@sema-agent/server 7.105.0 → 7.107.0

package/dist/task-settings.d.ts

@@ -35,25 +35,38 @@
  *  - (`hooks` NO LONGER deferred either — 轴B #2 注释保鲜:applied 形已接线(本文件 hooks 分片 +
  *    main.ts 单用户闸),仅 malformed 才报 deferred;旧「需要 remote hook-runner」是接线前拍照。)
  */
-import { type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PromptProvider } from "@sema-agent/core";
+import { type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PromptProvider, type PermissionMode } from "@sema-agent/core";
 import type { HooksConfig } from "@sema-agent/settings-schema/hooks";
 import { type KeyClosureIssue } from "./request-key-closure.js";
-/** The permission MODE a client may request (SDK `SettingsPermissions.defaultMode`), the [ref]/[ref] five-word
- *  table. ⚠️ This is a DELIBERATE deployment set, NOT a copy of any CC set ([ref] P2-1 corpus check): CC's own
- *  full enum is SIX words (= ours + `dontAsk`), CC's managed/remote form accepts FOUR (= ours − `bypassPermissions`,
- *  which it warns-and-ignores). Ours = {CC-remote four} ∪ {`bypassPermissions`} — registered divergence, not parity.
- *  `bypassPermissions` and `auto` joined the set with the [ref] fs-write gate: since the gate exists, every
- *  mode is a choice of HOW MUCH mode-derived gating the interpretation layer ADDS on top of the deployment baseline —
- *  `bypassPermissions` adds none (= the pre-[ref] behavior of every mode: "不加门" not "开门", [ref] table row 4; the
- *  deployment approval/governance baseline is composed OUTSIDE this derive and is untouchable from a settings stamp),
- *  and `auto` adds the same ask gate as `default` with core's auto-mode classifier screening the asks upstream
- *  (entitlement-gated in core, [ref]②). */
-export declare const SETTINGS_PERMISSION_MODES: readonly ["default", "acceptEdits", "plan", "bypassPermissions", "auto"];
-/** 五模式闭集的型形 —— **从值表派生**(S-496 / [ref]):改前本仓有 **4 份**同一张五词表(本处的手写联合 /
- *  下面 `coercePermissionModeStrict` 的运行期字面量链 / `http/admission.ts` 顶层 `permissionMode` 的比较链 /
- *  同文件 `settings.permissions.defaultMode` 的比较链),外加两句错误文案里各抄一遍词。现在值表一份、
- *  型与文案都从它派生,比较链改调 {@link isSettingsPermissionMode}。 */
-export type SettingsPermissionMode = (typeof SETTINGS_PERMISSION_MODES)[number];
+/**
+ * S-902(7.107.0,车QY 候裁 11 裁 A;[ref])—— core 的**每一个**权限模式词,本仓请求面收不收:`"request"` = 受理(顶层 `permissionMode` /
+ * `settings.permissions.defaultMode` / `?permissionMode=` 查询串三处同读),`"excluded"` = 显式排除(不上请求面)。
+ *
+ * 🔴 这张表是**表态**,不是词表的第二份:词与词序只从 core `PERMISSION_MODES` 来(下面 {@link SETTINGS_PERMISSION_MODES} 按它过滤);
+ * 表只对每个词说一句「收 / 不收」。`satisfies Record<PermissionMode, …>` 对 core 的词型**穷举**:core 加一个词 ⇒ 本表缺键 **编译红**
+ * (新词必须被表态一次,不会被静默收进请求面、也不会被静默漏掉);core 删 / 改名一个词 ⇒ 本表多键编译红(残条目不留)。
+ *
+ * 今天的表态(与 7.106.0 逐字同行为):五词受理;`dontAsk`(CC 的「自动拒」档,core 7.34.0 起第六词)**排除** —— 它上不上请求面是一件
+ * 新能力(未裁,本表不替它裁);不收它时提交面 400 `request.field_invalid`,续跑重放腿按 {@link coercePermissionMode} 的既有宽读折 `default`。
+ * 语义沿革(为什么是这五个、`bypassPermissions` / `auto` 何时进来):[ref] / [ref] / [ref] —— CC 自己的全集是六词,CC 托管 / 远端形收四词
+ * (= 本仓 − `bypassPermissions`),本仓 = {CC 远端四词} ∪ {`bypassPermissions`},登记过的偏离;生效模式原样过境 `TaskSpec.permissionMode`(S-877)。
+ */
+export declare const PERMISSION_MODE_REQUEST_FACE: {
+    readonly default: "request";
+    readonly acceptEdits: "request";
+    readonly plan: "request";
+    readonly auto: "request";
+    readonly bypassPermissions: "request";
+    readonly dontAsk: "excluded";
+};
+/** 请求面受理的模式词的型形 —— 从表态表派生(`"request"` 那几行的键)。 */
+export type SettingsPermissionMode = {
+    [M in PermissionMode]: (typeof PERMISSION_MODE_REQUEST_FACE)[M] extends "request" ? M : never;
+}[PermissionMode];
+/** 请求面受理的模式词(core 序)= core `PERMISSION_MODES` 过滤表态 `"request"`。wire 门、coerce 两族、两句 400 文案同读这一份。 */
+export declare const SETTINGS_PERMISSION_MODES: readonly SettingsPermissionMode[];
+/** 显式排除集(core 序)= core `PERMISSION_MODES` 过滤表态 `"excluded"`;今天恰是 `["dontAsk"]`。只作披露 / 钉读,不参与判定。 */
+export declare const SETTINGS_PERMISSION_MODES_EXCLUDED: readonly Exclude<PermissionMode, SettingsPermissionMode>[];
 /** 五词表的 wire 文案形(`"a" | "b" | …`)—— 两条 400 的句子从这里取词,不再各抄一份。 */
 export declare const SETTINGS_PERMISSION_MODE_WORDS: string;
 /** 闭集成员判定(`unknown` 入口用)—— 词表的**唯一**运行期读者:wire 门与 coerce 两族同调。 */
@@ -124,6 +137,12 @@ export declare function effectiveThinking(reasoningEffort: unknown, ultracode: b
  *  field is the explicit per-turn intent → it WINS over a bundle defaultMode). Creates a minimal settings object when
  *  no `body.settings` bundle was sent. The result flows through {@link applyTaskSettings} (tighten-only). */
 export declare function withPermissionMode(settings: ParsedTaskSettings | undefined, mode: SettingsPermissionMode): ParsedTaskSettings;
+/**
+ * 7.106.0 合并复审 X8(opus O-6)—— 请求**没有表态**模式时引擎实际跑的那个词。core 7.34.0 [ref]「Absent = `default`」
+ * (装树 `dist/core/runner/prepare-task.js` 的 `requested ?? "default"`)。只给**观测面**用(hook 载荷的 `permission_mode`,CC 恒带这个键):
+ * spec 过境点照旧不写键(`effectivePermissionMode` 缺席 ⇒ 不替调用方选 —— 那是引擎的默认,不是本仓的表态)。
+ */
+export declare const ENGINE_ABSENT_PERMISSION_MODE: "default";
 /**
  * [ref] §6-1 —— 本请求的**生效** permission mode,单点。优先序逐字同 {@link withPermissionMode}:
  * 顶层 `body.permissionMode`(本轮显式表态)赢过 bundle 的 `settings.permissions.defaultMode`;两处
@@ -137,51 +156,6 @@ export declare function withPermissionMode(settings: ParsedTaskSettings | undefi
 export declare function effectivePermissionMode(body: {
     permissionMode?: unknown;
 }, settings: ParsedTaskSettings | undefined): SettingsPermissionMode | undefined;
-/**
- * [ref] §2 —— 显式 permission mode → `TaskSpec.shellGate` 档位的**翻译表(单一真源)**。
- *
- *  · `bypassPermissions` ⇒ `"off"` —— CC `--dangerously-skip-permissions` 的对位裁定
- *    (与 fs-write 面的 bypass 臂两面归一,见 {@link deriveSettingsPolicy})。
- *  · `auto` ⇒ `"classify"` —— **[ref] §8 开口按施工期新披露亲裁改译**(原裁定字面是 off,
- *    §8 保留「core auto 分类器覆盖面有新披露时可独立再裁,表驱动一行」——新披露见下段):
- *
- *    ⚠️ **`auto` 这一行有一条待裁的开口([ref] §8 明列「core auto 分类器覆盖面有新披露时可独立再裁,
- *    表驱动一行」)。施工期交叉复审给出了那条新披露,已亲读安装包核实**:
- *      · core 只在**已经产生 `ask`** 之后才咨询分类器(`dist/core/hooks.js`:`if (input.autoMode &&
- *        decision.action === "ask" …)`);
- *      · 而 `shellGate:"off"` 下 core **不铸任何 shell 面的门**(`dist/core/runner/prepare-task.js` 的
- *        `shellGate === "off"` 臂反而发一条 `classification:"shell-gate-off"` 的 onError:「真可写 Bash 挂着
- *        却没有 shell 安全轴折叠」)。
- *    两条合起来:`auto` × off ⇒ Bash 既不产 ask、分类器也就永不被咨询 —— off 档下「筛选权交给分类器」
- *    不成立。故 auto 归 classify 组:分类器坐在 classify 产的 ask 之上,语义才真是「交给分类器」
- *    (良性只读命令由分类器自动放行,其余 ask;这正是 auto 模式的本义)。发车帖向 [ref] 裁定链披露此
- *    一行偏离;core auto 分类器若来日在 off 档下也有咨询点,可再裁回(表驱动一行)。
- *  · `default` / `acceptEdits` / `plan` ⇒ `"classify"` —— 这一档原先由壳无条件注入 `MANUAL_MODE_SHELL_GATE`
- *    供给(车道缺省走了 operator 通道),现在归位到表态轴。`plan` 本身 handsReadOnly(core 明写此档下
- *    shellGate 无效),给它 classify 纯为一致性。
- *
- * 🔴 **入参非可选**:缺席(无表态)不是这张表的一行 —— 它的语义是「不写这个键」,只能在调用点判。
- * 把它折进来会逼出一个 `undefined` 返回值,而那正是「写 off」与「不写」被混同的入口(core 的
- * 缺席默认是 off,但**写**一个 off 会成为 governance 的 base,与缺席不是同一件事)。
- *
- * 🔴 **闭集穷举表,无 default 臂**:五个模式词是封闭词表,新增一个模式而不更新本表
- * 是**编译错误**([ref] 的安全轴纪律:词表的未知项不许有静默兜底臂)。
- */
-export declare function shellGateForMode(effMode: SettingsPermissionMode): "off" | "classify";
-/**
- * [ref] —— 生效模式 → `TaskSpec.writeFace`(**写**面的 roots 容纳判断)。`"open"` = 工作区根之外也能写;
- * `undefined` = **不写这个键**(core 缺省 `"roots"`,与 7.77.0 及以前逐字节相同)。表逐字在
- * {@link MODE_ENGINE_FACES},裁定与硬边界写在 `resolve-spec.ts` 的写点上。
- *
- * 🔴 与 {@link shellGateForMode} 同律:入参非可选 —— 「表态缺席」不是这张表的一行(那是调用点判的
- * 「整个键都不写」),把它折进来就会逼出第二个 `undefined` 语义。
- */
-export declare function writeFaceForMode(effMode: SettingsPermissionMode): "open" | undefined;
-/**
- * [ref] ① —— 生效模式 → `TaskSpec.autoModeRequested`(auto **意图**座,CC 250「用户开」半场)。
- * `true` 只有 auto 一行;`undefined` = 不写键。表逐字在 {@link MODE_ENGINE_FACES}。
- */
-export declare function autoModeRequestedForMode(effMode: SettingsPermissionMode): true | undefined;
 /**
  * S-346 —— [ref] 技能清单预算两旋钮的**值域谓词**(一对具名单铸点)。
  *
@@ -262,6 +236,34 @@ export declare const MAX_SETTINGS_PERMISSION_RULES = 1000;
 export declare const MAX_SETTINGS_ENV_VARS = 256;
 export declare const MAX_SETTINGS_ENV_VALUE_CHARS = 32768;
 export declare const MAX_SETTINGS_ENV_KEY_CHARS = 256;
+/** 三桶(闭集;判据按此序逐桶判)。 */
+export declare const SETTINGS_PERMISSION_BUCKETS: readonly ["allow", "deny", "ask"];
+export type SettingsPermissionBucket = (typeof SETTINGS_PERMISSION_BUCKETS)[number];
+/** 拒因(闭集;wire 字段 `reason` 的全部词)。 */
+export declare const SETTINGS_PERMISSION_BUCKET_REFUSALS: readonly ["over_cap", "bad_entry"];
+export type SettingsPermissionBucketRefusal = (typeof SETTINGS_PERMISSION_BUCKET_REFUSALS)[number];
+/** 拒体的机读字段(按 `reason` 定形;原样进 wire 错误体 / `HttpError.extra`)。 */
+export type SettingsPermissionBucketIssueFields = {
+    readonly field: `settings.permissions.${SettingsPermissionBucket}`;
+    readonly reason: "over_cap";
+    readonly count: number;
+    readonly cap: number;
+} | {
+    readonly field: `settings.permissions.${SettingsPermissionBucket}`;
+    readonly reason: "bad_entry";
+    readonly index?: number;
+};
+/** 一次裁决的产物:wire 文案 + 机读字段。 */
+export interface SettingsPermissionBucketIssue {
+    readonly message: string;
+    readonly fields: SettingsPermissionBucketIssueFields;
+}
+/**
+ * 三桶的**唯一**判据(纯函数)。`perms` 不是对象 ⇒ 不判(那一形归「settings.permissions must be an object」那道门);桶缺席 / `null`
+ * ⇒ 不判(与 `permissions: null` 的「容器缺席」同一约定)。逐桶按 {@link SETTINGS_PERMISSION_BUCKETS} 的序:不是数组 ⇒ `bad_entry`(无
+ * `index`);超帽 ⇒ `over_cap`(先判,拒体有界);首个非串 / 空串项 ⇒ `bad_entry` + 它的下标。全合法 ⇒ `null`。
+ */
+export declare function settingsPermissionBucketIssue(perms: unknown): SettingsPermissionBucketIssue | null;
 /** 本 service 真正**消费**的 `settings` 顶层键 —— 闭集。每一个都有消费点:
  *  `env`/`hooks`/`model`/`outputStyle`/`permissions`/`ultracode` 与两个 `skillListing*` 在
  *  {@link parseTaskSettings};`webSearch` 在 `capabilities/scenarios.ts`(判决 `judgeRequestWebSearch`,单用户闸;形错在受理面 400,S-199)。

package/dist/task-settings.js

@@ -1,9 +1,18 @@
-import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, ruleToolGrammarOf, } from "@sema-agent/core";
+import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, ruleToolGrammarOf, } from "@sema-agent/core";
 import { findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
-export const SETTINGS_PERMISSION_MODES = ["default", "acceptEdits", "plan", "bypassPermissions", "auto"];
+export const PERMISSION_MODE_REQUEST_FACE = {
+    default: "request",
+    acceptEdits: "request",
+    plan: "request",
+    auto: "request",
+    bypassPermissions: "request",
+    dontAsk: "excluded",
+};
+export const SETTINGS_PERMISSION_MODES = PERMISSION_MODES.filter((m) => PERMISSION_MODE_REQUEST_FACE[m] === "request");
+export const SETTINGS_PERMISSION_MODES_EXCLUDED = PERMISSION_MODES.filter((m) => PERMISSION_MODE_REQUEST_FACE[m] === "excluded");
 export const SETTINGS_PERMISSION_MODE_WORDS = SETTINGS_PERMISSION_MODES.map((m) => `"${m}"`).join(" | ");
 export function isSettingsPermissionMode(raw) {
     return typeof raw === "string" && SETTINGS_PERMISSION_MODES.includes(raw);
@@ -37,6 +46,7 @@ export function withPermissionMode(settings, mode) {
     const base = settings ?? {};
     return { ...base, permissions: { ...base.permissions, defaultMode: mode } };
 }
+export const ENGINE_ABSENT_PERMISSION_MODE = "default";
 export function effectivePermissionMode(body, settings) {
     const requested = coercePermissionMode(body.permissionMode) ?? settings?.permissions?.defaultMode;
     const kill = settings?.permissions?.disableAutoMode;
@@ -44,22 +54,6 @@ export function effectivePermissionMode(body, settings) {
         return "default";
     return requested;
 }
-export function shellGateForMode(effMode) {
-    return MODE_ENGINE_FACES[effMode].shellGate;
-}
-const MODE_ENGINE_FACES = {
-    bypassPermissions: { shellGate: "off", writeFace: "open", autoModeRequested: undefined },
-    auto: { shellGate: "classify", writeFace: undefined, autoModeRequested: true },
-    default: { shellGate: "classify", writeFace: undefined, autoModeRequested: undefined },
-    acceptEdits: { shellGate: "classify", writeFace: undefined, autoModeRequested: undefined },
-    plan: { shellGate: "classify", writeFace: undefined, autoModeRequested: undefined },
-};
-export function writeFaceForMode(effMode) {
-    return MODE_ENGINE_FACES[effMode].writeFace;
-}
-export function autoModeRequestedForMode(effMode) {
-    return MODE_ENGINE_FACES[effMode].autoModeRequested;
-}
 export function skillListingBudgetFractionOk(v) {
     return typeof v === "number" && Number.isFinite(v) && v > 0 && v <= 1;
 }
@@ -88,11 +82,44 @@ function cleanEnvMap(v) {
     }
     return n > 0 ? out : undefined;
 }
-function cleanStringArray(v) {
-    if (!Array.isArray(v))
-        return undefined;
-    const out = v.filter((x) => typeof x === "string" && x.length > 0).slice(0, MAX_SETTINGS_PERMISSION_RULES);
-    return out.length > 0 ? out : undefined;
+export const SETTINGS_PERMISSION_BUCKETS = ["allow", "deny", "ask"];
+export const SETTINGS_PERMISSION_BUCKET_REFUSALS = ["over_cap", "bad_entry"];
+function bucketIssueMessage(f) {
+    switch (f.reason) {
+        case "over_cap":
+            return (`${f.field} has ${f.count} entries — at most ${f.cap} are accepted. Refused rather than truncated: a truncated list silently drops the rules past the cap, ` +
+                `and a dropped deny / ask rule is a tightening that never happened. Merge rules into broader patterns or trim the list`);
+        case "bad_entry":
+            return f.index === undefined
+                ? `${f.field} must be an array of non-empty rule strings — refused rather than ignored, because an ignored list reads as "in effect" to the caller`
+                : `${f.field}[${f.index}] is not a non-empty rule string — every entry must be one. Refused rather than dropped, because a dropped entry reads as "in effect" to the caller`;
+    }
+}
+export function settingsPermissionBucketIssue(perms) {
+    if (perms === null || typeof perms !== "object" || Array.isArray(perms))
+        return null;
+    for (const bucket of SETTINGS_PERMISSION_BUCKETS) {
+        const v = perms[bucket];
+        if (v === undefined || v === null)
+            continue;
+        const field = `settings.permissions.${bucket}`;
+        let fields;
+        if (!Array.isArray(v))
+            fields = { field, reason: "bad_entry" };
+        else if (v.length > MAX_SETTINGS_PERMISSION_RULES)
+            fields = { field, reason: "over_cap", count: v.length, cap: MAX_SETTINGS_PERMISSION_RULES };
+        else {
+            const index = v.findIndex((x) => typeof x !== "string" || x.length === 0);
+            if (index >= 0)
+                fields = { field, reason: "bad_entry", index };
+        }
+        if (fields !== undefined)
+            return { message: bucketIssueMessage(fields), fields };
+    }
+    return null;
+}
+function acceptedRuleList(v) {
+    return Array.isArray(v) && v.length > 0 ? v.slice() : undefined;
 }
 export const TASK_SETTINGS_KEYS = ["env", "hooks", "model", "outputStyle", "permissions", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch"];
 export const TASK_SETTINGS_PERMISSION_KEYS = ["allow", "ask", "defaultMode", "deny", "disableAutoMode"];
@@ -154,9 +181,12 @@ export function parseTaskSettings(raw) {
     }
     if (perms !== null && typeof perms === "object" && !Array.isArray(perms)) {
         const p = perms;
-        const allow = cleanStringArray(p.allow);
-        const deny = cleanStringArray(p.deny);
-        const ask = cleanStringArray(p.ask);
+        const bucketsOk = settingsPermissionBucketIssue(p) === null;
+        if (!bucketsOk)
+            deferred.push("permissions");
+        const allow = bucketsOk ? acceptedRuleList(p.allow) : undefined;
+        const deny = bucketsOk ? acceptedRuleList(p.deny) : undefined;
+        const ask = bucketsOk ? acceptedRuleList(p.ask) : undefined;
         const defaultMode = coercePermissionModeStrict(p.defaultMode);
         const rawKill = p.disableAutoMode;
         const disableAutoMode = rawKill === "disable" || rawKill === true || rawKill === false ? rawKill : undefined;
@@ -348,7 +378,7 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
         }
         case "default":
         case "auto": {
-            const p = compose(fsWriteGate(false), createWorkflowAskPolicy(workflowGate?.isExempt));
+            const p = compose(createWorkflowAskPolicy(workflowGate?.isExempt));
             return p ? { toolPolicy: p } : {};
         }
         case "bypassPermissions":

package/dist/tool-approval.d.ts

@@ -284,27 +284,6 @@ export interface ToolApprovalFrame {
      * ask」,治理策略产的与普通策略产的在这一个词上同形 ⇒ 顶替不了(逐字论证见 `governance-ask-marks.ts` 顶注)。
      */
     origin?: string;
-    /**
-     * **[ref] C3**(core 7.14.0;**ADDITIVE**,`"tool_approval"` only)—— `origin: "rule_store_unavailable"`
-     * 的**机制判别位**:持久规则车道这一次**读不下来的是哪一半**。core 闭二词
-     * (`RULE_STORE_UNREADABLE_KINDS`):`"store"` = 接上的规则店读不了(读失败 / 超时);`"call"` = 店读到了,
-     * 但**这条命令**按人的 deny/ask 行读不出来(收紧 lexer 的 `unreadable`:展开里含规则词、引号没闭、语法
-     * 错——具体那句在 `message` 里)。`AskRequest.ruleStoreUnreadable` 逐字透传。
-     *
-     * 🔴 **在场 ⇔ `origin === "rule_store_unavailable"`**(core 顶注逐字)。两词对审批人是两件事:`store`
-     * 指向「去看规则店 / 网络」,`call` 指向「这条命令的写法让规则判不了」——一个 origin 词对这两件事同形。
-     * 缺席 = 车道把店和这条命令都读通了,**或**本部署没接规则车道;消费端禁把缺席读成对规则店健康的断言。
-     *
-     * 🔴 **不枚举词表**(值形是 `string` 而不是本仓自铸的联合):词表单一属主在 core
-     * (`isRuleStoreUnreadable` 是它的成员判),抄一份会把 core 加的新词吞成缺席 —— 与 {@link origin} 逐字同规。
-     *
-     * 🔴 **echo-only,零消费**:策略自声明的值在 core 的**唯一**盖章点就被抹掉了,server 不重算、不再筛第二遍,
-     * 更不许据本键自铸第二张车道资格表 —— 同 `origin` / `denialLimitFallback` 两条顶注的同一条禁令。
-     *
-     * ⚰️ 本键的前任 `classifierUnavailable`(S-185 / [ref])随 core 7.14.0 [ref] **整族退役**:引擎那份事实改骑
-     * `GateDisposition.denied.cause`(`tool_end.gate` / `permissionDenied.gate`),ask 面自此没有这一位。
-     */
-    ruleStoreUnreadable?: string;
     /**
      * **[ref]**(core 7.19.0;**ADDITIVE**,`"tool_approval"` only)—— 这只**根外读** ask 的**清障目录**:
      * 把 `dir` 加进本会话的读目录(壳侧既有的 `/add-dir` 口),同一条调用就不会再问。
@@ -319,7 +298,7 @@ export interface ToolApprovalFrame {
      *
      * 🔴 **echo-only,零判读**:server 不从命令文本重推目录,也不复核它真不真能清掉这只 ask —— core 已经
      * 把提议的根放回读边界又走了一遍才递出来,下游再判一遍就是同一事实的第二个判官(与 `origin` /
-     * `ruleStoreUnreadable` / `denialLimitFallback` 三条顶注的同一条禁令)。
+     * `denialLimitFallback` 两条顶注的同一条禁令)。
      *
      * 🔴 **只此一面**:core 的负控逐字写着「the durable park row has no twin of this seat in this version」——
      * 一只 PARKED 的根外读 ask 渲的仍是单独那张确认卡。所以 `card_json` / 耐久面**没有**这一座,本仓也不
@@ -849,6 +828,10 @@ export type UnattendedPolicyRefusal = Extract<AskOutcome, {
  *  铸:park 政策的路由答 `"unavailable"`,deny 政策的 {@link UnattendedPolicyRefusal}。没有布尔臂(S-689:裸 `false`
  *  是人的拒绝,这个口从不替人说话)。 */
 export type UnattendedAskOutcome = Extract<AskOutcome, "unavailable"> | UnattendedPolicyRefusal;
+/** S-877 候裁 16:耐久会话授权店的读面(`src/plugins/approval-exemption-store.ts` 的 `has`,结构型 —— 协调器不值引店模块)。 */
+export interface SessionGrantReader {
+    has(sessionId: string, canonicalToolName: string): Promise<boolean>;
+}
 /**
  * [ref] 车3 刀 3b —— 「流内审批协议到底上不上场」的**单一谓词**(设计稿 §2.3 注入 / §2.4 能力面 /
  * §8.4 park 设施自检,三处同一份判据)。
@@ -1140,6 +1123,9 @@ export declare class ToolApprovalCoordinator {
      *  腿闭(`runWithContext` finally)。**纯观察面**:sink 自己吞写失败并 `recordFailOpen`,任何一次审计
      *  写都不得改变审批终局(店头注成文)。SQL 车道恒缺席(那里有真 ask 店)。 */
     private readonly askAudit;
+    /** S-877 候裁 16 → A:耐久会话授权店的**读面**(`/decide` 的 `remember:"session"` 写、本席读)。在场 ⇔ 部署有 store backend
+     *  (装配点 `boot/coordinators.ts`,与 `/decide` 写的是**同一只**店)。读口唯一 = {@link standingGrantSettles}。 */
+    private readonly sessionGrants;
     constructor(opts?: {
         ttlMs?: number;
         /** [ref](案A):零活流铸造的 ask 的窗(见 {@link unreachedTtlMs})。装配点在协议**上场**时才传
@@ -1167,6 +1153,8 @@ export declare class ToolApprovalCoordinator {
         parkTombstonePerPrincipalMax?: number;
         /** [ref] (c):local 车道审计 sink(见 {@link ToolApprovalCoordinator.askAudit})。 */
         askAudit?: ApprovalAskAuditSink;
+        /** S-877 候裁 16:耐久会话授权店的读面(见 {@link ToolApprovalCoordinator.sessionGrants})。 */
+        sessionGrants?: SessionGrantReader;
     });
     /**
      * [ref] R-13 C —— 「**无人可答**」这一类终局的**唯一**成形口(park 路由 vs deny 政策)。
@@ -1350,6 +1338,47 @@ export declare class ToolApprovalCoordinator {
      *  面)—— 把它混进本名单会让「同 askId 的重复本地注册」拿到裸 deny,而赢家拿的是 park 路由:同一条
      *  持久行、两种 live 终局。那一支改走 {@link settleSameAskIdParkRoute}。 */
     private settleVoidedSiblings;
+    /** [ref]/[ref]:本只 ask 的治理来源标(一次 peek,非消费式)。**出处决定判定**:按 `origin` 算 broker key(与写侧同一把),
+     *  投递到哪条连接不参与 —— 见 {@link AskOriginIdentity} 顶注。 */
+    private governanceForcedOf;
+    /**
+     * 🔴 **S-877 候裁 16 → A —— 站着的答案(会话授权)的唯一兑现口**(主会话裁定 2026-09-29;core 7.34.0 wire 段逐字指定的兑现位:
+     * 「a host approval seat that settles asks from a session grant reads it [`authoredBy`] to keep its hands off」)。
+     *
+     * **一条判据**:一只 ask 由会话授权代答 ⇔ ① 它是站着的答案退得掉的一问({@link standingAnswerMayRetire} —— 治理强制 /
+     * `requiresRealApproval` / `mandated` 三位的既有排除一字不动;运维「恒问人」的卡(`APPROVAL_NEVER_AUTO` / 耐久预算耗尽)
+     * 自 S-877 起盖部署出身 ⇒ core 盖 `mandated`,同落这一臂)∧ ② 有真会话 ∧ ③ 两只授权店任一命中:live `allow_session` 的
+     * 进程内表(按能力桶,[ref]② 修2)或耐久 `/decide` `remember:"session"` 的豁免店(按 canonical 工具名,`/decide` 写的同一只店;
+     * 读失败 ⇒ 不命中 = fail-closed,人多看一张卡而不是被静默代答)∧ ④ 行上没有与本地 peek 矛盾的出处({@link sessionGrantUncontestedByRow})。
+     *
+     * **两个读位、一只店、按问句的作者分**(收车档 ⑩ 16):本席兑现**引擎自装的问**(模式写门 / 形状层 —— core 7.34.0 起它们是引擎
+     * 自己的层、不读任何豁免,折叠 ask 赢 ⇒ 策略层探针对它们恒无效,codex F2);**本仓自己的问**(durable 名单门、workflow 问句门、
+     * acceptEdits 的 cwd 域写门)照旧在各自的层上读同一只店「不问」。为什么两处都要:子代经父约束链继承到的问到达祖先审批席时 core
+     * 盖 `mandated`(`ruleClearanceOf` 的 inheritedUnresolved / ancestorResolved 门),本席依约不退役 —— 只有策略层的「不问」够得着继承链
+     * (主会话裁定原想退役那三只探针,施工中被 test/parked-decide-leg.test.ts「[候裁② 修]remember 全链行为」证伪,收车档 ⑩ 16-⑤)。
+     * 本席的两个入口(`askBroadcast` 开头、窗 0 / 无活流身份席 {@link boundUnattendedAsk})都只调这一只。
+     */
+    private standingGrantSettles;
+    /** 耐久豁免店的一次读(fail-closed:读抛 **或超时** ⇒ 不命中 + warn)。只由 {@link standingGrantSettles} 调。
+     *  🔴 **有界**(codex 续车轮 F2):这一读排在呈卡 / 待决登记 / 审批计时器**之前**,一次黑洞化的店读会让整只 ask 连一个兜底都没有地
+     *  永久悬挂(与 R2-5 抓过的 `ensureAsk` 同病)。期限取 {@link DURABLE_CONVERGE_READ_TIMEOUT_MS}(只读复核,不是做事的调用);超时 ⇒
+     *  按未命中继续既有的呈卡 / 无人可答路径 —— 方向是人多看一张卡,不是被静默代答。迟到的真答案不追认(授权是「这一问要不要问」,
+     *  问已经发出去了)。 */
+    private durableGrantHas;
+    /**
+     * 🔴 **S-877 候裁 16 —— 窗 0 席**:本席**不呈卡**,但在报「无人可答」之前先问站着的答案。装配点 = 三条腿的 `windowZero` 席
+     * (sync `http/routes/tasks.ts`、bg `runs.ts`、resume `http/resume-legs.ts`)。修前三处是装配层的就地闭包 `() => unattendedAskOutcome(...)`
+     * —— 不读授权,引擎那一问(模式写门 / 形状层)在窗 0 部署上 remember 恒无效。改形后:授权命中 ⇒ `true`;否则逐字走
+     * {@link unattendedAskOutcome} 这**一个**政策口(五臂一处施加,[ref] R-13 C 不变)。
+     * parked 赎回腿的继承条目席**不**改:那条腿上到席的问全是继承问(core 盖 `mandated`),本席依约不退役,改了也兑现不了任何东西 ——
+     * 赎回腿上那类问的授权照旧由重建链里 durable 名单门的策略层探针兑现(锚 = 行的 root 会话)。复活子代**自己的**引擎问(模式写门 /
+     * 形状层)则经赎回腿铸的 execute ctx `onAsk` 落本席(身份 = 行的 root 会话,S-877 四续 ⑪,`parked-decide.ts` `approverSeatFor`)。
+     */
+    boundUnattendedAsk: (identity: {
+        owner: string | null;
+        taskId: string;
+        sessionId?: string;
+    }) => ((req: AskRequest) => Promise<AskOutcome>);
     /**
      * 🔴 session grant 短路前的**持久出处复核**([ref] 的 codex R1-[high] 补丁;[ref] 换判据)。
      *

package/dist/tool-approval.js

@@ -363,6 +363,7 @@ export class ToolApprovalCoordinator {
     parkTombstonePerPrincipalMax;
     parkedRedeem;
     askAudit;
+    sessionGrants;
     constructor(opts) {
         this.ruleConsent = opts?.ruleConsent;
         this.ruleScopeRootFor = opts?.ruleScopeRootFor;
@@ -379,6 +380,7 @@ export class ToolApprovalCoordinator {
         this.parkTombstoneTtlMs = opts?.parkTombstoneTtlMs ?? DEFAULT_PARK_TOMBSTONE_TTL_MS;
         this.parkTombstonePerPrincipalMax = opts?.parkTombstonePerPrincipalMax ?? DEFAULT_PARK_TOMBSTONE_PER_PRINCIPAL_MAX;
         this.askAudit = opts?.askAudit;
+        this.sessionGrants = opts?.sessionGrants;
     }
     unattendedOutcome(site) {
         let outcome;
@@ -696,6 +698,45 @@ export class ToolApprovalCoordinator {
                 entry.settle(false, "expired");
         }
     }
+    governanceForcedOf(origin, req) {
+        return (this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(origin.owner, origin.sessionId, origin.taskId))).isMarked(req.toolCallId);
+    }
+    async standingGrantSettles(origin, req, governanceForced) {
+        if (!standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true }))
+            return false;
+        const sessionId = origin.sessionId;
+        if (!sessionId)
+            return false;
+        const live = this.allowAllSessions.has(sessionAllowKey(origin.owner, sessionId, sessionAllowCategory(req.toolName)));
+        const durable = !live && (await this.durableGrantHas(sessionId, req.toolName));
+        if (!live && !durable)
+            return false;
+        if (!(await this.sessionGrantUncontestedByRow(origin, req)))
+            return false;
+        if (durable)
+            defaultLogger.info("approval_exempted", { sessionId, toolName: req.toolName, seat: "approval_seat" });
+        return true;
+    }
+    async durableGrantHas(sessionId, canonicalToolName) {
+        if (!this.sessionGrants)
+            return false;
+        try {
+            const hit = await this.withStoreDeadline(this.sessionGrants.has(sessionId, canonicalToolName), "sessionGrants.has(standing-grant)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
+            return hit === true;
+        }
+        catch (err) {
+            defaultLogger.warn("session_grant_read_failed", { sessionId, toolName: canonicalToolName, error: String(err).slice(0, 200) });
+            return false;
+        }
+    }
+    boundUnattendedAsk = (identity) => {
+        return async (req) => {
+            const origin = { owner: identity.owner, taskId: identity.taskId, ...(identity.sessionId !== undefined ? { sessionId: identity.sessionId } : {}), legKey: "" };
+            if (await this.standingGrantSettles(origin, req, this.governanceForcedOf(origin, req)))
+                return true;
+            return this.unattendedAskOutcome({ taskId: identity.taskId, owner: identity.owner, toolName: req.toolName });
+        };
+    };
     async sessionGrantUncontestedByRow(origin, req) {
         if (!this.askStore)
             return true;
@@ -944,6 +985,9 @@ export class ToolApprovalCoordinator {
     async askBroadcast(origin, ctxs, req, signal) {
         if (signal?.aborted)
             return false;
+        const governanceForced = this.governanceForcedOf(origin, req);
+        if (await this.standingGrantSettles(origin, req, governanceForced))
+            return true;
         const aliveCtxs = ctxs.filter((c) => !c.abortSignal?.aborted);
         const reachability = aliveCtxs.length === 0 ? "unreached" : "reachable";
         if (reachability === "unreached") {
@@ -952,13 +996,6 @@ export class ToolApprovalCoordinator {
             }
         }
         const primary = aliveCtxs[0];
-        const governanceForced = (this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(origin.owner, origin.sessionId, origin.taskId))).isMarked(req.toolCallId);
-        if (standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true }) &&
-            origin.sessionId &&
-            this.allowAllSessions.has(sessionAllowKey(origin.owner, origin.sessionId, sessionAllowCategory(req.toolName))) &&
-            (await this.sessionGrantUncontestedByRow(origin, req))) {
-            return true;
-        }
         const releaseAdmission = this.admit(origin.taskId, origin.owner);
         if (!releaseAdmission) {
             defaultLogger.warn("approval admission gate: too many pending asks — routing to park", {
@@ -1009,7 +1046,6 @@ export class ToolApprovalCoordinator {
             ...(ruleLaneMaterial !== undefined ? { ruleOffers: ruleLaneMaterial.offers } : {}),
             ...((a) => (a !== undefined ? { ruleOffersAbsence: a } : {}))(readRuleOffersAbsence(req)),
             ...((f) => (f !== undefined ? { denialLimitFallback: f } : {}))(readDenialLimitFallback(req)),
-            ...(typeof req.ruleStoreUnreadable === "string" && req.ruleStoreUnreadable.length > 0 ? { ruleStoreUnreadable: req.ruleStoreUnreadable } : {}),
             ...((g) => (g !== undefined ? { readRootCandidate: g } : {}))(readReadRootCandidate(req)),
             ...((c) => (c !== undefined ? { probeCause: c } : {}))(readProbeCause(req)),
             ...((c) => (c !== undefined ? { ruleEvidence: c } : {}))(readRuleEvidence(req)),

package/dist/tool-declaration-http-status.d.ts

@@ -0,0 +1,12 @@
+export declare const TOOL_DECLARATION_HTTP_STATUS: {
+    readonly "config.tool_mount_denied": 400;
+    readonly "config.tool_roster_bound": 503;
+    readonly "config.tool_name_too_long": 503;
+    readonly "config.tool_contract_too_long": 503;
+    readonly "config.tool_schema_bound": 503;
+    readonly "config.tool_face_invalid": null;
+    readonly "config.tool_name_invalid": null;
+    readonly "config.egress_requires_write_effect": null;
+    readonly "config.reserved_tool_name": null;
+};
+//# sourceMappingURL=tool-declaration-http-status.d.ts.map

package/dist/tool-declaration-http-status.js

@@ -0,0 +1,12 @@
+export const TOOL_DECLARATION_HTTP_STATUS = {
+    "config.tool_mount_denied": 400,
+    "config.tool_roster_bound": 503,
+    "config.tool_name_too_long": 503,
+    "config.tool_contract_too_long": 503,
+    "config.tool_schema_bound": 503,
+    "config.tool_face_invalid": null,
+    "config.tool_name_invalid": null,
+    "config.egress_requires_write_effect": null,
+    "config.reserved_tool_name": null,
+};
+//# sourceMappingURL=tool-declaration-http-status.js.map

package/dist/trace/core-keyset-guard.d.ts

@@ -43,8 +43,8 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable" | "readRootCandidate" | "mandated" | "mandate";
-type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate";
+type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
 type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "inputHasBidi";
@@ -133,19 +133,19 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable" | "mandated" | "mandate";
-type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate";
+type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld" | "authoredBy";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
 type ParkArmKeys = keyof Extract<PendingAction, {
     kind: "tool_approval";
 }>;
 type ParkArmQueueProjected = "toolName" | "toolCallId" | "boundInputHash" | "ruleOffers" | "hasBidiControls" | keyof import("../approval-card.js").ParkRowFacts;
-type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "ruleStoreUnreadable";
+type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy";
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "approverPosture" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory";
 type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
@@ -163,7 +163,7 @@ type GateOutcomeProjected = "disposition" | "settlement" | "origin";
 type _GuardGateOutcome = AssertAllKeysHandled<Exclude<keyof GateOutcome, GateOutcomeProjected>>;
 type _GuardGateOutcomeReverse = AssertAllKeysHandled<Exclude<GateOutcomeProjected, keyof GateOutcome>>;
 type GateDispositionKeys = GateDisposition extends infer D ? (D extends object ? keyof D : never) : never;
-type GateDispositionProjected = "kind" | "deniedBy" | "cause" | "classifier";
+type GateDispositionProjected = "kind" | "deniedBy" | "cause" | "classifier" | "released" | "mode" | "askClass" | "classes";
 type _GuardGateDisposition = AssertAllKeysHandled<Exclude<GateDispositionKeys, GateDispositionProjected>>;
 type _GuardGateDispositionReverse = AssertAllKeysHandled<Exclude<GateDispositionProjected, GateDispositionKeys>>;
 type SettlementProjected = "kind" | "who" | "when" | "note";

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /**
  * S-690 —— **本仓自铸**的通告码与它们的受众(码 / 铸点 / 受众三者的属主都是本仓)。

package/dist/trace/engine-notice-wire.js

@@ -27,6 +27,11 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "approval.read_root_grant_rejected",
     "instructions.source_changed",
     "session.records_skipped",
+    "classifier.unavailable",
+    "config.permission_mode_unavailable",
+    "permission.ask_released_by_mode",
+    "permission.read_deny_unapplied",
+    "permission.rule_store_unavailable",
 ];
 export const SERVER_NOTICE_AUDIENCE = {
     "instructions.source_changed": "user",