@sema-agent/core 7.9.2 → 7.10.0

package/dist/core/hooks.d.ts

@@ -5,7 +5,7 @@ import type { GateOutcome } from "./gate-outcome.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit, persistedRuleMandateOf } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { type AskClass } from "./ask-class.js";
-import type { AutoModeDenialTracker } from "./auto-mode.js";
+import { type AutoModeDenialTracker } from "./auto-mode.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import type { WiringLegKind } from "./wiring-manifest.js";
 /**
@@ -1405,6 +1405,20 @@ export interface ToolGateInput {
         toolCallId: string;
         fallback: import("./auto-mode.js").DenialLimitFallback;
     }) => void;
+    /**
+     * #648 — the deny exit nobody judged: the ask's approver (the run's own, or an ancestor's frozen seat on
+     * a delegated child) answered `unavailable` and the durable park re-route did not take the call, so the
+     * fail-closed deny STANDS. Fired once per such call, after the park has had its one attempt, with the
+     * facts the `delegation.ask_unresolvable` notice is composed from (`ask-unresolvable-notice.ts`);
+     * `parkLaneExisted` = a park lane was armed for this run. Observe-only: a throwing seat never alters
+     * the deny. Absent ⇒ the deny stands silently (a host driving the gate directly, no notice sink).
+     */
+    onAskUnresolvable?: (info: {
+        toolName: string;
+        toolCallId: string;
+        settlementKind: "approver_unavailable";
+        parkLaneExisted: boolean;
+    }) => void;
     /**
      * design/153 §2/§7.4 (件4 复审, MED): true means this call's ask is MARKED — an inherited ancestor
      * constraint already determined "no synchronous layer may resolve this ask" (the ancestor's frozen
@@ -1643,6 +1657,12 @@ export interface AskCarry {
     /** The surviving ask's engine-stamped origin word ({@link import("./ask-origin.js").AskOrigin}), persisted
      *  on the row so a durable card is rendered by the same word the synchronous card is. */
     readonly origin?: import("./ask-origin.js").AskOrigin;
+    /** #616: the surviving ask's classifier-unavailable fact (the classifier was consulted on this ask and could
+     *  not run — `cause` is the verdict's word), persisted on the row so a durable card says why it is asking
+     *  exactly as the synchronous card does. Absent ⇒ the classifier answered, was not eligible, or was not wired. */
+    readonly classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
 }
 /** What a durable row persists of an {@link AskCarry}: the fallback member COPIED (the row never aliases
  *  the gate's object; its window is already `0` — the gate's carry mint is the one writer of that
@@ -1651,6 +1671,9 @@ export interface AskCarry {
 export declare function askCarryRowMembers(carry: AskCarry | undefined): {
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
     origin?: import("./ask-origin.js").AskOrigin;
+    classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
 };
 /**
  * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant

package/dist/core/hooks.js

@@ -6,6 +6,7 @@ export { normalizeOrgGateVerdict, normalizePersistedRuleHit, persistedRuleMandat
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { isAskOrigin } from "./ask-origin.js";
+import { isAutoModeUnavailableCause } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import { createSafeNotifier } from "./safe-notify.js";
@@ -237,6 +238,7 @@ export function askCarryRowMembers(carry) {
     return {
         ...(carry.denialLimitFallback !== undefined ? { denialLimitFallback: { ...carry.denialLimitFallback } } : {}),
         ...(isAskOrigin(carry.origin) ? { origin: carry.origin } : {}),
+        ...(isAutoModeUnavailableCause(carry.classifierUnavailable?.cause) ? { classifierUnavailable: { cause: carry.classifierUnavailable.cause } } : {}),
     };
 }
 export async function runToolGate(input) {

package/dist/core/permission-rule-model.d.ts

@@ -497,28 +497,63 @@ export declare function parseRuleText(text: string, behavior: RuleBehavior): {
  *  double-slash directory form; for `path` it is the pattern as spelled. */
 export declare function formatRuleText(command: string, match: PersistedRuleMatch, tool: PersistedRuleTool): string;
 /**
- * The bases a path pattern resolves against at match time — facts of the CALL, never of the rule:
- * `home` for `~/…` (absent ⇒ `os.homedir()`), `root` for `/…` (the task's project root), `cwd` for a
- * relative pattern (the live working directory; absent ⇒ `root`). A pattern whose base is absent
- * resolves to nothing and reaches nothing.
+ * The closed set of BASES a path-form pattern resolves against — facts of the CALL (its execution
+ * environment and its task), never of the rule:
+ *  - `cwd`  — a relative pattern (`dist/**`, `./x`): the live tracked working directory; when no tracker
+ *             moved (or the caller keeps none) the task root stands in for it — that stand-in is the WORD's
+ *             own meaning (the same reading `TOOL_PATH_BASES.cwd` gives a tool's relative slot), not a
+ *             fallback to a different base;
+ *  - `root` — a root-relative pattern (`/dist/**`): the task's project root;
+ *  - `home` — a home-relative pattern (`~/.ssh/**`): the home directory OF THE EXECUTION ENVIRONMENT the
+ *             call runs in (`ExecutionEnv.homeDir`, declared by the adapter). NEVER the engine process's
+ *             own home: on a remote or sandboxed leg the two differ, and a `~/` deny resolved against the
+ *             engine host's home silently guarded the wrong directory (#644).
+ * A pattern whose base is ABSENT (or not an absolute path) cannot be judged: the reach is `unreadable`
+ * (fail-closed — a standing deny/ask the lane cannot read becomes an ask a person clears), never
+ * silence and never a guess. `//abs` patterns need no base. {@link ruleBasesNeeded} tells a host BEFORE
+ * prepare which base a rule will need, so it can declare it (or expect the ask).
  */
-export interface PathRuleBases {
-    readonly root?: string;
-    readonly cwd?: string;
-    readonly home?: string;
-}
+export declare const PATH_RULE_BASES: readonly ["cwd", "root", "home"];
+export type PathRuleBase = (typeof PATH_RULE_BASES)[number];
+/** The bases a call supplies, keyed by {@link PathRuleBase}; every member optional (absent = not supplied). */
+export type PathRuleBases = {
+    readonly [K in PathRuleBase]?: string;
+};
+/** The noun a refusal or an unreadable reason names each base by — the disposition table over the set
+ *  (a base without a row does not compile: {@link PathRuleBaseLabelCoversEveryBase}). */
+export declare const PATH_RULE_BASE_LABEL: {
+    readonly cwd: "the working directory";
+    readonly root: "the project root";
+    readonly home: "the home directory of the execution environment";
+};
+/** The fence over the label table: `never` while every base has a row. */
+export type PathRuleBaseLabelCoversEveryBase = AssertAllKeysHandled<Exclude<PathRuleBase, keyof typeof PATH_RULE_BASE_LABEL>>;
+/**
+ * WHICH base a rule's pattern resolves against — the one classification `resolvePathPattern`, the rule
+ * compiler's compile-time check and a host's pre-prepare "can this environment judge this rule?" all read.
+ * Empty for a rule that needs none: a `//abs` pattern, a `subpath` (directory) rule, a command rule. The
+ * relative form names `cwd`, whose own meaning includes "the root stands in when no tracker moved" — a
+ * host that supplies `root` has therefore supplied `cwd`'s stand-in too.
+ */
+export declare function ruleBasesNeeded(rule: Pick<PersistedRule, "match" | "command">): readonly PathRuleBase[];
 /** Is this base usable by {@link resolvePathPattern} — an absolute path with a lexical normal form? A rule
  *  compiler asks this at compile time so a pattern is refused rather than compiled inert. */
 export declare function isUsablePathBase(base: string | undefined): boolean;
 /**
- * The PATH family's tightening predicate: does this deny/ask rule reach the call's target path? The
- * target is the caller's ALREADY-RESOLVED lexical-normal absolute path (the same identity the read/write
- * fences judge with). A `subpath` rule reaches the directory and everything under it
- * ({@link directoryRuleAdmits}); a `path` rule resolves its spelling against the call's bases and
- * matches segment-wise (`*` within a segment, `**` across segments), reaching the path it names and
- * everything under a directory it names. A command-family rule reaches no path.
+ * The PATH family's tightening reach — three-valued like the command family's ({@link programRunReachOf}):
+ * does this deny/ask rule reach the call's target path? The target is the caller's ALREADY-RESOLVED
+ * lexical-normal absolute path (the same identity the read/write fences judge with). A `subpath` rule
+ * reaches the directory and everything under it ({@link directoryRuleAdmits}); a `path` rule resolves its
+ * spelling against the call's bases and matches segment-wise (`*` within a segment, `**` across
+ * segments), reaching the path it names and everything under a directory it names. A command-family rule
+ * reaches no path. `unreadable` (#644): the pattern needs a base the call did not supply (or supplied as
+ * a non-absolute spelling) — the rule CANNOT be judged, and the answer says which base; a lane that must
+ * fail closed on it turns it into the ask a person clears (the persisted lane's unreadable answer, the
+ * content lane's unreadable ask), exactly as an unreadable command is treated. Silence here was the #644
+ * defect (a `~/` deny falling back to the engine host's home guarded the wrong directory; a `/…` deny with
+ * no root reached nothing at all).
  */
-export declare function pathRuleReaches(rule: Pick<PersistedRule, "match" | "command">, target: string, bases: PathRuleBases): boolean;
+export declare function pathRuleReachOf(rule: Pick<PersistedRule, "match" | "command">, target: string, bases: PathRuleBases): ProgramRunReachOutcome;
 /**
  * Does this rule's command pattern admit `command`?
  *

package/dist/core/permission-rule-model.js

@@ -331,20 +331,47 @@ function parsePathRuleContent(text, tool, content, behavior) {
     }
     return { rule: { behavior, rule: formatRuleText(content, "path", tool), tool, match: "path", command: content } };
 }
-function resolvePathPattern(pattern, bases) {
+export const PATH_RULE_BASES = ["cwd", "root", "home"];
+export const PATH_RULE_BASE_LABEL = {
+    cwd: "the working directory",
+    root: "the project root",
+    home: "the home directory of the execution environment",
+};
+export function ruleBasesNeeded(rule) {
+    if (rule.match !== "path")
+        return [];
+    const pattern = rule.command;
     if (pattern.startsWith("//"))
-        return "/" + pattern.slice(2);
-    const under = (base, rest) => {
-        const normal = base === undefined ? undefined : lexicalNormalAbsolutePathOf(base);
-        if (normal === undefined)
-            return undefined;
-        return (normal === "/" ? "" : normal) + "/" + rest;
-    };
+        return [];
     if (pattern.startsWith("~/"))
-        return under(bases.home ?? homedir(), pattern.slice(2));
+        return ["home"];
     if (pattern.startsWith("/"))
-        return under(bases.root, pattern.slice(1));
-    return under(bases.cwd ?? bases.root, pattern.startsWith("./") ? pattern.slice(2) : pattern);
+        return ["root"];
+    return ["cwd"];
+}
+function baseValueOf(base, bases) {
+    switch (base) {
+        case "home":
+            return bases.home;
+        case "root":
+            return bases.root;
+        case "cwd":
+            return bases.cwd ?? bases.root;
+        default: {
+            const _exhaustive = base;
+            return _exhaustive;
+        }
+    }
+}
+function resolvePathPattern(pattern, bases) {
+    if (pattern.startsWith("//"))
+        return { resolved: "/" + pattern.slice(2) };
+    const needed = ruleBasesNeeded({ match: "path", command: pattern })[0];
+    const normal = lexicalNormalAbsolutePathOf(baseValueOf(needed, bases) ?? "");
+    if (normal === undefined)
+        return { missingBase: needed };
+    const rest = pattern.startsWith("~/") ? pattern.slice(2) : pattern.startsWith("/") ? pattern.slice(1) : pattern.startsWith("./") ? pattern.slice(2) : pattern;
+    return { resolved: (normal === "/" ? "" : normal) + "/" + rest };
 }
 export function isUsablePathBase(base) {
     return base !== undefined && lexicalNormalAbsolutePathOf(base) !== undefined;
@@ -389,19 +416,20 @@ function globSegmentsReach(globs, target) {
     };
     return walk(0, 0);
 }
-export function pathRuleReaches(rule, target, bases) {
+export function pathRuleReachOf(rule, target, bases) {
     if (rule.match === "subpath")
-        return directoryRuleAdmits(rule, target);
+        return directoryRuleAdmits(rule, target) ? REACHED : NOT_REACHED;
     if (rule.match !== "path")
-        return false;
+        return NOT_REACHED;
     if (!isLexicalNormalAbsoluteDir(target) && target !== "/")
-        return false;
-    const resolved = resolvePathPattern(rule.command, bases);
-    if (resolved === undefined)
-        return false;
-    const globs = resolved.split("/").filter((sg) => sg !== "");
+        return NOT_REACHED;
+    const r = resolvePathPattern(rule.command, bases);
+    if ("missingBase" in r) {
+        return { reach: "unreadable", reason: `the rule is relative to ${PATH_RULE_BASE_LABEL[r.missingBase]} and this call supplies no absolute \`${r.missingBase}\` base to resolve it against` };
+    }
+    const globs = r.resolved.split("/").filter((sg) => sg !== "");
     const segments = target.split("/").filter((sg) => sg !== "");
-    return globSegmentsReach(globs, segments);
+    return globSegmentsReach(globs, segments) ? REACHED : NOT_REACHED;
 }
 function hasUnescapedStar(s) {
     for (let i = 0; i < s.length; i++) {
@@ -778,12 +806,18 @@ export function adjudicatePersistedPathRules(rules, call, targets, bases) {
         }
         if (targets.tighten === undefined)
             continue;
+        let unreadable;
         for (const rule of rules) {
             if (!eligiblePersisted(rule, call, behavior))
                 continue;
-            if (pathRuleReaches(rule, targets.tighten, bases))
+            const outcome = pathRuleReachOf(rule, targets.tighten, bases);
+            if (outcome.reach === "reached")
                 return { behavior, rules: [rule] };
+            if (outcome.reach === "unreadable")
+                unreadable ??= { behavior: "ask", rules: [rule], unreadable: outcome.reason };
         }
+        if (unreadable !== undefined)
+            return unreadable;
     }
     return undefined;
 }

package/dist/core/permission-rules.d.ts

@@ -132,10 +132,12 @@ export interface PermissionRulePolicyOptions {
      */
     ruleFaces?: (toolName: string) => RuleFaceView | undefined;
     /**
-     * The bases a path-form deny/ask pattern resolves against at match time: `root` for `/…` (the task's
-     * project root), `cwd` for a relative pattern (absent ⇒ `root`), `home` for `~/…` (absent ⇒ the process
-     * owner's home). Facts of the DEPLOYMENT and the task, never of the rule — a pattern is stored as
-     * spelled. A rule whose base is absent here is refused at compile time (`unsupported.path_base`).
+     * The bases a path-form deny/ask pattern resolves against at match time ({@link PathRuleBases}): `root`
+     * for `/…` (the task's project root), `cwd` for a relative pattern (the root stands in when absent — the
+     * word's own meaning), `home` for `~/…` (the EXECUTION ENVIRONMENT's home — never the engine process's
+     * own; #644). Facts of the DEPLOYMENT and the task, never of the rule — a pattern is stored as spelled.
+     * A rule whose base is absent (or not an absolute path) here is refused at compile time
+     * (`unsupported.path_base`, naming the base — {@link ruleBasesNeeded} is the same classification).
      */
     pathBases?: PathRuleBases;
 }

package/dist/core/permission-rules.js

@@ -1,7 +1,7 @@
 import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
 import { catalogRuleFaceOf, pathTargetOf } from "./tool-registry.js";
 import { indexOfUnescaped, lastIndexOfUnescaped, parsePermissionRule } from "./permission-rule-syntax.js";
-import { isUsablePathBase, parseRuleText, pathRuleReaches, programRunReachOf } from "./permission-rule-model.js";
+import { PATH_RULE_BASE_LABEL, isUsablePathBase, parseRuleText, pathRuleReachOf, programRunReachOf, ruleBasesNeeded } from "./permission-rule-model.js";
 import { effectivePathTargetOf } from "./effective-path-target.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
 export { parsePermissionRule };
@@ -186,19 +186,14 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
                     bad(text, "invalid.command_rule", `${parsedPath.reject.code}: ${parsedPath.reject.message}`);
                     continue;
                 }
-                const pattern = parsedPath.rule.command;
-                if (parsedPath.rule.match === "path" && !pattern.startsWith("//")) {
-                    const needsRoot = pattern.startsWith("/");
-                    const base = pattern.startsWith("~/") ? (pathBases.home ?? "/") : needsRoot ? pathBases.root : (pathBases.cwd ?? pathBases.root);
-                    if (!isUsablePathBase(base)) {
-                        bad(text, "unsupported.path_base", pattern.startsWith("~/")
-                            ? `"${text}" is relative to the home directory, and this policy's \`pathBases.home\` is not an absolute path — the rule would reach nothing`
-                            : needsRoot
-                                ? `"${text}" is relative to the project root, and this policy was given no absolute \`pathBases.root\` to resolve it against — the rule would reach nothing`
-                                : `"${text}" is relative to the working directory, and this policy was given no absolute \`pathBases.cwd\` (or \`root\`) to resolve it against — the rule would reach nothing`);
-                        continue;
+                for (const base of ruleBasesNeeded(parsedPath.rule)) {
+                    const value = base === "cwd" ? (pathBases.cwd ?? pathBases.root) : pathBases[base];
+                    if (!isUsablePathBase(value)) {
+                        bad(text, "unsupported.path_base", `"${text}" is relative to ${PATH_RULE_BASE_LABEL[base]}, and this policy was given no absolute \`pathBases.${base}\`${base === "cwd" ? " (or `root`)" : ""} to resolve it against — the rule could not be judged on any call`);
                     }
                 }
+                if (issues.length > 0 && issues[issues.length - 1].rule === text && issues[issues.length - 1].code === "unsupported.path_base")
+                    continue;
                 entry.content[r.behavior].push({ parsed: parsedPath.rule, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
                 byTool.set(toolName, entry);
                 continue;
@@ -326,8 +321,13 @@ export function createPermissionRulePolicy(rules, opts) {
         let unreadable;
         for (const r of lane) {
             if (r.parsed.match === "subpath" || r.parsed.match === "path") {
-                if (target !== undefined && pathRuleReaches(r.parsed, target, pathBases))
+                if (target === undefined)
+                    continue;
+                const outcome = pathRuleReachOf(r.parsed, target, pathBases);
+                if (outcome.reach === "reached")
                     return { rule: r };
+                if (outcome.reach === "unreadable")
+                    unreadable ??= { rule: r, unreadable: outcome.reason };
                 continue;
             }
             if (typeof command !== "string")
@@ -342,7 +342,7 @@ export function createPermissionRulePolicy(rules, opts) {
     };
     const unreadableAsk = (hit, req) => ({
         action: "ask",
-        message: `tool "${req.toolName}" needs approval: the command could not be read against the permission rule ${hit.rule.ruleText} (${hit.unreadable}) — a person must decide`,
+        message: `tool "${req.toolName}" needs approval: the call could not be read against the permission rule ${hit.rule.ruleText} (${hit.unreadable}) — a person must decide`,
         matchedAskRule: hit.rule.ruleText,
         requiresRealApproval: true,
     });

package/dist/core/runner/contracts.d.ts

@@ -1486,6 +1486,22 @@ export interface RunInternals {
      * see from `spec`. Consumed by the `run_workflow` tool wiring (S8c), not by `prepareTask` itself.
      */
     workflowDepth?: number;
+    /**
+     * #642 — the host's DECISIONS for parked workflow-agent rows (`wa*` rows with `status:"parked"`), a TRUSTED
+     * run channel like `workflowDepth` (never a `TaskSpec` field, never a tool argument — a model cannot decide
+     * an approval). A host that decided a workflow child's parked checkpoint launches the run that re-invokes
+     * `Workflow({resumeFromRunId})` with the decision here; the Workflow tool applies the entries naming the
+     * resumed run (`RunWorkflowOptions.parkedResume`) and the resume drives the parked child on instead of
+     * re-parking. `inheritedGate` is the cross-process re-supply of the checkpoint's opaque parent constraints
+     * (the same seat the background revival's `reviveClaim.parkedResume` takes). Consumed by the `run_workflow`
+     * tool wiring, not by `prepareTask` itself.
+     */
+    workflowParkedResume?: ReadonlyArray<{
+        runId: string;
+        token: CheckpointToken;
+        outcome: ResumeOutcome;
+        inheritedGate?: InheritedGate;
+    }>;
     /**
      * design/110 — set ONLY by the Agent tool's fork route (`Agent(subagent_type:"fork")`, a core caller) on the
      * child it spawns: this run IS a forked child. `prepareTask` threads it to tool ctx as `insideFork` so the
@@ -1762,6 +1778,14 @@ export interface RunInternals {
      * channel, same posture as every other field here.
      */
     sessionReadStates?: SessionReadFileStates;
+    /**
+     * #616 — the Runner's per-session breaker ledger ({@link import("../auto-mode.js").AutoModeBreakerLedger}):
+     * the arming site's `onBreakerOpen` wrap records a trip here, the wiring-manifest phase of a LATER leg of
+     * the same session reads the most recent one onto `autoMode.breaker`. Always set by the Runner's own
+     * prepare call (overriding any caller value, like `sessionReadStates` beside it); absent on a standalone
+     * prepareTask, where no trip is recorded and none is reported. Trusted internals channel.
+     */
+    autoModeBreakerLedger?: import("../auto-mode.js").AutoModeBreakerLedger;
     onTaskNotification?: (notification: TaskNotificationPayload, 
     /** Injection tier (design/373 — the ladder is LIVE): "next" = the running turn's next boundary
      *  (arrival order, consecutive frames batch); "later" = the run's would-otherwise-stop seat
@@ -2357,7 +2381,7 @@ export interface HarnessHandlersDeps {
  * THE MEMBER SET IS MEASURED, NOT DESIGNED: it is exactly the union of what those consumers read off a
  * Runner today (a TS-Program census over `src/`, pinned in test/runner-self-seat.test.ts so a member
  * nobody reads reds as dead weight and a consumer reaching for a member outside it reds as a widening).
- * `swapModels`, `sideQuery` and the constructor are NOT here — no consumer reaches them; a host that
+ * `swapDeps`, `sideQuery` and the constructor are NOT here — no consumer reaches them; a host that
  * needs them holds the class. The class implements this interface, so the two cannot drift apart.
  *
  * Signatures are spelled out (not `Pick<Runner, …>`), because naming the class from here would be the
@@ -2365,7 +2389,7 @@ export interface HarnessHandlersDeps {
  */
 /**
  * The Runner's deployment deps as a LIVE read for the lanes that read them after an await (the resume ladder's
- * rungs). `Runner.deps` is not a constant: `swapModels` replaces the object, so a lane handed the object at its
+ * rungs). `Runner.deps` is not a constant: `swapDeps` replaces the object, so a lane handed the object at its
  * call would read a stale catalog — and a stale anything — where the one-function ladder read `this.deps.x` at the
  * instant of the read. The seat is the Runner's own view (a getter over the private field), so `runner.deps.x`
  * in a lane is exactly `this.deps.x` in the method it came from.

package/dist/core/runner/denial-limit-arms.d.ts

@@ -1,4 +1,4 @@
-import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type DenialLimitFallback, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback } from "../auto-mode.js";
+import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type AutoModeUnavailableCause, type DenialLimitFallback, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback } from "../auto-mode.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { PermissionResult, ResolvedAsk, ToolCallRequest } from "../tool-policy.js";
 import { type EngineNotice } from "../types.js";
@@ -84,10 +84,14 @@ export type InheritedAsk = Extract<PermissionResult, {
 }>;
 /** The members of a surviving ask that ride onto the approval request with a COMPUTED value — what the
  *  four request mint stations (the gate's own and the three inherited-lane ones) spread after the seats
- *  they spell themselves: the ask's origin word and its denial-limit fallback. */
+ *  they spell themselves: the ask's origin word, its denial-limit fallback and the classifier-unavailable
+ *  fact (#616). */
 export interface AskRequestCarry {
     origin?: AskOrigin;
     denialLimitFallback?: DenialLimitFallback;
+    classifierUnavailable?: {
+        readonly cause: AutoModeUnavailableCause;
+    };
 }
 /** The GATE's own mint station: both members are read off the surviving decision, which is the gate's
  *  OWN snapshot (its stamp point spreads the policy's object and stamps the word onto the copy), so the
@@ -99,7 +103,9 @@ export declare function gateAskCarry(decision: InheritedAsk, liveApprover: boole
  *  fallback member it captured — each read ONCE there and threaded here, never re-read off the
  *  caller-owned object (a stateful accessor could otherwise answer the card with one value and the
  *  settlement with another; a self-declared `origin` on the ancestor's decision is never read). */
-export declare function inheritedAskCarry(origin: AskOrigin, fallback: UnarmedDenialLimitFallback | undefined, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
+export declare function inheritedAskCarry(judged: Pick<Extract<InheritedClassifierJudgment<InheritedAsk>, {
+    kind: "resolve";
+}>, "origin" | "fallback" | "ask">, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
 /** What {@link judgeInheritedClassifier} hands back to the arm that called it. */
 export type InheritedClassifierJudgment<A extends InheritedAsk> = 
 /** The frozen classifier allowed — the arm returns its own allow shape (with or without the ask's rewrite). */
@@ -118,6 +124,11 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  *  unchanged-ask branches it is the SAME read the exclusion judged by (a caller-owned decision with a
  *  stateful accessor cannot answer the exclusion with one word and the card with another); on the
  *  bound branch it is derived from the re-spoken ask this station minted (its own object). */
+/** `ask` is the incoming ask unchanged — EXCEPT on an UNAVAILABLE round, where it is an engine-owned copy
+ *  carrying `classifierUnavailable: { cause }` (#616): the fact rides the ASK because the ask is what the
+ *  wrapper arms hand back to the gate when the frozen approver answers unavailable (the inherited-unavailable
+ *  float), and the gate's own park carry reads the fact off the decision it parks — a side member on this
+ *  judgment would have been lost on that route (codex r1). The request mint reads the same object. */
  | {
     kind: "resolve";
     ask: A;

package/dist/core/runner/denial-limit-arms.js

@@ -60,10 +60,18 @@ function fallbackCarry(fallback, liveApprover, tracker) {
     return { denialLimitFallback: liveApprover && tracker !== undefined ? tracker.armTimedWindow(fallback) : unarmedWindow(fallback) };
 }
 export function gateAskCarry(decision, liveApprover, tracker) {
-    return { ...(decision.origin !== undefined ? { origin: decision.origin } : {}), ...fallbackCarry(decision.denialLimitFallback, liveApprover, tracker) };
+    return {
+        ...(decision.origin !== undefined ? { origin: decision.origin } : {}),
+        ...fallbackCarry(decision.denialLimitFallback, liveApprover, tracker),
+        ...(decision.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: decision.classifierUnavailable.cause } } : {}),
+    };
 }
-export function inheritedAskCarry(origin, fallback, liveApprover, tracker) {
-    return { origin, ...fallbackCarry(fallback, liveApprover, tracker) };
+export function inheritedAskCarry(judged, liveApprover, tracker) {
+    return {
+        origin: judged.origin,
+        ...fallbackCarry(judged.fallback, liveApprover, tracker),
+        ...(judged.ask.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: judged.ask.classifierUnavailable.cause } } : {}),
+    };
 }
 export async function judgeInheritedClassifier(opts) {
     const { autoMode, ask, req } = opts;
@@ -77,8 +85,10 @@ export async function judgeInheritedClassifier(opts) {
         autoMode.denialTracking?.recordAllow();
         return { kind: "allow" };
     }
-    if (verdict.kind !== "block")
-        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+    if (verdict.kind !== "block") {
+        const resolved = verdict.kind === "unavailable" ? { ...ask, classifierUnavailable: { cause: verdict.cause } } : ask;
+        return { kind: "resolve", ask: resolved, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+    }
     const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
     const category = verdict.category ? inlineUntrusted(verdict.category) : "";
     const tracked = autoMode.denialTracking?.recordBlock();

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -107,7 +107,8 @@ export declare function pathRuleLaneAnswer(table: readonly PersistedRule[], req:
     root: string | undefined;
     sessionId: string | undefined;
     liveCwd: string | undefined;
-}): PersistedRuleHit | undefined;
+    home: string | undefined;
+}): PersistedRuleHit | PersistedRuleUnreadable | undefined;
 /** The two lanes prepare hands the gate. Each is `undefined` when its partition is not configured, so
  *  a deployment without one keeps a decision path byte-identical to a build without the feature. */
 export interface PermissionRuleLanes {
@@ -137,6 +138,11 @@ export declare function createPermissionRuleLanes(cfg: {
     /** The LIVE tracked working directory (adversarial-review P1): the base a relative cd resolves against
      *  after an earlier observable `cd`; read per call. */
     liveCwd: () => string | undefined;
+    /** #644 — the EXECUTION ENVIRONMENT's home directory (`ExecutionEnv.homeDir`, adapter-declared), the base a
+     *  `~/` path rule resolves against. `undefined` = the adapter declares none: a `~/` deny/ask row then reads
+     *  UNREADABLE for every call (a fail-closed ask), never the engine process's home. A declared value that is
+     *  not an absolute path is refused HERE, loudly (a bad declaration is a wiring defect, not an absence). */
+    home: string | undefined;
     /** True iff the reserved question-tool NAME resolves to the ENGINE's own content-ask tool on this leg. */
     questionToolMounted: boolean;
     questionToolName: string;

package/dist/core/runner/permission-rule-lanes.js

@@ -1,5 +1,6 @@
 import { persistedRuleMandateOf } from "../hooks.js";
 import { adjudicatePersistedPathRules, adjudicatePersistedRules, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
+import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";
 import { declaredPathTargetOf, protectivePathTargetOf } from "../tool-registry.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
@@ -31,15 +32,20 @@ export function persistedRuleAnswerOf(verdict) {
     return persistedRuleHitOf(verdict);
 }
 export function pathRuleLaneAnswer(table, req, ctx) {
-    const bases = { ...(ctx.root !== undefined ? { root: ctx.root } : {}), ...(ctx.liveCwd !== undefined ? { cwd: ctx.liveCwd } : {}) };
+    const bases = { ...(ctx.root !== undefined ? { root: ctx.root } : {}), ...(ctx.liveCwd !== undefined ? { cwd: ctx.liveCwd } : {}), ...(ctx.home !== undefined ? { home: ctx.home } : {}) };
     const tighten = effectivePathTargetOf(req, protectivePathTargetOf(req), bases);
     const allow = effectivePathTargetOf(req, declaredPathTargetOf(req), bases);
     if (tighten === undefined && allow === undefined)
         return undefined;
-    return persistedRuleHitOf(adjudicatePersistedPathRules(table, { tool: req.toolName, cwd: ctx.root, sessionId: ctx.sessionId }, { ...(tighten !== undefined ? { tighten } : {}), ...(allow !== undefined ? { allow } : {}) }, bases));
+    return persistedRuleAnswerOf(adjudicatePersistedPathRules(table, { tool: req.toolName, cwd: ctx.root, sessionId: ctx.sessionId }, { ...(tighten !== undefined ? { tighten } : {}), ...(allow !== undefined ? { allow } : {}) }, bases));
 }
 export function createPermissionRuleLanes(cfg) {
     const provider = cfg.provider;
+    if (cfg.home !== undefined && !isAbsolutePathForm(cfg.home)) {
+        const e = new Error(`the execution environment declares homeDir ${JSON.stringify(cfg.home)}, which is not an absolute path — a \`~/\` permission rule could not be resolved against it; declare an absolute home directory or none`);
+        e.code = "config.execution_env_home_dir_invalid";
+        throw e;
+    }
     if (cfg.localOwnerDeclared) {
         if (provider === undefined || !provider.partitions.durable) {
             throw new Error("RunnerDeps.localOwnerRules is declared but no durable permission-rule partition is wired — there is no bucket for the local owner to hold rules in; refusing rather than running as if the declaration were absent");
@@ -127,7 +133,7 @@ export function createPermissionRuleLanes(cfg) {
                 const table = view.rules;
                 const liveCwd = cfg.liveCwd();
                 if (grammar === "path") {
-                    return pathRuleLaneAnswer(table, req, { root: cfg.root, sessionId: cfg.sessionId, liveCwd });
+                    return pathRuleLaneAnswer(table, req, { root: cfg.root, sessionId: cfg.sessionId, liveCwd, home: cfg.home });
                 }
                 const command = req.args?.command;
                 if (typeof command !== "string")

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -49,7 +49,7 @@ export interface PrepareCapsAndWorkflowInput {
     deps: RunnerDeps;
     /** borrowed-readonly — the trusted spawn-side channel; the Workflow mount forwards `rootSessionId`, `placementRoot`,
      *  `onTaskNotification`, `workflowDepth`, and the capture-floor getter reads `memoryCaptureAncestors`. */
-    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors"> | undefined;
+    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume" | "autoModeBreakerLedger"> | undefined;
     /** borrowed-readonly — the acquired session; the classifier leg rebuilds its transcript window from `buildContext`. */
     session: Pick<StoredSession, "buildContext">;
     /** borrowed-readonly — the acquired session id (operator-line context, the refusal codes' phase record). */

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -1,6 +1,6 @@
 import { isSyntheticApiErrorMessage } from "../../internal/harness.js";
 import { createHash } from "node:crypto";
-import { deploymentSubagentTierModel, forkGovernanceDenial } from "../../agents/subagent.js";
+import { childThinkingSeat, deploymentSubagentThinking, deploymentSubagentTierModel, forkGovernanceDenial } from "../../agents/subagent.js";
 import { CROSS_SESSION_CLASSIFIER_RULE } from "../../agents/cross-session-envelope.js";
 import { createRunWorkflowTool } from "../../orchestration/run-workflow-tool.js";
 import { isSelfOrchestrationActive } from "../../orchestration/workflow-script-runner.js";
@@ -170,7 +170,10 @@ export async function prepareCapsAndWorkflow(input) {
         autoModeDecider = createAutoModeDecider({
             ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
             ...(am.failureThreshold !== undefined ? { failureThreshold: am.failureThreshold } : {}),
-            ...(am.onBreakerOpen !== undefined ? { onBreakerOpen: am.onBreakerOpen } : {}),
+            onBreakerOpen: (info) => {
+                internals?.autoModeBreakerLedger?.record(sessionId, { openedAtMs: Date.now(), lastCause: info.lastCause, failures: info.consecutiveFailures, runId });
+                am.onBreakerOpen?.(info);
+            },
             onClassified: (info) => emitTrace(deps.tracer, () => ({
                 kind: "auto_mode.classified",
                 version: 1,
@@ -246,6 +249,13 @@ export async function prepareCapsAndWorkflow(input) {
             parentModel: () => deploymentSubagentTierModel(runnerSelf.agentCatalog) ?? harnessRef.current?.getModel(),
             ...(spec.getApiKeyAndHeaders !== undefined ? { parentGetApiKeyAndHeaders: spec.getApiKeyAndHeaders } : {}),
             ...(frozenOnAsk !== undefined ? { parentOnAsk: frozenOnAsk } : {}),
+            ...(spec.durableApproval !== undefined ? { parentDurableApproval: { ...spec.durableApproval } } : {}),
+            ...(internals?.workflowParkedResume !== undefined
+                ? { parkedResume: (resumeFromRunId) => {
+                        const mine = internals.workflowParkedResume.filter((d) => d.runId === resumeFromRunId).map(({ runId: _r, ...rest }) => rest);
+                        return mine.length > 0 ? mine : undefined;
+                    } }
+                : {}),
             principal: spec.principal,
             oneShot: spec.oneShot,
             ...(resolvedInteractionPosture !== undefined ? { parentInteractionPosture: resolvedInteractionPosture } : {}),
@@ -258,7 +268,7 @@ export async function prepareCapsAndWorkflow(input) {
             autoModeReview: () => (autoModeDecider !== undefined ? { decider: autoModeDecider } : undefined),
             workflowDepth: internals?.workflowDepth,
             parentCwd: taskRootFinal,
-            parentThinking: () => harnessRef.current?.getThinkingLevel() ?? thinking,
+            parentThinking: () => childThinkingSeat(undefined, deploymentSubagentThinking(runnerSelf.agentCatalog?.roles), harnessRef.current?.getThinkingLevel() ?? thinking).thinking,
             parentReadFace: () => carrierReadFace(),
             parentReadDenyPatterns: () => {
                 const readDenyAdditionsNormalized = input.readDenyAdditionsNormalized();

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -49,8 +49,9 @@ export interface PrepareGateStationsInput {
      *  first-party tool's declared effect (never overrides a scanned one); the plan-mode deny reads it per call. */
     toolEffects: Map<string, ToolEffect>;
     /** borrowed-readonly — the deployment seats these stations read, as a Pick over the SAME `deps` object (receiver
-     *  preserved for `deps.onError?.()`): the write-protection table and its data root, the tracer, the error face. */
-    deps: Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir" | "tracer" | "onError">;
+     *  preserved for `deps.onError?.()`): the write-protection table and its data root, the tracer, the error face, and
+     *  the notice sink (#648: the gate's unresolvable-ask exit delivers `delegation.ask_unresolvable` through it). */
+    deps: Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir" | "tracer" | "onError" | "onNotice">;
     /** borrowed-mutable — the protocol-tools phase's arming belt. Writer here: `armed` ← the registration predicate, the
      *  one write; the refresh seam reads it. */
     toolCallGateArmedRef: {