@sema-agent/core 7.9.1 → 7.10.0

package/dist/core/checkpoint-store.js

@@ -2,7 +2,7 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
-import { readDenialLimitFallback } from "./auto-mode.js";
+import { isAutoModeUnavailableCause, readDenialLimitFallback } from "./auto-mode.js";
 import { isAskOrigin } from "./ask-origin.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
@@ -278,6 +278,7 @@ export function summarizeCheckpoint(cp) {
             return fb !== undefined ? { denialLimitFallback: fb } : {};
         })(),
         ...(tool !== undefined && isAskOrigin(tool.origin) ? { origin: tool.origin } : {}),
+        ...(tool !== undefined && isAutoModeUnavailableCause(tool.classifierUnavailable?.cause) ? { classifierUnavailable: { cause: tool.classifierUnavailable.cause } } : {}),
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }

package/dist/core/engine-notice.d.ts

@@ -69,15 +69,25 @@ export interface EngineNotice {
      *    (`MCP_INJECTION_DROP_REASONS`, CLOSED-SETS), `field` names the bad key for `malformed_entry`
      *    when known. `"user"` audience; `sessionId` REQUIRED at the mint (a user row with no session
      *    routes nowhere — refused, never fabricated). Dedup unit: per leg per server name, the host's.
-     *  - `"config.models_swapped"` — `Runner.swapModels` replaced the model catalog generation
-     *    (zero-restart model switching). `detail: { models, tiers, occurrenceId }` — key COUNTS only,
-     *    never the
-     *    catalog itself. In-flight tasks finish on the models they resolved at prepare (natural
-     *    snapshot); every later prepare resolves against the new generation. A failed swap (illegal
-     *    tier binding) throws atomically and mints nothing.
+     *  - `"config.models_swapped"` — `Runner.swapDeps` replaced the model catalog generation
+     *    (zero-restart model switching; the `models` / `tiers` seats of the swappable set). `detail:
+     *    { models, tiers, occurrenceId }` — key COUNTS only, never the catalog itself. In-flight tasks
+     *    finish on the models they resolved at prepare (natural snapshot); every later prepare resolves
+     *    against the new generation. A failed swap (illegal tier binding, a refused candidate) throws
+     *    atomically and mints nothing.
      *    `occurrenceId` (#495, uuidv7 minted at the announcement): the verb carries no run and no
      *    session, and the payload is a pair of counts, so two swaps of the same shape were byte-
      *    identical lines. Dedup key: (code, occurrenceId).
+     *  - `"config.read_face_swapped"` — `Runner.swapDeps` replaced the deployment's read-face
+     *    declaration (`RunnerDeps.readFace`, the `readFace` seat of the swappable set) without a
+     *    restart. `detail: { from, to, occurrenceId }` — the seat's previous and new value, each
+     *    `"open"` | `"roots"` | `null` (`null` = no declaration; the engine default `roots` applies).
+     *    The SEAT is announced, not a leg's resolved face: resolution (task seat, governance, the
+     *    read-only mount) still runs per prepare. In-flight legs keep the face they prepared under;
+     *    every later prepare resolves against the new declaration. A candidate outside the value gate
+     *    (`assertReadFaceValue`) throws atomically and mints nothing. Own `occurrenceId` for the same
+     *    reason as the catalog line (no run, no session, a two-word payload). Dedup key:
+     *    (code, occurrenceId).
      *  - `"route.fallback_to_primary"` (key↔URL pairing, `src/brain/route-adjudicator.ts`) — a
      *    DERIVED-leg model (role/tier/system-default resolution, never a caller-explicit one) failed
      *    the pairing pre-flight and the seat fell back to the primary model instead of sinking the
@@ -90,7 +100,7 @@ export interface EngineNotice {
      *    session falling back on the same seat used to mint byte-identical lines; `runId` is what
      *    tells one task falling back twice apart from two tasks falling back once each.
      *    Explicitly-named models never mint this: they refuse at the brain's request gate instead.
-     *  - `"route.base_url_changed_key_unchanged"` (key↔URL pairing) — `Runner.swapModels` moved a
+     *  - `"route.base_url_changed_key_unchanged"` (key↔URL pairing) — `Runner.swapDeps` moved a
      *    same-name entry's `baseUrl` while its Model-visible credential half (auth-bearing headers)
      *    did not change: legal (a provider changing domains), but worth one loud line — if the
      *    PROVIDER changed, the credential reference needs the same update. Advisory only, never a
@@ -484,6 +494,17 @@ export interface EngineNotice {
      *    access scope of the read that found the gap — from the continuation read faces (SendMessage preflight /
      *    AgentTranscript's durable leg); the per-call honest refusals are unchanged, and the declared
      *    tier is NOT auto-downgraded (declaration-制 — observation reports, it never re-adjudicates).
+     *  - `"delegation.ask_unresolvable"` (#648) — an `ask` reached its FINAL deny with nobody having judged
+     *    it: the approver consulted for the call (the run's own seat, or an ancestor's frozen seat on a
+     *    delegated child — the sync / workflow lanes, or a background child outside the park family)
+     *    answered `unavailable` (no operator reachable for this ask) and no durable approval park took
+     *    the call afterwards. The deny itself is unchanged (`tool_end.gate.settlement.kind:
+     *    "approver_unavailable"`, the fail-closed sentence as the tool result); this is its person-facing
+     *    half. Minted at the one gate exit both unavailable deny arms reach, once per tool call, by
+     *    `ask-unresolvable-notice.ts`. `detail: { sessionId, toolName, toolCallId, settlementKind,
+     *    parkLaneExisted }` — `parkLaneExisted` says whether a park lane was armed and declined/failed
+     *    (`true`) or none existed (`false`, the usual shape). Audience `"user"`: the refused work is the
+     *    session user's own; the operator hears it through the sink like every code.
      *
      *  - `"memory.consolidation_recommended"` (design/339 §2.2/§6.2) — the engine-minted per-scope
      *    session count crossed the consolidation thresholds (time gate open ∧ enough distinct

package/dist/core/gate-lanes.js

@@ -385,6 +385,9 @@ export async function runGateLanes(pass) {
                     pass.deniedBy = "classifier";
                 }
             }
+            else if (verdict.kind === "unavailable") {
+                pass.decision = { ...pass.decision, classifierUnavailable: { cause: verdict.cause } };
+            }
         }
         if (input.sandboxAdmission !== undefined &&
             pass.decision.action === "ask" &&
@@ -425,6 +428,7 @@ export async function runGateLanes(pass) {
             ...(callSignal !== undefined ? { signal: callSignal } : {}),
             ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
             ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
+            ...(d.action === "ask" && d.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: d.classifierUnavailable.cause } } : {}),
         });
         if (suspendAsk && pass.decision.action === "ask") {
             const parkArgs = [pass.req, pass.currentInput, safety, undefined, realApprovalOf(pass.decision), pass.decision.action === "ask" ? pass.decision.persistedRuleShadowed : undefined, pass.decision.action === "ask" ? pass.decision.decisionReason : undefined, pass.decision.action === "ask" ? pass.decision.probeReason : undefined, pass.decision.action === "ask" ? pass.decision.probeCause : undefined, pass.decision.action === "ask" ? pass.decision.segmentCoverage : undefined, pass.decision.action === "ask" ? pass.decision.matchedAskRule : undefined, pass.decision.action === "ask" ? pass.decision.probeMandated : undefined];
@@ -492,6 +496,16 @@ export async function runGateLanes(pass) {
                         return { suspend: suspended, preToolContext: pass.preToolContext };
                 }
             }
+            const noteUnresolvable = (r) => {
+                if (r.action !== "deny" || r.approverUnavailable !== true)
+                    return;
+                try {
+                    input.onAskUnresolvable?.({ toolName, toolCallId, settlementKind: "approver_unavailable", parkLaneExisted: suspendAsk !== undefined });
+                }
+                catch {
+                }
+            };
+            noteUnresolvable(resolved);
             if (askBeforeResolve.action === "ask" && askBeforeResolve.denialLimitFallback !== undefined) {
                 if (pass.decision.action === "allow") {
                     input.autoMode?.denialTracking?.recordAllow();
@@ -624,6 +638,7 @@ export async function runGateLanes(pass) {
                     const editAskReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
                     const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     ledger.fromResolved(rr, editAskDecision, toolName);
+                    noteUnresolvable(rr);
                     if (rr.action !== "allow") {
                         editDenied = rr;
                         pass.deniedBy = "ask_resolution";

package/dist/core/governance-codes.d.ts

@@ -103,7 +103,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -97,6 +97,7 @@ export const ENGINE_NOTICE_CODES = [
     "config.env_timeout_discarded",
     "config.materialize_env_discarded",
     "config.models_swapped",
+    "config.read_face_swapped",
     "config.read_face_deployment_clamped",
     "config.tool_model_gate_removed",
     "config.tool_model_gate_unknown_class",
@@ -113,6 +114,7 @@ export const ENGINE_NOTICE_CODES = [
     "classifier.denial_limit",
     "checkpoint.execution_outcome_unrecorded",
     "delegation.transcript_integrity",
+    "delegation.ask_unresolvable",
     "mcp.injection_dropped",
     "mcp.revocation_probe_failed",
     "workflow.governance_key_stripped",
@@ -160,10 +162,12 @@ const NOTICE_AUDIENCE_TABLE = {
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",
     "memory.consolidation_withheld": "user",
+    "delegation.ask_unresolvable": "user",
     "config.autocompact_window_clamped": "operator",
     "config.env_timeout_discarded": "operator",
     "config.materialize_env_discarded": "operator",
     "config.models_swapped": "operator",
+    "config.read_face_swapped": "operator",
     "config.read_face_deployment_clamped": "operator",
     "config.tool_model_gate_removed": "operator",
     "config.tool_model_gate_unknown_class": "operator",

package/dist/core/hooks.d.ts

@@ -5,7 +5,7 @@ import type { GateOutcome } from "./gate-outcome.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit, persistedRuleMandateOf } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { type AskClass } from "./ask-class.js";
-import type { AutoModeDenialTracker } from "./auto-mode.js";
+import { type AutoModeDenialTracker } from "./auto-mode.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import type { WiringLegKind } from "./wiring-manifest.js";
 /**
@@ -1405,6 +1405,20 @@ export interface ToolGateInput {
         toolCallId: string;
         fallback: import("./auto-mode.js").DenialLimitFallback;
     }) => void;
+    /**
+     * #648 — the deny exit nobody judged: the ask's approver (the run's own, or an ancestor's frozen seat on
+     * a delegated child) answered `unavailable` and the durable park re-route did not take the call, so the
+     * fail-closed deny STANDS. Fired once per such call, after the park has had its one attempt, with the
+     * facts the `delegation.ask_unresolvable` notice is composed from (`ask-unresolvable-notice.ts`);
+     * `parkLaneExisted` = a park lane was armed for this run. Observe-only: a throwing seat never alters
+     * the deny. Absent ⇒ the deny stands silently (a host driving the gate directly, no notice sink).
+     */
+    onAskUnresolvable?: (info: {
+        toolName: string;
+        toolCallId: string;
+        settlementKind: "approver_unavailable";
+        parkLaneExisted: boolean;
+    }) => void;
     /**
      * design/153 §2/§7.4 (件4 复审, MED): true means this call's ask is MARKED — an inherited ancestor
      * constraint already determined "no synchronous layer may resolve this ask" (the ancestor's frozen
@@ -1643,6 +1657,12 @@ export interface AskCarry {
     /** The surviving ask's engine-stamped origin word ({@link import("./ask-origin.js").AskOrigin}), persisted
      *  on the row so a durable card is rendered by the same word the synchronous card is. */
     readonly origin?: import("./ask-origin.js").AskOrigin;
+    /** #616: the surviving ask's classifier-unavailable fact (the classifier was consulted on this ask and could
+     *  not run — `cause` is the verdict's word), persisted on the row so a durable card says why it is asking
+     *  exactly as the synchronous card does. Absent ⇒ the classifier answered, was not eligible, or was not wired. */
+    readonly classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
 }
 /** What a durable row persists of an {@link AskCarry}: the fallback member COPIED (the row never aliases
  *  the gate's object; its window is already `0` — the gate's carry mint is the one writer of that
@@ -1651,6 +1671,9 @@ export interface AskCarry {
 export declare function askCarryRowMembers(carry: AskCarry | undefined): {
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
     origin?: import("./ask-origin.js").AskOrigin;
+    classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
 };
 /**
  * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant

package/dist/core/hooks.js

@@ -6,6 +6,7 @@ export { normalizeOrgGateVerdict, normalizePersistedRuleHit, persistedRuleMandat
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { isAskOrigin } from "./ask-origin.js";
+import { isAutoModeUnavailableCause } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import { createSafeNotifier } from "./safe-notify.js";
@@ -237,6 +238,7 @@ export function askCarryRowMembers(carry) {
     return {
         ...(carry.denialLimitFallback !== undefined ? { denialLimitFallback: { ...carry.denialLimitFallback } } : {}),
         ...(isAskOrigin(carry.origin) ? { origin: carry.origin } : {}),
+        ...(isAutoModeUnavailableCause(carry.classifierUnavailable?.cause) ? { classifierUnavailable: { cause: carry.classifierUnavailable.cause } } : {}),
     };
 }
 export async function runToolGate(input) {

package/dist/core/permission-rule-model.d.ts

@@ -497,28 +497,63 @@ export declare function parseRuleText(text: string, behavior: RuleBehavior): {
  *  double-slash directory form; for `path` it is the pattern as spelled. */
 export declare function formatRuleText(command: string, match: PersistedRuleMatch, tool: PersistedRuleTool): string;
 /**
- * The bases a path pattern resolves against at match time — facts of the CALL, never of the rule:
- * `home` for `~/…` (absent ⇒ `os.homedir()`), `root` for `/…` (the task's project root), `cwd` for a
- * relative pattern (the live working directory; absent ⇒ `root`). A pattern whose base is absent
- * resolves to nothing and reaches nothing.
+ * The closed set of BASES a path-form pattern resolves against — facts of the CALL (its execution
+ * environment and its task), never of the rule:
+ *  - `cwd`  — a relative pattern (`dist/**`, `./x`): the live tracked working directory; when no tracker
+ *             moved (or the caller keeps none) the task root stands in for it — that stand-in is the WORD's
+ *             own meaning (the same reading `TOOL_PATH_BASES.cwd` gives a tool's relative slot), not a
+ *             fallback to a different base;
+ *  - `root` — a root-relative pattern (`/dist/**`): the task's project root;
+ *  - `home` — a home-relative pattern (`~/.ssh/**`): the home directory OF THE EXECUTION ENVIRONMENT the
+ *             call runs in (`ExecutionEnv.homeDir`, declared by the adapter). NEVER the engine process's
+ *             own home: on a remote or sandboxed leg the two differ, and a `~/` deny resolved against the
+ *             engine host's home silently guarded the wrong directory (#644).
+ * A pattern whose base is ABSENT (or not an absolute path) cannot be judged: the reach is `unreadable`
+ * (fail-closed — a standing deny/ask the lane cannot read becomes an ask a person clears), never
+ * silence and never a guess. `//abs` patterns need no base. {@link ruleBasesNeeded} tells a host BEFORE
+ * prepare which base a rule will need, so it can declare it (or expect the ask).
  */
-export interface PathRuleBases {
-    readonly root?: string;
-    readonly cwd?: string;
-    readonly home?: string;
-}
+export declare const PATH_RULE_BASES: readonly ["cwd", "root", "home"];
+export type PathRuleBase = (typeof PATH_RULE_BASES)[number];
+/** The bases a call supplies, keyed by {@link PathRuleBase}; every member optional (absent = not supplied). */
+export type PathRuleBases = {
+    readonly [K in PathRuleBase]?: string;
+};
+/** The noun a refusal or an unreadable reason names each base by — the disposition table over the set
+ *  (a base without a row does not compile: {@link PathRuleBaseLabelCoversEveryBase}). */
+export declare const PATH_RULE_BASE_LABEL: {
+    readonly cwd: "the working directory";
+    readonly root: "the project root";
+    readonly home: "the home directory of the execution environment";
+};
+/** The fence over the label table: `never` while every base has a row. */
+export type PathRuleBaseLabelCoversEveryBase = AssertAllKeysHandled<Exclude<PathRuleBase, keyof typeof PATH_RULE_BASE_LABEL>>;
+/**
+ * WHICH base a rule's pattern resolves against — the one classification `resolvePathPattern`, the rule
+ * compiler's compile-time check and a host's pre-prepare "can this environment judge this rule?" all read.
+ * Empty for a rule that needs none: a `//abs` pattern, a `subpath` (directory) rule, a command rule. The
+ * relative form names `cwd`, whose own meaning includes "the root stands in when no tracker moved" — a
+ * host that supplies `root` has therefore supplied `cwd`'s stand-in too.
+ */
+export declare function ruleBasesNeeded(rule: Pick<PersistedRule, "match" | "command">): readonly PathRuleBase[];
 /** Is this base usable by {@link resolvePathPattern} — an absolute path with a lexical normal form? A rule
  *  compiler asks this at compile time so a pattern is refused rather than compiled inert. */
 export declare function isUsablePathBase(base: string | undefined): boolean;
 /**
- * The PATH family's tightening predicate: does this deny/ask rule reach the call's target path? The
- * target is the caller's ALREADY-RESOLVED lexical-normal absolute path (the same identity the read/write
- * fences judge with). A `subpath` rule reaches the directory and everything under it
- * ({@link directoryRuleAdmits}); a `path` rule resolves its spelling against the call's bases and
- * matches segment-wise (`*` within a segment, `**` across segments), reaching the path it names and
- * everything under a directory it names. A command-family rule reaches no path.
+ * The PATH family's tightening reach — three-valued like the command family's ({@link programRunReachOf}):
+ * does this deny/ask rule reach the call's target path? The target is the caller's ALREADY-RESOLVED
+ * lexical-normal absolute path (the same identity the read/write fences judge with). A `subpath` rule
+ * reaches the directory and everything under it ({@link directoryRuleAdmits}); a `path` rule resolves its
+ * spelling against the call's bases and matches segment-wise (`*` within a segment, `**` across
+ * segments), reaching the path it names and everything under a directory it names. A command-family rule
+ * reaches no path. `unreadable` (#644): the pattern needs a base the call did not supply (or supplied as
+ * a non-absolute spelling) — the rule CANNOT be judged, and the answer says which base; a lane that must
+ * fail closed on it turns it into the ask a person clears (the persisted lane's unreadable answer, the
+ * content lane's unreadable ask), exactly as an unreadable command is treated. Silence here was the #644
+ * defect (a `~/` deny falling back to the engine host's home guarded the wrong directory; a `/…` deny with
+ * no root reached nothing at all).
  */
-export declare function pathRuleReaches(rule: Pick<PersistedRule, "match" | "command">, target: string, bases: PathRuleBases): boolean;
+export declare function pathRuleReachOf(rule: Pick<PersistedRule, "match" | "command">, target: string, bases: PathRuleBases): ProgramRunReachOutcome;
 /**
  * Does this rule's command pattern admit `command`?
  *

package/dist/core/permission-rule-model.js

@@ -331,20 +331,47 @@ function parsePathRuleContent(text, tool, content, behavior) {
     }
     return { rule: { behavior, rule: formatRuleText(content, "path", tool), tool, match: "path", command: content } };
 }
-function resolvePathPattern(pattern, bases) {
+export const PATH_RULE_BASES = ["cwd", "root", "home"];
+export const PATH_RULE_BASE_LABEL = {
+    cwd: "the working directory",
+    root: "the project root",
+    home: "the home directory of the execution environment",
+};
+export function ruleBasesNeeded(rule) {
+    if (rule.match !== "path")
+        return [];
+    const pattern = rule.command;
     if (pattern.startsWith("//"))
-        return "/" + pattern.slice(2);
-    const under = (base, rest) => {
-        const normal = base === undefined ? undefined : lexicalNormalAbsolutePathOf(base);
-        if (normal === undefined)
-            return undefined;
-        return (normal === "/" ? "" : normal) + "/" + rest;
-    };
+        return [];
     if (pattern.startsWith("~/"))
-        return under(bases.home ?? homedir(), pattern.slice(2));
+        return ["home"];
     if (pattern.startsWith("/"))
-        return under(bases.root, pattern.slice(1));
-    return under(bases.cwd ?? bases.root, pattern.startsWith("./") ? pattern.slice(2) : pattern);
+        return ["root"];
+    return ["cwd"];
+}
+function baseValueOf(base, bases) {
+    switch (base) {
+        case "home":
+            return bases.home;
+        case "root":
+            return bases.root;
+        case "cwd":
+            return bases.cwd ?? bases.root;
+        default: {
+            const _exhaustive = base;
+            return _exhaustive;
+        }
+    }
+}
+function resolvePathPattern(pattern, bases) {
+    if (pattern.startsWith("//"))
+        return { resolved: "/" + pattern.slice(2) };
+    const needed = ruleBasesNeeded({ match: "path", command: pattern })[0];
+    const normal = lexicalNormalAbsolutePathOf(baseValueOf(needed, bases) ?? "");
+    if (normal === undefined)
+        return { missingBase: needed };
+    const rest = pattern.startsWith("~/") ? pattern.slice(2) : pattern.startsWith("/") ? pattern.slice(1) : pattern.startsWith("./") ? pattern.slice(2) : pattern;
+    return { resolved: (normal === "/" ? "" : normal) + "/" + rest };
 }
 export function isUsablePathBase(base) {
     return base !== undefined && lexicalNormalAbsolutePathOf(base) !== undefined;
@@ -389,19 +416,20 @@ function globSegmentsReach(globs, target) {
     };
     return walk(0, 0);
 }
-export function pathRuleReaches(rule, target, bases) {
+export function pathRuleReachOf(rule, target, bases) {
     if (rule.match === "subpath")
-        return directoryRuleAdmits(rule, target);
+        return directoryRuleAdmits(rule, target) ? REACHED : NOT_REACHED;
     if (rule.match !== "path")
-        return false;
+        return NOT_REACHED;
     if (!isLexicalNormalAbsoluteDir(target) && target !== "/")
-        return false;
-    const resolved = resolvePathPattern(rule.command, bases);
-    if (resolved === undefined)
-        return false;
-    const globs = resolved.split("/").filter((sg) => sg !== "");
+        return NOT_REACHED;
+    const r = resolvePathPattern(rule.command, bases);
+    if ("missingBase" in r) {
+        return { reach: "unreadable", reason: `the rule is relative to ${PATH_RULE_BASE_LABEL[r.missingBase]} and this call supplies no absolute \`${r.missingBase}\` base to resolve it against` };
+    }
+    const globs = r.resolved.split("/").filter((sg) => sg !== "");
     const segments = target.split("/").filter((sg) => sg !== "");
-    return globSegmentsReach(globs, segments);
+    return globSegmentsReach(globs, segments) ? REACHED : NOT_REACHED;
 }
 function hasUnescapedStar(s) {
     for (let i = 0; i < s.length; i++) {
@@ -778,12 +806,18 @@ export function adjudicatePersistedPathRules(rules, call, targets, bases) {
         }
         if (targets.tighten === undefined)
             continue;
+        let unreadable;
         for (const rule of rules) {
             if (!eligiblePersisted(rule, call, behavior))
                 continue;
-            if (pathRuleReaches(rule, targets.tighten, bases))
+            const outcome = pathRuleReachOf(rule, targets.tighten, bases);
+            if (outcome.reach === "reached")
                 return { behavior, rules: [rule] };
+            if (outcome.reach === "unreadable")
+                unreadable ??= { behavior: "ask", rules: [rule], unreadable: outcome.reason };
         }
+        if (unreadable !== undefined)
+            return unreadable;
     }
     return undefined;
 }

package/dist/core/permission-rules.d.ts

@@ -132,10 +132,12 @@ export interface PermissionRulePolicyOptions {
      */
     ruleFaces?: (toolName: string) => RuleFaceView | undefined;
     /**
-     * The bases a path-form deny/ask pattern resolves against at match time: `root` for `/…` (the task's
-     * project root), `cwd` for a relative pattern (absent ⇒ `root`), `home` for `~/…` (absent ⇒ the process
-     * owner's home). Facts of the DEPLOYMENT and the task, never of the rule — a pattern is stored as
-     * spelled. A rule whose base is absent here is refused at compile time (`unsupported.path_base`).
+     * The bases a path-form deny/ask pattern resolves against at match time ({@link PathRuleBases}): `root`
+     * for `/…` (the task's project root), `cwd` for a relative pattern (the root stands in when absent — the
+     * word's own meaning), `home` for `~/…` (the EXECUTION ENVIRONMENT's home — never the engine process's
+     * own; #644). Facts of the DEPLOYMENT and the task, never of the rule — a pattern is stored as spelled.
+     * A rule whose base is absent (or not an absolute path) here is refused at compile time
+     * (`unsupported.path_base`, naming the base — {@link ruleBasesNeeded} is the same classification).
      */
     pathBases?: PathRuleBases;
 }

package/dist/core/permission-rules.js

@@ -1,7 +1,7 @@
 import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
 import { catalogRuleFaceOf, pathTargetOf } from "./tool-registry.js";
 import { indexOfUnescaped, lastIndexOfUnescaped, parsePermissionRule } from "./permission-rule-syntax.js";
-import { isUsablePathBase, parseRuleText, pathRuleReaches, programRunReachOf } from "./permission-rule-model.js";
+import { PATH_RULE_BASE_LABEL, isUsablePathBase, parseRuleText, pathRuleReachOf, programRunReachOf, ruleBasesNeeded } from "./permission-rule-model.js";
 import { effectivePathTargetOf } from "./effective-path-target.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
 export { parsePermissionRule };
@@ -186,19 +186,14 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
                     bad(text, "invalid.command_rule", `${parsedPath.reject.code}: ${parsedPath.reject.message}`);
                     continue;
                 }
-                const pattern = parsedPath.rule.command;
-                if (parsedPath.rule.match === "path" && !pattern.startsWith("//")) {
-                    const needsRoot = pattern.startsWith("/");
-                    const base = pattern.startsWith("~/") ? (pathBases.home ?? "/") : needsRoot ? pathBases.root : (pathBases.cwd ?? pathBases.root);
-                    if (!isUsablePathBase(base)) {
-                        bad(text, "unsupported.path_base", pattern.startsWith("~/")
-                            ? `"${text}" is relative to the home directory, and this policy's \`pathBases.home\` is not an absolute path — the rule would reach nothing`
-                            : needsRoot
-                                ? `"${text}" is relative to the project root, and this policy was given no absolute \`pathBases.root\` to resolve it against — the rule would reach nothing`
-                                : `"${text}" is relative to the working directory, and this policy was given no absolute \`pathBases.cwd\` (or \`root\`) to resolve it against — the rule would reach nothing`);
-                        continue;
+                for (const base of ruleBasesNeeded(parsedPath.rule)) {
+                    const value = base === "cwd" ? (pathBases.cwd ?? pathBases.root) : pathBases[base];
+                    if (!isUsablePathBase(value)) {
+                        bad(text, "unsupported.path_base", `"${text}" is relative to ${PATH_RULE_BASE_LABEL[base]}, and this policy was given no absolute \`pathBases.${base}\`${base === "cwd" ? " (or `root`)" : ""} to resolve it against — the rule could not be judged on any call`);
                     }
                 }
+                if (issues.length > 0 && issues[issues.length - 1].rule === text && issues[issues.length - 1].code === "unsupported.path_base")
+                    continue;
                 entry.content[r.behavior].push({ parsed: parsedPath.rule, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
                 byTool.set(toolName, entry);
                 continue;
@@ -326,8 +321,13 @@ export function createPermissionRulePolicy(rules, opts) {
         let unreadable;
         for (const r of lane) {
             if (r.parsed.match === "subpath" || r.parsed.match === "path") {
-                if (target !== undefined && pathRuleReaches(r.parsed, target, pathBases))
+                if (target === undefined)
+                    continue;
+                const outcome = pathRuleReachOf(r.parsed, target, pathBases);
+                if (outcome.reach === "reached")
                     return { rule: r };
+                if (outcome.reach === "unreadable")
+                    unreadable ??= { rule: r, unreadable: outcome.reason };
                 continue;
             }
             if (typeof command !== "string")
@@ -342,7 +342,7 @@ export function createPermissionRulePolicy(rules, opts) {
     };
     const unreadableAsk = (hit, req) => ({
         action: "ask",
-        message: `tool "${req.toolName}" needs approval: the command could not be read against the permission rule ${hit.rule.ruleText} (${hit.unreadable}) — a person must decide`,
+        message: `tool "${req.toolName}" needs approval: the call could not be read against the permission rule ${hit.rule.ruleText} (${hit.unreadable}) — a person must decide`,
         matchedAskRule: hit.rule.ruleText,
         requiresRealApproval: true,
     });

package/dist/core/roles.d.ts

@@ -98,6 +98,14 @@ export interface ResolvedRole {
  * Resolve the model (and default thinking) for a task. Explicit `spec.model` wins; otherwise walk the
  * `modelRole`'s fallback chain over the merged roles (task overrides runner) and use the first role
  * that supplies a model. Throws a helpful error if nothing resolves.
+ *
+ * @contract roles.side_channels_deployment_only — an engine SIDE CHANNEL (the auto-mode classifier,
+ * the compaction/summarize lane, memory consolidation, next-prompt suggestion) resolves here with a
+ * `modelRole` and NO run model: it runs on the deployment's roles alone — the boot default at the end of
+ * its chain — and never follows the model a run was switched to. Only a run's CHILDREN follow the parent:
+ * the delegation seat (`childModelSeat`) passes the parent's `Model` as `spec.model` with the role kept
+ * on `modelRole`, so the role's presets still apply. A side channel that must follow a run passes that
+ * run's model explicitly; nothing here infers it.
  */
 export declare function resolveTaskModel(spec: {
     model?: ModelRef;

package/dist/core/runner/contracts.d.ts

@@ -43,7 +43,7 @@ import type { SystemInjectionPriority, TaskNotificationPayload } from "../task-n
 import type { OnAsk, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
 import type { RemoteExecutionEnv, SnapshotId, WorkspaceHandle } from "../remote-env.js";
 import type { ToolDisclosureManifest } from "../trace.js";
-import type { AgentDefinition, Brain, CompactOutcome, NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
+import type { AgentDefinition, Brain, CompactOutcome, ModelRoles, NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
 import type { WiringManifest } from "../wiring-manifest.js";
 import type { ActiveSkillFrame } from "./active-skill-scope.js";
 import type { BudgetAxis } from "./assemble-result.js";
@@ -1486,6 +1486,22 @@ export interface RunInternals {
      * see from `spec`. Consumed by the `run_workflow` tool wiring (S8c), not by `prepareTask` itself.
      */
     workflowDepth?: number;
+    /**
+     * #642 — the host's DECISIONS for parked workflow-agent rows (`wa*` rows with `status:"parked"`), a TRUSTED
+     * run channel like `workflowDepth` (never a `TaskSpec` field, never a tool argument — a model cannot decide
+     * an approval). A host that decided a workflow child's parked checkpoint launches the run that re-invokes
+     * `Workflow({resumeFromRunId})` with the decision here; the Workflow tool applies the entries naming the
+     * resumed run (`RunWorkflowOptions.parkedResume`) and the resume drives the parked child on instead of
+     * re-parking. `inheritedGate` is the cross-process re-supply of the checkpoint's opaque parent constraints
+     * (the same seat the background revival's `reviveClaim.parkedResume` takes). Consumed by the `run_workflow`
+     * tool wiring, not by `prepareTask` itself.
+     */
+    workflowParkedResume?: ReadonlyArray<{
+        runId: string;
+        token: CheckpointToken;
+        outcome: ResumeOutcome;
+        inheritedGate?: InheritedGate;
+    }>;
     /**
      * design/110 — set ONLY by the Agent tool's fork route (`Agent(subagent_type:"fork")`, a core caller) on the
      * child it spawns: this run IS a forked child. `prepareTask` threads it to tool ctx as `insideFork` so the
@@ -1762,6 +1778,14 @@ export interface RunInternals {
      * channel, same posture as every other field here.
      */
     sessionReadStates?: SessionReadFileStates;
+    /**
+     * #616 — the Runner's per-session breaker ledger ({@link import("../auto-mode.js").AutoModeBreakerLedger}):
+     * the arming site's `onBreakerOpen` wrap records a trip here, the wiring-manifest phase of a LATER leg of
+     * the same session reads the most recent one onto `autoMode.breaker`. Always set by the Runner's own
+     * prepare call (overriding any caller value, like `sessionReadStates` beside it); absent on a standalone
+     * prepareTask, where no trip is recorded and none is reported. Trusted internals channel.
+     */
+    autoModeBreakerLedger?: import("../auto-mode.js").AutoModeBreakerLedger;
     onTaskNotification?: (notification: TaskNotificationPayload, 
     /** Injection tier (design/373 — the ladder is LIVE): "next" = the running turn's next boundary
      *  (arrival order, consecutive frames batch); "later" = the run's would-otherwise-stop seat
@@ -2357,7 +2381,7 @@ export interface HarnessHandlersDeps {
  * THE MEMBER SET IS MEASURED, NOT DESIGNED: it is exactly the union of what those consumers read off a
  * Runner today (a TS-Program census over `src/`, pinned in test/runner-self-seat.test.ts so a member
  * nobody reads reds as dead weight and a consumer reaching for a member outside it reds as a widening).
- * `swapModels`, `sideQuery` and the constructor are NOT here — no consumer reaches them; a host that
+ * `swapDeps`, `sideQuery` and the constructor are NOT here — no consumer reaches them; a host that
  * needs them holds the class. The class implements this interface, so the two cannot drift apart.
  *
  * Signatures are spelled out (not `Pick<Runner, …>`), because naming the class from here would be the
@@ -2365,7 +2389,7 @@ export interface HarnessHandlersDeps {
  */
 /**
  * The Runner's deployment deps as a LIVE read for the lanes that read them after an await (the resume ladder's
- * rungs). `Runner.deps` is not a constant: `swapModels` replaces the object, so a lane handed the object at its
+ * rungs). `Runner.deps` is not a constant: `swapDeps` replaces the object, so a lane handed the object at its
  * call would read a stale catalog — and a stale anything — where the one-function ladder read `this.deps.x` at the
  * instant of the read. The seat is the Runner's own view (a getter over the private field), so `runner.deps.x`
  * in a lane is exactly `this.deps.x` in the method it came from.
@@ -2377,11 +2401,12 @@ export interface RunnerDepsSeat {
 export interface RunnerSelfSeat {
     /** The session store this Runner was constructed over — the delegation tools acquire / release / fork through it. */
     readonly sessions: SessionStore;
-    /** The deployment agent + model catalog, READ-ONLY (a fresh copy per read; the definitions are the shared objects). */
+    /** The deployment agent + model catalog, READ-ONLY (a fresh copy per read; the definitions are the shared objects); `roles` = `RunnerDeps.roles` (the delegation seat's `childModelSeat` reads `roles.subagent`). */
     readonly agentCatalog: {
         agents?: AgentDefinition[];
         builtinAgents?: boolean;
         models?: Record<string, Model>;
+        roles?: ModelRoles;
     };
     /** The deployment-level gating baseline (deps toolPolicy / hooks) as delegate wrappers — for assemblers that compose with it. */
     readonly gateBaseline: {