "allow",
@@ -324,7 +342,7 @@ export async function runGateLanes(pass) {
                 };
             }
         }
-        const originFacts = askOriginFacts(orgAnswer.org);
+        const originFacts = askOriginFacts(orgAnswer.org, laneAnswer?.unreadable === true ? "unavailable" : undefined);
         if (pass.decision.action === "ask") {
             const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
             pass.decision = { ...stamped, origin: askOriginOf(stamped, originFacts) };
@@ -374,6 +392,7 @@ export async function runGateLanes(pass) {
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true &&
             pass.decision.requiresRealApproval !== true &&
             pass.decision.decisionReason !== "hook" &&
+            pass.decision.origin !== "ask_rule" &&
             pass.hookAsk === undefined &&
             input.egress !== true &&
             input.peerMessage !== true &&
@@ -543,7 +562,7 @@ export async function runGateLanes(pass) {
                             }
                         }
                     }
-                    if (!adjudicate && input.orgRules === undefined)
+                    if (!adjudicate && input.orgRules === undefined && input.persistedRules === undefined)
                         break;
                     let recheck = { action: "allow" };
                     if (adjudicate) {
@@ -576,6 +595,19 @@ export async function runGateLanes(pass) {
                         editDenied = recheck;
                         break;
                     }
+                    let editRuleStore;
+                    if (input.persistedRules !== undefined && toolName !== ASK_USER_QUESTION_TOOL_NAME) {
+                        const editLane = await readPersistedRules({ toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
+                        editRuleStore = editLane.unreadable === true ? "unavailable" : undefined;
+                        const editTightened = applyPersistedTightening(recheck, editLane);
+                        recheck = editTightened.decision;
+                        if (editTightened.tightened === "deny")
+                            pass.deniedBy = "persisted_rule";
+                        if (recheck.action === "deny") {
+                            editDenied = recheck;
+                            break;
+                        }
+                    }
                     if (recheck.action === "allow") {
                         if (recheck.updatedInput !== undefined) {
                             editArgs = recheck.updatedInput;
@@ -588,7 +620,7 @@ export async function runGateLanes(pass) {
                         editRewrittenSinceHuman = true;
                     }
                     const editAskSnapshot = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
-                    const editAskDecision = { ...editAskSnapshot, origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org)) };
+                    const editAskDecision = { ...editAskSnapshot, origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org, editRuleStore)) };
                     const editAskReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
                     const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     ledger.fromResolved(rr, editAskDecision, toolName);

package/dist/core/gate-outcome.d.ts

@@ -129,18 +129,22 @@ export type SettlementRefusalTableCoversEveryKind = AssertAllKeysHandled<Exclude
  *  - `ask_resolution` — the ask's own settlement is the refusal (a person said no, a window elapsed,
  *    nobody could be asked…); the detail is on {@link GateOutcome.settlement}.
  */
-export declare const DENIED_BY_VALUES: readonly ["policy", "hook", "org", "classifier", "plan_mode", "compliance", "write_protection", "ask_resolution"];
+export declare const DENIED_BY_VALUES: readonly ["policy", "hook", "org", "persisted_rule", "classifier", "plan_mode", "compliance", "write_protection", "ask_resolution"];
 export type DeniedBy = (typeof DENIED_BY_VALUES)[number];
 /** Membership test for {@link DeniedBy}. */
 export declare function isDeniedBy(v: unknown): v is DeniedBy;
 /** Which layers may VETO an approval a person already gave (invariant I3: a `human_allowed` settlement
- *  beside a `denied` disposition names one of these). The approval-edit re-screen (hook), the policy and
- *  org re-checks, and the write-protection re-judge run AFTER the person's yes; the classifier, plan mode
- *  and compliance run before any ask exists, and `ask_resolution` IS the settlement, not a veto of it. */
+ *  beside a `denied` disposition names one of these). The approval-edit re-screen (hook), the policy, org
+ *  and persisted-rule re-checks, and the write-protection re-judge run AFTER the person's yes; the
+ *  classifier, plan mode and compliance run before any ask exists, and `ask_resolution` IS the
+ *  settlement, not a veto of it. `persisted_rule` = a person's own standing DENY row (their settings'
+ *  deny list, imported) — the personal-store sibling of `org`, and like it re-judged on an edited
+ *  command. */
 export declare const DENIED_BY_MAY_VETO: {
     readonly policy: true;
     readonly hook: true;
     readonly org: true;
+    readonly persisted_rule: true;
     readonly classifier: false;
     readonly plan_mode: false;
     readonly compliance: false;

package/dist/core/gate-outcome.js

@@ -31,7 +31,7 @@ export const SETTLEMENT_IS_REFUSAL = {
     blanket_allow_refused: true,
     task_aborted: true,
 };
-export const DENIED_BY_VALUES = ["policy", "hook", "org", "classifier", "plan_mode", "compliance", "write_protection", "ask_resolution"];
+export const DENIED_BY_VALUES = ["policy", "hook", "org", "persisted_rule", "classifier", "plan_mode", "compliance", "write_protection", "ask_resolution"];
 const DENIED_BY_SET = new Set(DENIED_BY_VALUES);
 export function isDeniedBy(v) {
     return DENIED_BY_SET.has(v);
@@ -40,6 +40,7 @@ export const DENIED_BY_MAY_VETO = {
     policy: true,
     hook: true,
     org: true,
+    persisted_rule: true,
     classifier: false,
     plan_mode: false,
     compliance: false,

package/dist/core/governance-codes.d.ts

@@ -103,7 +103,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -113,6 +113,7 @@ export const ENGINE_NOTICE_CODES = [
     "classifier.denial_limit",
     "checkpoint.execution_outcome_unrecorded",
     "delegation.transcript_integrity",
+    "mcp.injection_dropped",
     "mcp.revocation_probe_failed",
     "workflow.governance_key_stripped",
     "workflow.agent_option_ignored",
@@ -177,6 +178,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "peer.idle_subscription": "user",
     "delegation.transcript_integrity": "operator",
     "checkpoint.execution_outcome_unrecorded": "operator",
+    "mcp.injection_dropped": "user",
     "mcp.revocation_probe_failed": "operator",
     "workflow.governance_key_stripped": "operator",
     "workflow.agent_option_ignored": "operator",

package/dist/core/hooks.d.ts

@@ -993,10 +993,13 @@ export interface ParkAttemptFailed {
  */
 export type OrgGateVerdict = {
     status: "available";
-    /** The org rule that speaks for this call, if any. Deny outranks ask; there is no allow bucket. */
+    /** The org rule that speaks for this call, if any. Deny outranks ask; there is no allow bucket. An
+     *  `unreadable` member (the lexer's reason) says the call could not be READ against `rule` — an
+     *  org rule that may reach it — so `behavior` is `ask` and the message names the reason. */
     verdict?: {
         behavior: "deny" | "ask";
         rule: string;
+        unreadable?: string;
     };
     /** design/252 G-2 (additive): the REVISION of the snapshot this answer was read off — the
      *  published-policy version an auditor reconciles the resulting decision against. Present on the
@@ -1022,22 +1025,27 @@ export interface PersistedRuleHitRule {
     readonly dots?: readonly import("./permission-rule-model.js").RuleDot[];
 }
 /**
- * design/252 G-2, re-formed by design/375 (BREAKING) — the structured answer a persisted-rule lane
- * gives: the COVERAGE SET that admits the call. A single rule admitting the whole command is a
- * one-element set (the historical case); a compound admitted by the conjunction of per-segment rules
- * (design/375 §5.1) is the set of those rules, in segment order. `rules` is non-empty by contract —
- * an empty set covers nothing and is not a hit (the normalizer reads it as a clean negative).
+ * design/252 G-2, re-formed by design/375 and again by the three-behavior model (BREAKING) — the
+ * structured answer a persisted-rule lane gives: WHICH behavior spoke for the call, and the rule set it
+ * stands on. For an `allow` the set is the COVERAGE SET that admits the call — a single rule admitting
+ * the whole command is a one-element set (the historical case); a compound admitted by the conjunction
+ * of per-segment rules (design/375 §5.1) is the set of those rules, in segment order. For a `deny` or an
+ * `ask` the set is the one rule of that behavior that reaches the call (the lane's precedence walk —
+ * deny > ask > allow — already chose it). `rules` is non-empty by contract — an empty set covers nothing
+ * and is not a hit (the normalizer reads it as a clean negative).
  *
- * Why dots and not an id: a persisted allow rule HAS no scalar id — it is a (text, scope) group whose
+ * Why dots and not an id: a persisted rule HAS no scalar id — it is a (behavior, text, scope) group whose
  * identity is the set of add dots that redeemed it, and two concurrently approved records for one text
  * each carry their own. The set is the identity; a joined string would not be one.
  *
- * The pre-375 single-rule object shape (`{ rule, dots? }`) is NOT accepted: on this loosening seam an
- * unrecognized answer degrades to a clean negative (more asks), never to a match — the safe failure
- * shape for a lane that missed the same-window upgrade.
+ * The pre-375 single-rule object shape (`{ rule, dots? }`) and the pre-behavior `{ rules }` shape are
+ * NOT accepted: on this loosening seam an unrecognized answer degrades to a clean negative (more asks),
+ * never to a match — the safe failure shape for a lane that missed the same-window upgrade.
  */
 export interface PersistedRuleHit {
-    /** The coverage set — every rule the decision stands on. Non-empty. */
+    /** What the deciding rule(s) say about the call — the closed set's word. */
+    readonly behavior: import("./permission-rule-model.js").RuleBehavior;
+    /** The rule set the verdict stands on. Non-empty. */
     readonly rules: readonly PersistedRuleHitRule[];
 }
 /**
@@ -1052,6 +1060,12 @@ export interface PersistedRuleHit {
  */
 export interface PersistedRuleUnreadable {
     readonly unreadable: true;
+    /** WHY the lane could not read: absent for a store read failure; for a call the lane could not READ
+     *  against the person's standing deny/ask rows (an expansion where a rule reads a word, an unterminated
+     *  quote, a syntax error — `programRunReachOf`'s `unreadable` word), the lexer's reason. The DECISION
+     *  is the same fail-closed one either way (the question "does one of my rules forbid this?" is
+     *  unanswered); the reason is what the ask's message says instead of "the store could not be read". */
+    readonly reason?: string;
 }
 /**
  * design/375 §5.2② — the CLEAN NEGATIVE that still carries the per-segment coverage table: no rule
@@ -1065,8 +1079,9 @@ export interface PersistedRuleUnreadable {
 export interface PersistedRuleCoverage {
     readonly segmentCoverage: readonly import("./permission-rule-model.js").SegmentCoverage[];
 }
-/** Every shape a lane may answer with. A bare string stays valid and unchanged. */
-export type PersistedRuleAnswer = string | PersistedRuleHit | PersistedRuleCoverage | PersistedRuleUnreadable | undefined;
+/** Every shape a lane may answer with. The retired bare-string form (a single allow rule's text) is read
+ *  by the normalizer as a clean negative, like every other unrecognized shape. */
+export type PersistedRuleAnswer = PersistedRuleHit | PersistedRuleCoverage | PersistedRuleUnreadable | undefined;
 /** Inputs to the two-phase tool gate. `adjudicate`/`resolveAsk` are pre-bound to the task abort
  *  signal; when the caller also supplies {@link ToolGateInput.callSignal}, the Runner's closures
  *  additionally bind their waits to that per-call signal (`AbortSignal.any` of the two), so a turn
@@ -1404,15 +1419,27 @@ export interface ToolGateInput {
      */
     isMarkedUnresolvable?: (toolCallId: string) => boolean;
     /**
-     * design/179 — the persisted allow-rule lane. Present only when a deployment wired a rule store; absent
-     * it, this whole step does not exist and the gate's decision path is byte-identical to what it was.
+     * design/179 — the persisted-rule lane. Present only when a deployment wired a rule store; absent it,
+     * this whole step does not exist and the gate's decision path is byte-identical to what it was.
      *
-     * A persisted rule is the standing form of ONE recorded human approval, so it resolves the asks a real
-     * person saying "allow" would have resolved — and nothing else. It sits post-fold, at the entry of the
-     * `ask` branch, BEFORE the classifier and AFTER every tighten: earlier and a tighten would simply put
-     * the ask back; later and the classifier would already have spoken.
+     * The lane answers with the BEHAVIOR that spoke ({@link PersistedRuleHit}), and the gate consumes the
+     * three behaviors at two different places — the upstream arbiter's order, deny > ask > allow, across
+     * the person's own standing rules:
+     *  · a DENY row refuses the call outright, on EVERY decision (an allow from the policy fold included):
+     *    it is the person's own "never run this" (their settings' deny list, imported), the personal-store
+     *    sibling of an org deny, and it runs right after the org layer — nothing downstream re-opens it;
+     *  · an ASK row is the person's standing "ask me each time": it turns a surviving allow into an ask
+     *    and stamps `matchedAskRule` on it (the same marker an explicit `ask` permission rule stamps), so
+     *    the ask's origin is `ask_rule` — the auto-mode classifier never answers it and a persisted ALLOW
+     *    never clears it; on a call that is already an ask it stamps the marker and leaves the rest;
+     *  · an ALLOW row is the standing form of ONE recorded human approval, so it resolves the asks a real
+     *    person saying "allow" would have resolved — and nothing else. It sits post-fold, at the entry of
+     *    the `ask` branch, BEFORE the classifier and AFTER every tighten: earlier and a tighten would
+     *    simply put the ask back; later and the classifier would already have spoken.
      *
-     * Its consumption predicate is its own, not the classifier's blanket flip:
+     * The deny/ask arms tighten and take no conjunct but the two structural ones every lane shares (the
+     * engine's own content-ask tool is exempt; the lane must be wired). The ALLOW arm's consumption
+     * predicate is its own, not the classifier's blanket flip:
      *  · `requiresRealApproval` asks are never consumed — the two integrity gates are the floor, and the
      *    same flag is what a v2 organization-level ask will carry;
      *  · a PreToolUse hook's ask is never consumed — that is the deployment's own adjudication, and a rule
@@ -1441,19 +1468,26 @@ export interface ToolGateInput {
      * bullets above are what keep integrity/hook/mandated asks out of that set.
      */
     persistedRules?: {
-        /** The rule COVERAGE that admits this call, or `undefined`. Must not throw: a store that cannot
-         *  be read answers "no rule" and discloses on its own channel (fail-closed = more asks).
+        /** The lane's verdict for this call — a {@link PersistedRuleHit} naming the behavior that spoke and
+         *  the rule set it stands on, a coverage-carrying clean negative, an unreadable-store report, or
+         *  `undefined` (the store was READ and no rule speaks). Must not throw — and a store that cannot be
+         *  read answers `{ unreadable: true }`, NEVER `undefined`: the gate reads the unreadable report as
+         *  fail-closed (an allow tightens to a real-approval ask of origin `rule_store_unavailable`), while
+         *  `undefined` is a successful no-match that leaves an allow standing. An adapter that answers
+         *  `undefined` on a read failure silently disarms every deny/ask row it holds.
          *
-         *  TWO ACCEPTED SHAPES (design/252 G-2 / design/375 BREAKING): the canonical rule TEXT (a
-         *  single-rule hit with no identity), or a {@link PersistedRuleHit} carrying the coverage SET —
-         *  each member's canonical text plus its add DOTS. A single rule admitting the whole command is a
-         *  one-element set; a compound admitted by the per-segment conjunction (design/375 §5.1) is the
-         *  set of the covering rules. The dots are a rule's durable identity, and the text is not one (it
-         *  reaches a card sanitized and capped); a lane that can name them lets the shadowed-ask evidence
-         *  say WHICH stored rules matched rather than merely what they looked like. The retired pre-375
-         *  single-rule object shape (`{ rule, dots? }`) is read as a clean negative by the normalizer —
-         *  a stale lane degrades toward asking, never toward an allow. */
-        admits: (req: ToolCallRequest) => Promise<PersistedRuleAnswer>;
+         *  For an ALLOW the set is the COVERAGE SET — each member's canonical text plus its add DOTS. A
+         *  single rule admitting the whole command is a one-element set; a compound admitted by the
+         *  per-segment conjunction (design/375 §5.1) is the set of the covering rules. The dots are a rule's
+         *  durable identity, and the text is not one (it reaches a card sanitized and capped); a lane that
+         *  can name them lets the shadowed-ask evidence say WHICH stored rules matched rather than merely
+         *  what they looked like. The retired shapes — a bare rule TEXT, the pre-375 `{ rule, dots? }` object,
+         *  a `{ rules }` hit without its behavior — are read as a clean negative by the normalizer: a stale
+         *  lane degrades toward asking, never toward an allow. Consulted on EVERY decision (a deny/ask row
+         *  must be able to tighten an allow), so the lane pays one store read per call on the tools it
+         *  speaks for; the runner's lane hands the org layer's read to it, so a governed deployment still
+         *  pays one. */
+        adjudicate: (req: ToolCallRequest) => Promise<PersistedRuleAnswer>;
         /** Observation sink for an ask a rule coverage resolved — the allow-side disclosure. `rules` is
          *  the coverage set's canonical texts in reporting order (design/375: a conjunction names every
          *  rule the decision stands on). Never affects the outcome. */

package/dist/core/mcp-injection-drop.d.ts

@@ -0,0 +1,74 @@
+/**
+ * `mcp.injection_dropped` — the one mint of the notice a host raises when an entry of the user's own
+ * MCP injection (a `.mcp.json` row handed to the engine through the host's request lane) was NOT
+ * mounted for the leg. L-167: three drop sites in the host's intake and one cap site each produced
+ * their own wording and none reached the user; the engine did not see the entry at all (it never
+ * reached `prepareTask`), so no core-side notice could stand for it.
+ *
+ * Division of labour, the settlement pattern (`settlement.single_mint`): the HOST supplies FACTS
+ * (which session, which server name, which of four reasons, optionally which field was bad) and
+ * CORE composes the notice — the code word, the audience row, the message text per reason. A host
+ * never spells the code or the text itself: a second wording is a second source that drifts, and a
+ * host-spelled code is not in {@link import("./governance-codes.js").ENGINE_NOTICE_CODES}'s
+ * mint scan, so its audience row could silently rot.
+ *
+ * Audience `"user"`: the dropped entry is the user's own configuration and the recovery (rename the
+ * server, fix the field, trim the list) is in their hands — an operator channel does not reach them.
+ * `sessionId` is therefore REQUIRED at the mint (the routing half of a user row: a user disclosure
+ * that cannot name its session has nowhere to be delivered) — a host with no session has no user to
+ * tell and must not mint. Dedup unit: per leg per server name — the HOST's obligation (it owns the
+ * leg's intake loop); this module is pure.
+ */
+import type { AssertAllKeysHandled } from "./ask-origin.js";
+import type { EngineNotice } from "./engine-notice.js";
+/**
+ * The closed set of drop reasons ({@link McpInjectionDropFacts.reason}) — the host's intake
+ * enumerates exactly these, and a consumer rendering the notice keys on the word:
+ *  · `malformed_entry`              — the entry did not parse as a server declaration (a missing
+ *                                     `command`/`url`, a `toolFaces` value of the wrong shape, …);
+ *                                     `field` names the offending key when the host knows it;
+ *  · `name_reserved_by_deployment`  — the entry's server name collides with one the deployment
+ *                                     itself mounts, and the deployment's wins;
+ *  · `gate_closed`                  — the deployment does not accept request-lane MCP injection on
+ *                                     this leg at all (a multi-tenant posture): the whole list is
+ *                                     ignored, one notice per entry;
+ *  · `over_cap`                     — the entry sits beyond the deployment's injection cap.
+ */
+export declare const MCP_INJECTION_DROP_REASONS: readonly ["malformed_entry", "name_reserved_by_deployment", "gate_closed", "over_cap"];
+export type McpInjectionDropReason = (typeof MCP_INJECTION_DROP_REASONS)[number];
+/**
+ * The user-facing sentence per reason — the disposition table over {@link MCP_INJECTION_DROP_REASONS}
+ * (one reason, one wording; a consumer that wants its own phrasing keys on `detail.reason`, never on
+ * this text). Each names the recovery, because the reader is the person who can perform it.
+ */
+export declare const MCP_INJECTION_DROP_TEXT: {
+    readonly malformed_entry: "its declaration could not be read — fix the entry and start a new session";
+    readonly name_reserved_by_deployment: "the deployment mounts a server of that name and its own wins — rename the entry";
+    readonly gate_closed: "this deployment does not accept MCP servers from the request on this leg — ask the operator, or use the deployment's servers";
+    readonly over_cap: "the request named more MCP servers than this deployment mounts per leg — trim the list";
+};
+export type DropTextCoversEveryReason = AssertAllKeysHandled<Exclude<McpInjectionDropReason, keyof typeof MCP_INJECTION_DROP_TEXT>>;
+/** What a host knows at the drop site — facts only, no words of the engine's vocabulary composed. */
+export interface McpInjectionDropFacts {
+    /** The session whose injection carried the entry — the notice's routing key, required (see module note). */
+    readonly sessionId: string;
+    /** The entry's server name as the user spelled it (the message quotes it verbatim). */
+    readonly server: string;
+    readonly reason: McpInjectionDropReason;
+    /** `malformed_entry` only, optional: the key the host found bad, so the user knows what to edit. */
+    readonly field?: string;
+}
+/**
+ * Compose the `mcp.injection_dropped` notice from a host's facts.
+ *
+ * @contract mcp.injection_dropped.single_mint — the `mcp.injection_dropped` notice is composed by CORE
+ * from a host's drop FACTS (session, server name, one of four reasons, optionally the bad field); a
+ * host never spells the code, the audience or the sentence, and a fact outside the vocabulary (an
+ * unlisted reason word, an empty session or server name) is refused at the mint with a `TypeError`
+ * rather than shaped into a notice that would route nowhere or read as an unknown word downstream.
+ *
+ * `detail: { sessionId, server, reason, field? }` — `sessionId` is lifted onto the typed key by
+ * {@link import("./engine-notice.js").deliverEngineNotice}, the one throat, so the two spellings
+ * cannot disagree; `field` is present only when the host supplied a non-empty one.
+ */
+export declare function mcpInjectionDroppedNotice(facts: McpInjectionDropFacts): EngineNotice;

package/dist/core/mcp-injection-drop.js

@@ -0,0 +1,27 @@
+export const MCP_INJECTION_DROP_REASONS = ["malformed_entry", "name_reserved_by_deployment", "gate_closed", "over_cap"];
+export const MCP_INJECTION_DROP_TEXT = {
+    malformed_entry: "its declaration could not be read — fix the entry and start a new session",
+    name_reserved_by_deployment: "the deployment mounts a server of that name and its own wins — rename the entry",
+    gate_closed: "this deployment does not accept MCP servers from the request on this leg — ask the operator, or use the deployment's servers",
+    over_cap: "the request named more MCP servers than this deployment mounts per leg — trim the list",
+};
+const isReason = (x) => typeof x === "string" && MCP_INJECTION_DROP_REASONS.includes(x);
+export function mcpInjectionDroppedNotice(facts) {
+    const { sessionId, server, reason, field } = facts;
+    if (typeof sessionId !== "string" || sessionId.length === 0) {
+        throw new TypeError("mcp.injection_dropped: sessionId is required — a user-audience notice with no session routes nowhere");
+    }
+    if (typeof server !== "string" || server.length === 0) {
+        throw new TypeError("mcp.injection_dropped: server name is required");
+    }
+    if (!isReason(reason)) {
+        throw new TypeError(`mcp.injection_dropped: reason ${JSON.stringify(reason)} is not one of ${MCP_INJECTION_DROP_REASONS.join("/")}`);
+    }
+    const fieldSeat = typeof field === "string" && field.length > 0 ? { field } : {};
+    const where = reason === "malformed_entry" && typeof field === "string" && field.length > 0 ? ` (field \`${field}\`)` : "";
+    return {
+        code: "mcp.injection_dropped",
+        message: `MCP server "${server}" from this request was not mounted: ${MCP_INJECTION_DROP_TEXT[reason]}${where}.`,
+        detail: { sessionId, server, reason, ...fieldSeat },
+    };
+}