@sema-agent/core 7.9.2 → 7.11.0

package/dist/core/read-only-shell.js

@@ -0,0 +1,316 @@
+import { readShellCommand } from "./shell-lexer.js";
+import { FIND_ACTION_PRIMARIES, FIND_NEWER_PRIMARY, FIND_VALUE_PRIMARIES, FLAG_VALUE_ACCEPTS, READ_ONLY_BARE_ONLY, READ_ONLY_BARE_PROGRAMS, READ_ONLY_COMMAND_TABLE, READ_ONLY_ENV_NAMES, READ_ONLY_EXACT_FORMS, READ_ONLY_GLOB_PROGRAMS, XARGS_READ_ONLY_TARGETS, dockerRetargetDanger, } from "./read-only-shell-table.js";
+const NOT = (reason) => ({ readOnly: false, reason });
+const READ_ONLY = { readOnly: true };
+const BARE_PROGRAMS = new Set(READ_ONLY_BARE_PROGRAMS.filter((p) => !p.includes(" ")));
+const BARE_MULTIWORD = READ_ONLY_BARE_PROGRAMS.filter((p) => p.includes(" ")).map((p) => p.split(" "));
+const GLOB_PROGRAMS = new Set(READ_ONLY_GLOB_PROGRAMS);
+const BARE_ONLY = new Set(READ_ONLY_BARE_ONLY);
+const ENV_NAMES = new Set(READ_ONLY_ENV_NAMES);
+const FIND_ACTIONS = new Set(FIND_ACTION_PRIMARIES);
+const FIND_VALUES = new Set(FIND_VALUE_PRIMARIES);
+const XARGS_TARGETS = XARGS_READ_ONLY_TARGETS;
+const TABLE_ROWS = Object.entries(READ_ONLY_COMMAND_TABLE)
+    .map(([key, row]) => ({ words: key.split(" "), row }))
+    .sort((a, b) => b.words.length - a.words.length);
+const READING_REDIRECTS = new Set(["<", "<<", "<<-", "<&", "<<<"]);
+const LITERAL_ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*)\+?=(?:"[^"$`\\]*"|'[^']*'|[A-Za-z0-9_./:+-]*)$/;
+const ASSIGNMENT_NAME = /^([A-Za-z_][A-Za-z0-9_]*)(?:\[[^\]]*\])?\+?=/;
+const FLAG_WORD = /^-[a-zA-Z0-9_-]/;
+const NUMBER_LITERAL = /^[-+]?(0[xX][0-9a-fA-F]+|[0-9]+#[0-9a-zA-Z]+|[0-9]*\.?[0-9]+([eE][-+]?[0-9]+)?)$/;
+const PRINTF_LENGTH = "[lLhqjzZt]*";
+const PRINTF_ESCAPE = new RegExp(`%[^%a-zA-Z]*${PRINTF_LENGTH}\\\\[0-7xX]`);
+const PRINTF_NUMERIC = new RegExp(`%[-+ 0#']*[0-9.*]*${PRINTF_LENGTH}[diouxXeEfFgGaAn]`);
+const JQ_DANGER_FLAG = /^['"]?-[a-zA-Z]*[fL]/;
+const JQ_DANGER_TEXT = /--from-file|--rawfile|--slurpfile|--run-tests|--library-path|\benv\b|\$ENV\b|\binclude\b|\bimport\b/;
+export function readOnlyShellVerdict(command, shape = readShellCommand(command)) {
+    if (shape.grouped)
+        return NOT("a subshell, group or control structure — not a flat list of simple commands");
+    if (shape.segments.length === 0)
+        return NOT("no command");
+    if (shape.backgrounded)
+        return NOT("a background `&` defers execution past the approval-time reading");
+    if (shape.strayRedirection)
+        return NOT("a redirection on a piece that runs no program — the shell still opens its target");
+    for (const seg of shape.segments) {
+        if (seg.unreadable !== undefined)
+            return NOT(seg.unreadable);
+        if (seg.peelUnreadable !== undefined)
+            return NOT(seg.peelUnreadable);
+        for (const w of [...seg.argv, ...seg.redirections.map((r) => r.target)]) {
+            if (expansionKind(w) === "variable")
+                return NOT("a variable, arithmetic or command substitution — its value is not known at approval time");
+            if (w.expands !== false && /[()]/.test(w.raw))
+                return NOT("a pattern with a parenthesised part (an extended pattern or a shell-specific glob qualifier)");
+            if (/^=[A-Za-z_]/.test(w.raw) || w.raw.includes("~["))
+                return NOT("a shell-specific expansion spelling (`=cmd`, `~[…]`)");
+        }
+    }
+    const programs = shape.segments.map((s) => peelBuiltinPrefix(s.argv.slice(leadingAssignmentCount(s.argv)).map((w) => w.text))[0] ?? "");
+    if (shape.segments.length > 1 && programs.includes("cd") && programs.includes("git"))
+        return NOT("a compound that changes directory and runs git");
+    for (const seg of shape.segments) {
+        const verdict = segmentVerdict(seg);
+        if (!verdict.readOnly)
+            return verdict;
+    }
+    return READ_ONLY;
+}
+function expansionKind(w) {
+    if (w.expands === false)
+        return "none";
+    if (/[$`]|[<>]\(/.test(w.raw))
+        return "variable";
+    if (w.expands === "many")
+        return "glob";
+    return "none";
+}
+function leadingAssignmentCount(argv) {
+    let k = 0;
+    while (k < argv.length && ASSIGNMENT_NAME.test(argv[k].raw))
+        k++;
+    return k;
+}
+function peelBuiltinPrefix(words) {
+    let t = words;
+    for (;;) {
+        if (t[0] === "command") {
+            let r = 1;
+            while (t[r] !== undefined && /^-p+$/.test(t[r]))
+                r++;
+            if (t[r] === "--")
+                r++;
+            if (r >= t.length || t[r].startsWith("-"))
+                return t;
+            t = t.slice(r);
+        }
+        else if (t[0] === "builtin") {
+            const r = t[1] === "--" ? 2 : 1;
+            if (r >= t.length)
+                return t;
+            t = t.slice(r);
+        }
+        else if (t[0] === "noglob") {
+            if (t.length <= 1)
+                return t;
+            t = t.slice(1);
+        }
+        else
+            return t;
+    }
+}
+function segmentVerdict(seg) {
+    for (const r of seg.redirections) {
+        const target = r.target.text;
+        if (!READING_REDIRECTS.has(r.op) && target !== "/dev/null" && !(r.op === ">&" && /^\d+$/.test(target)))
+            return NOT(`the redirection \`${r.op} ${target}\` writes`);
+        if (/^\/dev\/(tcp|udp)\//.test(target))
+            return NOT("a redirection to a network pseudo-device");
+    }
+    const k = leadingAssignmentCount(seg.argv);
+    for (const w of seg.argv.slice(0, k)) {
+        const m = LITERAL_ASSIGNMENT.exec(w.raw);
+        if (m === null)
+            return NOT(`the assignment \`${w.raw}\` is not a literal value`);
+        if (!ENV_NAMES.has(m[1]))
+            return NOT(`the environment variable \`${m[1]}\` can alter what a program does`);
+    }
+    const run = seg.argv.slice(k);
+    if (run.length === 0)
+        return NOT("a bare assignment runs no program");
+    const words = peelBuiltinPrefix(run.map((w) => w.text));
+    const program = words[0];
+    if (run.some((w) => expansionKind(w) === "glob"))
+        return GLOB_PROGRAMS.has(program) ? READ_ONLY : NOT(`\`${program}\` with a glob argument — the glob may name anything`);
+    const structural = structuralReading(words);
+    if (structural !== null)
+        return structural ? READ_ONLY : NOT(`\`${program}\` with these arguments is not a read-only form`);
+    return tableReading(words, run);
+}
+function structuralReading(words) {
+    const program = words[0];
+    if (BARE_ONLY.has(program))
+        return words.length === 1;
+    for (const form of READ_ONLY_EXACT_FORMS)
+        if (words.length === form.length && words.every((w, i) => w === form[i]))
+            return true;
+    if (BARE_PROGRAMS.has(program))
+        return true;
+    for (const form of BARE_MULTIWORD)
+        if (words.length >= form.length && form.every((w, i) => words[i] === w))
+            return form[0] !== "docker" || !dockerRetargetDanger(words);
+    if (program === "echo")
+        return true;
+    if (program === "printf")
+        return printfReading(words);
+    if (program === "ls")
+        return true;
+    if (program === "cd")
+        return words.length <= 2;
+    if (program === "find") {
+        for (let i = 1; i < words.length; i++) {
+            const w = words[i];
+            if (FIND_ACTIONS.has(w))
+                return false;
+            if (FIND_VALUES.has(w) || FIND_NEWER_PRIMARY.test(w)) {
+                i++;
+                continue;
+            }
+        }
+        return true;
+    }
+    if (program === "history")
+        return words.length === 1 || (words.length === 2 && /^\d+$/.test(words[1]));
+    if (program === "arch")
+        return words.length === 1 || (words.length === 2 && (words[1] === "-h" || words[1] === "--help"));
+    if (program === "ifconfig")
+        return words.length === 1 || (words.length === 2 && /^[a-zA-Z]/.test(words[1]));
+    return null;
+}
+function printfReading(words) {
+    if (words[1]?.startsWith("-") === true && words[1] !== "--")
+        return false;
+    const at = words[1] === "--" ? 2 : 1;
+    const format = words[at] ?? "";
+    if (format.includes("$"))
+        return false;
+    const stripped = format.replace(/%%/g, "");
+    if (PRINTF_ESCAPE.test(stripped) || /\\[uU]/.test(stripped))
+        return false;
+    if (PRINTF_NUMERIC.test(stripped) || /%[^%a-zA-Z]*\*/.test(stripped)) {
+        for (let i = at + 1; i < words.length; i++) {
+            const operand = words[i];
+            if (operand.includes("[") || operand.includes("`") || operand.includes("$(") || !NUMBER_LITERAL.test(operand))
+                return false;
+        }
+    }
+    return true;
+}
+function tableReading(words, run) {
+    const program = words[0];
+    const hit = TABLE_ROWS.find((r) => words.length >= r.words.length && r.words.every((w, i) => words[i] === w));
+    if (hit !== undefined) {
+        const args = words.slice(hit.words.length);
+        for (const a of args) {
+            if (a.includes("$"))
+                return NOT(`\`${program}\`: an argument spells \`$\``);
+            if (a.includes("{") && (a.includes(",") || a.includes("..")))
+                return NOT(`\`${program}\`: a brace pattern argument`);
+        }
+        if (!flagWalk(args, hit.row, program))
+            return NOT(`\`${program}\`: an option outside its read-only set (or a malformed option value)`);
+        if (hit.row.wordsShape !== undefined ? !hit.row.wordsShape(args) : run.some((w) => w.raw.includes("`")))
+            return NOT(`\`${program}\`: arguments outside its read-only form`);
+        if (hit.row.wordsShape === undefined && (program === "rg" || program === "grep" || program === "egrep" || program === "fgrep") && run.some((w) => /[\n\r]/.test(w.raw)))
+            return NOT(`\`${program}\`: a line break inside an argument`);
+        if (hit.row.dangerous?.(args) === true)
+            return NOT(`\`${program}\`: an argument form upstream marks as writing, executing or resolving`);
+        return READ_ONLY;
+    }
+    if (program === "uniq" && words.slice(1).every((w, i, all) => /^-[a-zA-Z]+$/.test(w) || /^--[a-zA-Z-]+(=\S+)?$/.test(w) || (i > 0 && /^-[fsw]$/.test(all[i - 1]) && /^\d+$/.test(w))))
+        return gitOptionGuard(words);
+    if (program === "jq" && jqReading(run.slice(run.length - words.length + 1)))
+        return gitOptionGuard(words);
+    return NOT(`\`${program}\` is not a read-only program (or not in a read-only form)`);
+}
+function gitOptionGuard(words) {
+    if (words.includes("git") && words.some((w) => /^-c(=|$)|^--exec-path(=|$)|^--config-env(=|$)/.test(w)))
+        return NOT("a git configuration override on the line");
+    return READ_ONLY;
+}
+function jqReading(args) {
+    if (args.some((w) => JQ_DANGER_FLAG.test(w.raw) || JQ_DANGER_TEXT.test(w.raw)))
+        return false;
+    let i = 0;
+    while (i < args.length && (/^-[a-zA-Z]+$/.test(args[i].raw) || /^--[a-zA-Z-]+(=\S+)?$/.test(args[i].raw)))
+        i++;
+    if (i >= args.length)
+        return false;
+    for (; i < args.length; i++) {
+        const w = args[i];
+        const quoted = /^'[^'`]*'$|^"[^"`]*"$/.test(w.raw);
+        if (!quoted && (/^[-'"\s]/.test(w.raw) || /['"]/.test(w.raw)))
+            return false;
+    }
+    return true;
+}
+function flagWalk(args, row, program) {
+    let i = 0;
+    while (i < args.length) {
+        let word = args[i];
+        if (word === "") {
+            i++;
+            continue;
+        }
+        if (program === "xargs" && (!word.startsWith("-") || word === "--")) {
+            if (word === "--" && i + 1 < args.length) {
+                i++;
+                word = args[i];
+            }
+            return XARGS_TARGETS.includes(word);
+        }
+        if (word === "--") {
+            if (row.respectsDoubleDash !== false)
+                break;
+            i++;
+            continue;
+        }
+        if (FLAG_WORD.test(word)) {
+            const eq = word.indexOf("=");
+            const flag = eq === -1 ? word : word.slice(0, eq);
+            const attached = eq === -1 ? undefined : word.slice(eq + 1);
+            const arity = row.safeFlags[flag];
+            if (arity === undefined) {
+                if (program === "git" && /^-\d+$/.test(flag)) {
+                    i++;
+                    continue;
+                }
+                if ((program === "grep" || program === "egrep" || program === "fgrep" || program === "rg") && !flag.startsWith("--") && flag.length > 2) {
+                    const base = flag.slice(0, 2);
+                    const rest = flag.slice(2);
+                    const baseArity = row.safeFlags[base];
+                    if (baseArity !== undefined && /^\d+$/.test(rest) && (baseArity === "number" || baseArity === "string")) {
+                        if (FLAG_VALUE_ACCEPTS[baseArity](rest)) {
+                            i++;
+                            continue;
+                        }
+                        return false;
+                    }
+                }
+                if (!flag.startsWith("--") && flag.length > 2) {
+                    for (let c = 1; c < flag.length; c++)
+                        if (row.safeFlags[`-${flag[c]}`] !== "none")
+                            return false;
+                    i++;
+                    continue;
+                }
+                return false;
+            }
+            if (arity === "none") {
+                if (attached !== undefined)
+                    return false;
+                i++;
+                continue;
+            }
+            let value;
+            if (attached !== undefined) {
+                value = attached;
+                i++;
+            }
+            else {
+                const next = args[i + 1];
+                if (next === undefined || FLAG_WORD.test(next))
+                    return false;
+                value = next;
+                i += 2;
+            }
+            if (arity === "string" && value.startsWith("-") && !(flag === "--sort" && program === "git" && /^-[a-zA-Z]/.test(value)))
+                return false;
+            if (!FLAG_VALUE_ACCEPTS[arity](value))
+                return false;
+            continue;
+        }
+        i++;
+    }
+    return true;
+}

package/dist/core/roles.d.ts

@@ -104,8 +104,9 @@ export interface ResolvedRole {
  * `modelRole` and NO run model: it runs on the deployment's roles alone — the boot default at the end of
  * its chain — and never follows the model a run was switched to. Only a run's CHILDREN follow the parent:
  * the delegation seat (`childModelSeat`) passes the parent's `Model` as `spec.model` with the role kept
- * on `modelRole`, so the role's presets still apply. A side channel that must follow a run passes that
- * run's model explicitly; nothing here infers it.
+ * on `modelRole` — and keeps that role on an EXPLICIT-model seat too, so the explicit branch below reads
+ * the child's presets off the subagent role, not the default one. A side channel that must follow a run
+ * passes that run's model explicitly; nothing here infers it.
  */
 export declare function resolveTaskModel(spec: {
     model?: ModelRef;

package/dist/core/runner/contracts.d.ts

@@ -1486,6 +1486,22 @@ export interface RunInternals {
      * see from `spec`. Consumed by the `run_workflow` tool wiring (S8c), not by `prepareTask` itself.
      */
     workflowDepth?: number;
+    /**
+     * #642 — the host's DECISIONS for parked workflow-agent rows (`wa*` rows with `status:"parked"`), a TRUSTED
+     * run channel like `workflowDepth` (never a `TaskSpec` field, never a tool argument — a model cannot decide
+     * an approval). A host that decided a workflow child's parked checkpoint launches the run that re-invokes
+     * `Workflow({resumeFromRunId})` with the decision here; the Workflow tool applies the entries naming the
+     * resumed run (`RunWorkflowOptions.parkedResume`) and the resume drives the parked child on instead of
+     * re-parking. `inheritedGate` is the cross-process re-supply of the checkpoint's opaque parent constraints
+     * (the same seat the background revival's `reviveClaim.parkedResume` takes). Consumed by the `run_workflow`
+     * tool wiring, not by `prepareTask` itself.
+     */
+    workflowParkedResume?: ReadonlyArray<{
+        runId: string;
+        token: CheckpointToken;
+        outcome: ResumeOutcome;
+        inheritedGate?: InheritedGate;
+    }>;
     /**
      * design/110 — set ONLY by the Agent tool's fork route (`Agent(subagent_type:"fork")`, a core caller) on the
      * child it spawns: this run IS a forked child. `prepareTask` threads it to tool ctx as `insideFork` so the
@@ -1762,6 +1778,14 @@ export interface RunInternals {
      * channel, same posture as every other field here.
      */
     sessionReadStates?: SessionReadFileStates;
+    /**
+     * #616 — the Runner's per-session breaker ledger ({@link import("../auto-mode.js").AutoModeBreakerLedger}):
+     * the arming site's `onBreakerOpen` wrap records a trip here, the wiring-manifest phase of a LATER leg of
+     * the same session reads the most recent one onto `autoMode.breaker`. Always set by the Runner's own
+     * prepare call (overriding any caller value, like `sessionReadStates` beside it); absent on a standalone
+     * prepareTask, where no trip is recorded and none is reported. Trusted internals channel.
+     */
+    autoModeBreakerLedger?: import("../auto-mode.js").AutoModeBreakerLedger;
     onTaskNotification?: (notification: TaskNotificationPayload, 
     /** Injection tier (design/373 — the ladder is LIVE): "next" = the running turn's next boundary
      *  (arrival order, consecutive frames batch); "later" = the run's would-otherwise-stop seat
@@ -2357,7 +2381,7 @@ export interface HarnessHandlersDeps {
  * THE MEMBER SET IS MEASURED, NOT DESIGNED: it is exactly the union of what those consumers read off a
  * Runner today (a TS-Program census over `src/`, pinned in test/runner-self-seat.test.ts so a member
  * nobody reads reds as dead weight and a consumer reaching for a member outside it reds as a widening).
- * `swapModels`, `sideQuery` and the constructor are NOT here — no consumer reaches them; a host that
+ * `swapDeps`, `sideQuery` and the constructor are NOT here — no consumer reaches them; a host that
  * needs them holds the class. The class implements this interface, so the two cannot drift apart.
  *
  * Signatures are spelled out (not `Pick<Runner, …>`), because naming the class from here would be the
@@ -2365,7 +2389,7 @@ export interface HarnessHandlersDeps {
  */
 /**
  * The Runner's deployment deps as a LIVE read for the lanes that read them after an await (the resume ladder's
- * rungs). `Runner.deps` is not a constant: `swapModels` replaces the object, so a lane handed the object at its
+ * rungs). `Runner.deps` is not a constant: `swapDeps` replaces the object, so a lane handed the object at its
  * call would read a stale catalog — and a stale anything — where the one-function ladder read `this.deps.x` at the
  * instant of the read. The seat is the Runner's own view (a getter over the private field), so `runner.deps.x`
  * in a lane is exactly `this.deps.x` in the method it came from.

package/dist/core/runner/denial-limit-arms.d.ts

@@ -1,4 +1,4 @@
-import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type DenialLimitFallback, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback } from "../auto-mode.js";
+import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type AutoModeUnavailableCause, type DenialLimitFallback, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback } from "../auto-mode.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { PermissionResult, ResolvedAsk, ToolCallRequest } from "../tool-policy.js";
 import { type EngineNotice } from "../types.js";
@@ -84,10 +84,14 @@ export type InheritedAsk = Extract<PermissionResult, {
 }>;
 /** The members of a surviving ask that ride onto the approval request with a COMPUTED value — what the
  *  four request mint stations (the gate's own and the three inherited-lane ones) spread after the seats
- *  they spell themselves: the ask's origin word and its denial-limit fallback. */
+ *  they spell themselves: the ask's origin word, its denial-limit fallback and the classifier-unavailable
+ *  fact (#616). */
 export interface AskRequestCarry {
     origin?: AskOrigin;
     denialLimitFallback?: DenialLimitFallback;
+    classifierUnavailable?: {
+        readonly cause: AutoModeUnavailableCause;
+    };
 }
 /** The GATE's own mint station: both members are read off the surviving decision, which is the gate's
  *  OWN snapshot (its stamp point spreads the policy's object and stamps the word onto the copy), so the
@@ -99,7 +103,9 @@ export declare function gateAskCarry(decision: InheritedAsk, liveApprover: boole
  *  fallback member it captured — each read ONCE there and threaded here, never re-read off the
  *  caller-owned object (a stateful accessor could otherwise answer the card with one value and the
  *  settlement with another; a self-declared `origin` on the ancestor's decision is never read). */
-export declare function inheritedAskCarry(origin: AskOrigin, fallback: UnarmedDenialLimitFallback | undefined, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
+export declare function inheritedAskCarry(judged: Pick<Extract<InheritedClassifierJudgment<InheritedAsk>, {
+    kind: "resolve";
+}>, "origin" | "fallback" | "ask">, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
 /** What {@link judgeInheritedClassifier} hands back to the arm that called it. */
 export type InheritedClassifierJudgment<A extends InheritedAsk> = 
 /** The frozen classifier allowed — the arm returns its own allow shape (with or without the ask's rewrite). */
@@ -118,6 +124,11 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  *  unchanged-ask branches it is the SAME read the exclusion judged by (a caller-owned decision with a
  *  stateful accessor cannot answer the exclusion with one word and the card with another); on the
  *  bound branch it is derived from the re-spoken ask this station minted (its own object). */
+/** `ask` is the incoming ask unchanged — EXCEPT on an UNAVAILABLE round, where it is an engine-owned copy
+ *  carrying `classifierUnavailable: { cause }` (#616): the fact rides the ASK because the ask is what the
+ *  wrapper arms hand back to the gate when the frozen approver answers unavailable (the inherited-unavailable
+ *  float), and the gate's own park carry reads the fact off the decision it parks — a side member on this
+ *  judgment would have been lost on that route (codex r1). The request mint reads the same object. */
  | {
     kind: "resolve";
     ask: A;

package/dist/core/runner/denial-limit-arms.js

@@ -60,10 +60,18 @@ function fallbackCarry(fallback, liveApprover, tracker) {
     return { denialLimitFallback: liveApprover && tracker !== undefined ? tracker.armTimedWindow(fallback) : unarmedWindow(fallback) };
 }
 export function gateAskCarry(decision, liveApprover, tracker) {
-    return { ...(decision.origin !== undefined ? { origin: decision.origin } : {}), ...fallbackCarry(decision.denialLimitFallback, liveApprover, tracker) };
+    return {
+        ...(decision.origin !== undefined ? { origin: decision.origin } : {}),
+        ...fallbackCarry(decision.denialLimitFallback, liveApprover, tracker),
+        ...(decision.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: decision.classifierUnavailable.cause } } : {}),
+    };
 }
-export function inheritedAskCarry(origin, fallback, liveApprover, tracker) {
-    return { origin, ...fallbackCarry(fallback, liveApprover, tracker) };
+export function inheritedAskCarry(judged, liveApprover, tracker) {
+    return {
+        origin: judged.origin,
+        ...fallbackCarry(judged.fallback, liveApprover, tracker),
+        ...(judged.ask.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: judged.ask.classifierUnavailable.cause } } : {}),
+    };
 }
 export async function judgeInheritedClassifier(opts) {
     const { autoMode, ask, req } = opts;
@@ -77,8 +85,10 @@ export async function judgeInheritedClassifier(opts) {
         autoMode.denialTracking?.recordAllow();
         return { kind: "allow" };
     }
-    if (verdict.kind !== "block")
-        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+    if (verdict.kind !== "block") {
+        const resolved = verdict.kind === "unavailable" ? { ...ask, classifierUnavailable: { cause: verdict.cause } } : ask;
+        return { kind: "resolve", ask: resolved, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+    }
     const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
     const category = verdict.category ? inlineUntrusted(verdict.category) : "";
     const tracked = autoMode.denialTracking?.recordBlock();

package/dist/core/runner/gate-exit.d.ts

@@ -218,6 +218,11 @@ export interface GatePass {
      *  touch. Recorded by the gate rather than read off `decisionReason` because that member is a policy's to
      *  compose (a policy stamping `"safety"` on its own ask must read as `policy`). Writer: the fold. */
     tightenedBy: AskOriginFacts["tightened"];
+    /** borrowed-mutable — the reversibility probe was consulted on this pass and DID NOT ANSWER (it threw or
+     *  timed out). The out-of-root mandate has no other source than the probe's answer, so an unanswered probe
+     *  leaves the call's boundary UNKNOWN: the allow layer (a stored allow rule, the read-only reader) must
+     *  not clear the surviving ask — a person confirms it. Writer: the fold. Reader: the lanes' mandate. */
+    probeUnanswered?: true;
     /** borrowed-mutable — the rewrite remembered BEFORE a hook-ask promotion / tighten, re-applied on the
      *  approved path (a redaction is not cancelled because a person confirmed). Writer: the fold. Readers: the
      *  fold's probe and write-protection judges, the lanes, the allow exit. */

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -107,7 +107,8 @@ export declare function pathRuleLaneAnswer(table: readonly PersistedRule[], req:
     root: string | undefined;
     sessionId: string | undefined;
     liveCwd: string | undefined;
-}): PersistedRuleHit | undefined;
+    home: string | undefined;
+}): PersistedRuleHit | PersistedRuleUnreadable | undefined;
 /** The two lanes prepare hands the gate. Each is `undefined` when its partition is not configured, so
  *  a deployment without one keeps a decision path byte-identical to a build without the feature. */
 export interface PermissionRuleLanes {
@@ -137,6 +138,11 @@ export declare function createPermissionRuleLanes(cfg: {
     /** The LIVE tracked working directory (adversarial-review P1): the base a relative cd resolves against
      *  after an earlier observable `cd`; read per call. */
     liveCwd: () => string | undefined;
+    /** #644 — the EXECUTION ENVIRONMENT's home directory (`ExecutionEnv.homeDir`, adapter-declared), the base a
+     *  `~/` path rule resolves against. `undefined` = the adapter declares none: a `~/` deny/ask row then reads
+     *  UNREADABLE for every call (a fail-closed ask), never the engine process's home. A declared value that is
+     *  not an absolute path is refused HERE, loudly (a bad declaration is a wiring defect, not an absence). */
+    home: string | undefined;
     /** True iff the reserved question-tool NAME resolves to the ENGINE's own content-ask tool on this leg. */
     questionToolMounted: boolean;
     questionToolName: string;

package/dist/core/runner/permission-rule-lanes.js

@@ -1,5 +1,6 @@
 import { persistedRuleMandateOf } from "../hooks.js";
 import { adjudicatePersistedPathRules, adjudicatePersistedRules, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
+import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";
 import { declaredPathTargetOf, protectivePathTargetOf } from "../tool-registry.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
@@ -31,15 +32,20 @@ export function persistedRuleAnswerOf(verdict) {
     return persistedRuleHitOf(verdict);
 }
 export function pathRuleLaneAnswer(table, req, ctx) {
-    const bases = { ...(ctx.root !== undefined ? { root: ctx.root } : {}), ...(ctx.liveCwd !== undefined ? { cwd: ctx.liveCwd } : {}) };
+    const bases = { ...(ctx.root !== undefined ? { root: ctx.root } : {}), ...(ctx.liveCwd !== undefined ? { cwd: ctx.liveCwd } : {}), ...(ctx.home !== undefined ? { home: ctx.home } : {}) };
     const tighten = effectivePathTargetOf(req, protectivePathTargetOf(req), bases);
     const allow = effectivePathTargetOf(req, declaredPathTargetOf(req), bases);
     if (tighten === undefined && allow === undefined)
         return undefined;
-    return persistedRuleHitOf(adjudicatePersistedPathRules(table, { tool: req.toolName, cwd: ctx.root, sessionId: ctx.sessionId }, { ...(tighten !== undefined ? { tighten } : {}), ...(allow !== undefined ? { allow } : {}) }, bases));
+    return persistedRuleAnswerOf(adjudicatePersistedPathRules(table, { tool: req.toolName, cwd: ctx.root, sessionId: ctx.sessionId }, { ...(tighten !== undefined ? { tighten } : {}), ...(allow !== undefined ? { allow } : {}) }, bases));
 }
 export function createPermissionRuleLanes(cfg) {
     const provider = cfg.provider;
+    if (cfg.home !== undefined && !isAbsolutePathForm(cfg.home)) {
+        const e = new Error(`the execution environment declares homeDir ${JSON.stringify(cfg.home)}, which is not an absolute path — a \`~/\` permission rule could not be resolved against it; declare an absolute home directory or none`);
+        e.code = "config.execution_env_home_dir_invalid";
+        throw e;
+    }
     if (cfg.localOwnerDeclared) {
         if (provider === undefined || !provider.partitions.durable) {
             throw new Error("RunnerDeps.localOwnerRules is declared but no durable permission-rule partition is wired — there is no bucket for the local owner to hold rules in; refusing rather than running as if the declaration were absent");
@@ -127,7 +133,7 @@ export function createPermissionRuleLanes(cfg) {
                 const table = view.rules;
                 const liveCwd = cfg.liveCwd();
                 if (grammar === "path") {
-                    return pathRuleLaneAnswer(table, req, { root: cfg.root, sessionId: cfg.sessionId, liveCwd });
+                    return pathRuleLaneAnswer(table, req, { root: cfg.root, sessionId: cfg.sessionId, liveCwd, home: cfg.home });
                 }
                 const command = req.args?.command;
                 if (typeof command !== "string")

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -49,7 +49,7 @@ export interface PrepareCapsAndWorkflowInput {
     deps: RunnerDeps;
     /** borrowed-readonly — the trusted spawn-side channel; the Workflow mount forwards `rootSessionId`, `placementRoot`,
      *  `onTaskNotification`, `workflowDepth`, and the capture-floor getter reads `memoryCaptureAncestors`. */
-    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors"> | undefined;
+    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume" | "autoModeBreakerLedger"> | undefined;
     /** borrowed-readonly — the acquired session; the classifier leg rebuilds its transcript window from `buildContext`. */
     session: Pick<StoredSession, "buildContext">;
     /** borrowed-readonly — the acquired session id (operator-line context, the refusal codes' phase record). */