@sema-agent/server 7.116.0 → 7.117.0

package/dist/task-settings.js

@@ -1,6 +1,8 @@
-import { combinePolicies, createFsWriteGatePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, ruleToolGrammarOf, } from "@sema-agent/core";
+import { combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, ruleToolGrammarOf, } from "@sema-agent/core";
 import { unmatchableToolNamesRefusal } from "./config.js";
 import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
+import { allowLayerEntryCountIssue, describeAllowLayerOverCap, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { tightenGoverned } from "./governance-overrides.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 import { heldRuleName } from "./tool-rule-names.js";
@@ -83,15 +85,28 @@ function cleanEnvMap(v) {
 }
 export const SETTINGS_PERMISSION_BUCKETS = ["allow", "deny", "ask"];
 export const SETTINGS_PERMISSION_BUCKET_REFUSALS = ["over_cap", "bad_entry"];
-function bucketIssueMessage(f) {
+const BUCKET_ENTRY_RULE = { allow: "allow_layer", deny: "rule_policy", ask: "rule_policy" };
+function bucketIssueMessage(f, rule) {
     switch (f.reason) {
         case "over_cap":
-            return (`${f.field} has ${f.count} entries — at most ${f.cap} are accepted. Refused rather than truncated: a truncated list silently drops the rules past the cap, ` +
-                `and a dropped deny / ask rule is a tightening that never happened. Merge rules into broader patterns or trim the list`);
+            switch (rule) {
+                case "rule_policy":
+                    return (`${f.field} has ${f.count} entries — at most ${f.cap} are accepted. Refused rather than truncated: a truncated list silently drops the rules past the cap, ` +
+                        `and a dropped deny / ask rule is a tightening that never happened. Merge rules into broader patterns or trim the list`);
+                case "allow_layer":
+                    return describeAllowLayerOverCap(f.field, f.count);
+            }
         case "bad_entry":
-            return f.index === undefined
-                ? `${f.field} must be an array of non-empty rule strings — refused rather than ignored, because an ignored list reads as "in effect" to the caller`
-                : `${f.field}[${f.index}] is not a non-empty rule string — every entry must be one. Refused rather than dropped, because a dropped entry reads as "in effect" to the caller`;
+            switch (rule) {
+                case "rule_policy":
+                    return f.index === undefined
+                        ? `${f.field} must be an array of non-empty rule strings — refused rather than ignored, because an ignored list reads as "in effect" to the caller`
+                        : `${f.field}[${f.index}] is not a non-empty rule string — every entry must be one. Refused rather than dropped, because a dropped entry reads as "in effect" to the caller`;
+                case "allow_layer":
+                    return f.index === undefined
+                        ? `${f.field} must be an array of permission-rule strings — refused rather than ignored, because an ignored list reads as "in effect" to the caller`
+                        : `${f.field}[${f.index}] is not a string — every entry must be a permission-rule string. Refused rather than dropped, because a dropped entry reads as "in effect" to the caller`;
+            }
     }
 }
 export function settingsPermissionBucketIssue(perms) {
@@ -102,18 +117,34 @@ export function settingsPermissionBucketIssue(perms) {
         if (v === undefined || v === null)
             continue;
         const field = `settings.permissions.${bucket}`;
+        const rule = BUCKET_ENTRY_RULE[bucket];
         let fields;
         if (!Array.isArray(v))
             fields = { field, reason: "bad_entry" };
-        else if (v.length > MAX_PERMISSION_RULES_PER_LIST)
-            fields = { field, reason: "over_cap", count: v.length, cap: MAX_PERMISSION_RULES_PER_LIST };
         else {
-            const index = v.findIndex((x) => typeof x !== "string" || x.length === 0);
-            if (index >= 0)
-                fields = { field, reason: "bad_entry", index };
+            switch (rule) {
+                case "rule_policy": {
+                    if (v.length > MAX_PERMISSION_RULES_PER_LIST)
+                        fields = { field, reason: "over_cap", count: v.length, cap: MAX_PERMISSION_RULES_PER_LIST };
+                    else {
+                        const index = v.findIndex((x) => typeof x !== "string" || x.length === 0);
+                        if (index >= 0)
+                            fields = { field, reason: "bad_entry", index };
+                    }
+                    break;
+                }
+                case "allow_layer": {
+                    const over = allowLayerEntryCountIssue(field, v);
+                    if (over !== undefined)
+                        fields = { field, reason: "over_cap", count: over.count, cap: over.cap };
+                    else if (!ruleEntryListShapeOk(v))
+                        fields = { field, reason: "bad_entry", index: v.findIndex((x) => typeof x !== "string") };
+                    break;
+                }
+            }
         }
         if (fields !== undefined)
-            return { message: bucketIssueMessage(fields), fields };
+            return { message: bucketIssueMessage(fields, rule), fields };
     }
     return null;
 }
@@ -265,7 +296,7 @@ export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
     }
     return v;
 }
-const RULE_SOURCE_BY_BEHAVIOR = { allow: "settings.permissions.allow", ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
+const RULE_SOURCE_BY_BEHAVIOR = { ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];
 const isWorkflowName = (name) => name === RUN_WORKFLOW_TOOL_NAME;
 function createWorkflowAskPolicy(isExempt) {
@@ -301,7 +332,6 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
         for (const [field, names, behavior] of [
             ["permissions.ask", perms.ask, "ask"],
             ["permissions.deny", perms.deny, "deny"],
-            ["permissions.allow", perms.allow, "allow"],
         ]) {
             for (const name of names ?? []) {
                 const parsed = parseRuleText(name, behavior);
@@ -313,14 +343,15 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
             }
         }
     }
-    for (const [field, names, behavior] of [
-        ["permissions.ask", perms.ask, "ask"],
-        ["permissions.deny", perms.deny, "deny"],
-        ["permissions.allow", perms.allow, "allow"],
-    ]) {
+    const judgments = [
+        ["permissions.ask", perms.ask, { consumer: "rule-policy", behavior: "ask", ...(pathBases !== undefined ? { pathBases } : {}) }],
+        ["permissions.deny", perms.deny, { consumer: "rule-policy", behavior: "deny", ...(pathBases !== undefined ? { pathBases } : {}) }],
+        ["permissions.allow", perms.allow, { consumer: "allow-layer" }],
+    ];
+    for (const [field, names, judgment] of judgments) {
         if (!names)
             continue;
-        const unmatchable = unmatchableToolNamesRefusal(field, names, { consumer: "rule-policy", behavior, ...(pathBases !== undefined ? { pathBases } : {}) });
+        const unmatchable = unmatchableToolNamesRefusal(field, names, judgment);
         if (unmatchable !== undefined)
             throw new Error(unmatchable.message);
     }
@@ -329,14 +360,12 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const perms = settings.permissions;
     if (!perms)
         return {};
-    const { allow, deny, ask, defaultMode } = perms;
+    const { deny, ask, defaultMode } = perms;
     const pathBases = gate?.taskRoot !== undefined || gate?.taskHome !== undefined
         ? { ...(gate.taskRoot !== undefined ? { root: gate.taskRoot } : {}), ...(gate.taskHome !== undefined ? { home: gate.taskHome } : {}) }
         : undefined;
     rejectUnmatchableSettingsNames(perms, pathBases);
     const policies = [];
-    if (allow)
-        policies.push(createRuleListPolicy(allow, "allow", RULE_SOURCE_BY_BEHAVIOR.allow, pathBases));
     if (deny)
         policies.push(createRuleListPolicy(deny, "deny", RULE_SOURCE_BY_BEHAVIOR.deny, pathBases));
     if (ask)
@@ -380,15 +409,13 @@ export function applyTaskSettings(base, settings, gate, workflowGate) {
     const { toolPolicy, handsReadOnly, enablePlanMode } = deriveSettingsPolicy(settings, gate, workflowGate);
     let next = base;
     if (toolPolicy !== undefined || handsReadOnly !== undefined) {
-        const overrides = {};
-        if (toolPolicy !== undefined)
-            overrides.toolPolicy = toolPolicy;
-        if (handsReadOnly !== undefined)
-            overrides.handsReadOnly = handsReadOnly;
-        next = tightenTaskSpec(next, overrides);
+        next = tightenGoverned(next, { ...(toolPolicy !== undefined ? { toolPolicy } : {}), ...(handsReadOnly !== undefined ? { handsReadOnly } : {}) });
     }
     if (enablePlanMode)
         next = { ...next, enablePlanMode: true };
+    const allow = settings.permissions?.allow;
+    if (allow !== undefined)
+        next = { ...next, allowedTools: allow };
     if (settings.outputStyle) {
         const appended = next.appendSystemPrompt ? `${next.appendSystemPrompt}\n\n${settings.outputStyle}` : settings.outputStyle;
         next = { ...next, appendSystemPrompt: appended };

package/dist/tool-approval.d.ts

@@ -2,7 +2,7 @@ import type { HostDecidedBy, HostSettledBy } from "./host-decision.js";
 import type { IncomingMessage } from "node:http";
 import { type AskClass, type AskRequest, type AskOutcome, type CheckpointGate, type PendingAction, type PersistedRuleMandate, type ReadRootGrantCandidate, type RuleOffer } from "@sema-agent/core";
 import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js";
-import { type DenialLimitFallback, type RuleOffersAbsence, type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
+import { type AllowRuleShadowProjection, type DenialLimitFallback, type RuleOffersAbsence, type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
 import { type ApprovalAskStore, type AskRow } from "./plugins/approval-ask-store-sql.js";
 import type { ApprovalAskAuditSink } from "./approval-ask-audit-store.js";
 import type { ParkCommitWatch } from "./plugins/park-commit-watch.js";
@@ -372,37 +372,28 @@ export interface ToolApprovalFrame {
     expiresInMs?: number;
     serverNowMs?: number;
     /**
-     * [ref](core 5.25.0,[ref] 接力契约 / [ref] 主件;**ADDITIVE**,`"tool_approval"` only)——
-     * 这只 ask **命中了**调用方的一条持久 allow 规则,而那条规则**没能清掉它**。值 = 被越级的那条规则
-     * **原文**(core `AskRequest.persistedRuleShadowed`,四个 mint 点全带;core 侧已过 `inlineUntrusted`)。
-     *
-     * 🔴 **它存在的理由是一次真实的用户面回归**:core 5.25.0 收窄了消音边界(裁定逐字:「Allow rules
-     * silence the CLASSIFIER's questions, never a MANDATED one」)—— `shellGate:"always"` 的部署、工具自带
-     * egress/irreversible mark、以及既有的 governance 三类门下,用户此前被规则消掉的 ask **重新出现**。
-     * 没有这个键,人看到的是「我明明点过『不再询问』,它怎么又问」,唯一合理的结论是「我的规则坏了/没存上」。
-     * 有了它,壳能渲「你的规则仍在,只是这次调用被(运维令 / 工具本性)要求逐次确认」。
-     *
-     * 🔴 **缺席 ≠「你没有规则」**:本键只在「有规则命中 ∧ 规则清不掉这只 ask」时在场。绝大多数 ask
-     * 压根没有规则命中(缺席),而**命中且清掉了**的那些根本不会变成 ask(它们被消音了,没有卡)。
-     * 消费端禁把缺席读成「你在这条命令上没有规则」。
-     *
-     * 与 {@link ToolApprovalFrame.governanceForced} **刻意分列、不合并**:那个键回答「门是谁下的」
-     * (运维治理层),本键回答「你那条规则怎么了」。governance 只是不可消音的三个来源之一,另两个
-     * (doctrine `always` / 工具自带 mark)不打 governance 标 —— 合并会让后两类的 ask 要么谎报治理出身、
-     * 要么丢掉规则解释。出身的完整推法见 [ref]:`gate.safetyAxis` + `riskDescriptor.shellGateDoctrine` +
-     * `realApproval.origin` 组合读,server 不新铸出身键。
-     *
-     * 值是**用户内容族**(规则原文是人写的文本)⇒ 与 `message`/`sourceAgentName` 同待遇:`redactSecrets`
-     * 后上帧,UNTRUSTED-for-display。空串**不铸键**(core 只在真有命中时带它,空串是坏值不是「空规则」)。
-     *
-     * 耐久路(park 行)的对偶是 `gate.riskDescriptor.shadowedRule` —— 我方对 `riskDescriptor` 是**整体透传**
-     * (SQL 双生落整只 JSON 列、`listPending` 整只回读、两条 durable 读面整行上 wire),所以那一路**键集**零施工;
-     * 唯一的施工是**内容**:那两条读面(`GET /v1/approvals` + `/v1/approvals/stream`)在读边界对这一格补
-     * `redactSecrets`(core 只中和不脱敏,而运维队列是跨租户可见的那一条 —— 见
-     * `http/routes/approvals-assistant.ts` 的 `redactPendingDisclosures` 顶注)。
-     * 两路的钉见 `test/approval-shadowed-rule-wire.test.ts` 与 db-integration 的「[ref] 件4」格。
+     * core 7.42.0 #1327(**硬破坏换名**:取代 7.41.x 的 `persistedRuleShadowed`,零别名;`"tool_approval"` only)——
+     * allow 层里**命中了这次调用、却没能清掉这只 ask** 的成员,每个成员一条 `{ member, entries, omitted? }`:`member` ∈ core `ALLOW_RULE_MEMBERS`
+     * (`hook` 部署 PreToolUse hook 的 allow / `deployment` 运维的 `APPROVAL_GRANT` / `persisted` 人存的 allow 规则 / `skill` 被激活技能的清单 /
+     * `request` 请求的 `settings.permissions.allow`);`entries` = 那个成员命中的条目原文(hook 恒空表);`omitted` = 没列出的条目数。
+     *
+     * 🔴 **它存在的理由**:allow 层只清「普通问 / 没人表态」两类问;运维的强制类(`APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO` / shell 地板 /
+     * 写保护 / 治理)、hook 的问、plan 模式的问照样到人。没有这个键,人看到的是「我明明写了 allow,它怎么又问」,唯一合理的结论是「我的规则坏了」;
+     * 有了它,壳能渲「你的规则在、命中了,只是这次调用必须逐次确认」。卡上那句话引擎已经写进 `message`(每个呈卡站的 `cardDisclosureOf`),
+     * 本键是同一事实的结构化一面,本仓不另写句子。
+     *
+     * 🔴 **缺席 ≠「你没有规则」**:本键只在「有成员命中 ∧ 清不掉这只 ask」时在场;命中且清掉了的根本不会变成 ask。
+     *
+     * 与 {@link ToolApprovalFrame.governanceForced} **刻意分列**:那个键回答「门是谁下的」,本键回答「你那条规则怎么了」。
+     *
+     * 值是**内容族**(人 / 运维写的条目)⇒ 唯一窄读点 `approval-card.ts` 的 `readAllowRuleShadowed`(卡也用它 ⇒ 帧与 `card_json` 同值;
+     * `redactSecrets` 后截长一次算定)。形不合 / 空表 ⇒ 不铸键。
+     *
+     * 耐久路(park 行)的对偶是 `gate.riskDescriptor.allowRuleShadowed`(整体透传,两条 durable 读面在读边界对条目补 `redactSecrets`,
+     * 叶表属主 `observability/run-terminal.ts` 的 `redactRiskDescriptor`)。升级前停驻的行带旧键 `shadowedRule`,起服一次性迁移改写
+     * (`plugins/one-time-migrations.ts` 登记表)。
      */
-    persistedRuleShadowed?: string;
+    allowRuleShadowed?: AllowRuleShadowProjection[];
     /**
      * [ref] 车二(core 5.18.0 [ref]):`"tool_approval"` only —— 引擎为这次 ask 铸的**规则候选**
      * (`AskRequest.ruleOffers`,core 5.58.0 判别联合逐字透传:闭词表 `kind`/`match` + 引擎铸的文本,
@@ -506,9 +497,9 @@ export interface ToolApprovalFrame {
      * 🔴 **展示/对账元数据,永不是裁决输入**(core 契约逐字:removing it would leave every decision
      * byte-identical);server 逐字转录**引擎盖章**的那一份,**永不自铸缺席词**(server 铸词 = 谎报
      * 「某一层没报」)。窄读走 `approval-card.ts` 的 `readRuleEvidence`(卡也用它 ⇒ 帧与 `card_json`
-     * 同值;redact+截长在函数内一次算定,`persistedRuleShadowed` R2-[medium] 同款)。
+     * 同值;redact+截长在函数内一次算定,allow 层披露 R2-[medium] 同款)。
      *
-     * 与 `persistedRuleShadowed` **刻意分列**:那是**人读的**越级规则原文(display 值,非身份通道),
+     * 与 `allowRuleShadowed` **刻意分列**:那是**人读的**命中条目原文(display 值,非身份通道),
      * 本键的 dots 是那条规则的**机器身份**(a rule is a set of adds;数组即身份,消费端禁 join 成标量)。
      */
     ruleEvidence?: RuleEvidenceProjection;

package/dist/tool-approval.js

@@ -8,7 +8,7 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readRuleEvidence, readAllowRuleShadowed, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { MAX_SETTLED_BY_CHARS, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, settledByFitsColumn } from "./plugins/approval-ask-store-sql.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
@@ -1102,9 +1102,7 @@ export class ToolApprovalCoordinator {
             ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
             ...(originWord !== undefined ? { origin: originWord } : {}),
             ...(askClassPair ?? {}),
-            ...(typeof req.persistedRuleShadowed === "string" && req.persistedRuleShadowed !== ""
-                ? { persistedRuleShadowed: redactSecrets(req.persistedRuleShadowed).slice(0, MAX_RULE_TEXT_CHARS) }
-                : {}),
+            ...((d) => (d !== undefined ? { allowRuleShadowed: d } : {}))(readAllowRuleShadowed(req)),
             ...(ruleLaneMaterial !== undefined ? { ruleOffers: ruleLaneMaterial.offers } : {}),
             ...((a) => (a !== undefined ? { ruleOffersAbsence: a } : {}))(readRuleOffersAbsence(req)),
             ...((f) => (f !== undefined ? { denialLimitFallback: f } : {}))(readDenialLimitFallback(req)),
@@ -1206,10 +1204,10 @@ export class ToolApprovalCoordinator {
                     frame.governanceForced = true;
                 else
                     delete frame.governanceForced;
-                if (typeof cardForFrame.persistedRuleShadowed === "string")
-                    frame.persistedRuleShadowed = cardForFrame.persistedRuleShadowed;
+                if (cardForFrame.allowRuleShadowed !== undefined)
+                    frame.allowRuleShadowed = cardForFrame.allowRuleShadowed;
                 else
-                    delete frame.persistedRuleShadowed;
+                    delete frame.allowRuleShadowed;
                 if (cardForFrame.inputHasBidi === true)
                     frame.inputHasBidi = true;
                 else

package/dist/trace/core-keyset-guard.d.ts

@@ -43,7 +43,7 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
@@ -129,7 +129,7 @@ type WiringGovernanceHandled = "audience" | "lockedConfig" | "compliance" | "mem
 type _GuardWiringGovernance = AssertAllKeysHandled<Exclude<keyof WiringSection<"governance">, WiringGovernanceHandled>>;
 type _GuardWiringGovernanceReverse = AssertAllKeysHandled<Exclude<WiringGovernanceHandled, keyof WiringSection<"governance">>>;
 type PermissionTraceKind = Extract<TraceEvent["kind"], `permission.${string}`>;
-export type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed" | "permission.skill_allowed";
+export type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed" | "permission.skill_allowed" | "permission.allowed_tools_allowed";
 type PermissionTraceDropped = "permission.sandbox_admitted" | "permission.rule_sync_resurrected" | "permission.rule_sync_dropped" | "permission.org_snapshot_unavailable";
 type _GuardPermissionTrace = AssertAllKeysHandled<Exclude<PermissionTraceKind, PermissionTraceProjected | PermissionTraceDropped>>;
 type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTraceProjected | PermissionTraceDropped, PermissionTraceKind>>;
@@ -148,7 +148,7 @@ type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCal
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "allowedTools";
 type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "outputStyle";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "task.tool_turn_incomplete"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;
@@ -63,12 +63,10 @@ export interface EngineNoticeWireRow {
  */
 export declare function sanitizeNoticeDetail(detail: Record<string, unknown> | undefined): Record<string, unknown>;
 /**
- * `engine_notice` 载荷构造器(三条终点腿同源:live SSE / durable 账本 / 未来的任何第四条腿)。
- *
- * 与 `trace/project.ts` 的 `*EventData` 族同纪律(白名单挑键、禁 `{...notice}`),但**不住在那个文件里**:
- * 那一族的入参全是 core `TaskEvent` 的臂(有 `wire-whitelist-exhaustiveness` 的臂集编译门看着),
- * 而 `EngineNotice` 不是 `TaskEvent` —— 混进去会让那道门的语义变成"两个不同来源的联合",判别力反而降。
+ * 通告 `detail` 里的**规则条目原串**过呈现口(`presentRuleEntry`:剥 C0 / 双向控制符、超长截断)—— 会话流行(经 {@link engineNoticeEventData})
+ * 与运维日志行(`boot/runner-deps.ts` 的转发席)同调这一只。其余字段、其余码原样(多行文本不受影响)。
  */
+export declare function presentNoticeDetail(code: string, detail: Record<string, unknown> | undefined): Record<string, unknown> | undefined;
 export declare function engineNoticeEventData(notice: {
     code: string;
     message: string;

package/dist/trace/engine-notice-wire.js

@@ -1,4 +1,5 @@
 import { redactSecrets } from "./redact.js";
+import { presentRuleEntry } from "../rule-entry-list.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 export const ENGINE_NOTICE_WIRE_CODES = [
     "memory.session_polluted",
@@ -33,6 +34,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "permission.ask_released_by_mode",
     "permission.read_deny_unapplied",
     "permission.rule_store_unavailable",
+    "permission.allowed_tool_not_granted",
     "task.tool_turn_incomplete",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
@@ -90,11 +92,22 @@ function sanitizeValue(v, depth) {
     }
     return undefined;
 }
+const RULE_ENTRY_DETAIL_ARRAYS = { "permission.allowed_tool_not_granted": "entries" };
+export function presentNoticeDetail(code, detail) {
+    const key = Object.hasOwn(RULE_ENTRY_DETAIL_ARRAYS, code) ? RULE_ENTRY_DETAIL_ARRAYS[code] : undefined;
+    if (key === undefined || detail === undefined)
+        return detail;
+    const list = detail[key];
+    if (!Array.isArray(list))
+        return detail;
+    const presented = list.map((item) => item !== null && typeof item === "object" && typeof item.entry === "string" ? { ...item, entry: presentRuleEntry(item.entry) } : item);
+    return { ...detail, [key]: presented };
+}
 export function engineNoticeEventData(notice, sessionId, nowMs) {
     return {
         code: notice.code,
         message: redactSecrets(String(notice.message)).slice(0, NOTICE_TEXT_MAX),
-        detail: sanitizeNoticeDetail(notice.detail),
+        detail: sanitizeNoticeDetail(presentNoticeDetail(notice.code, notice.detail)),
         sessionId,
         ts: nowMs,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.116.0",
+  "version": "7.117.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -44,7 +44,7 @@
     "node": "^20.19.0 || >=22.12.0"
   },
   "scripts": {
-    "typecheck": "tsc --noEmit -p tsconfig.typecheck.json",
+    "typecheck": "node --max-old-space-size=4096 node_modules/typescript/bin/tsc --noEmit -p tsconfig.typecheck.json",
     "typecheck:scripts": "tsc --noEmit -p tsconfig.scripts.json",
     "build": "rm -rf dist && tsc -p tsconfig.build-js.json && tsc -p tsconfig.build-dts.json && node scripts/scrub-dist-refs.mjs dist",
     "prepublishOnly": "npm run build && vitest run test/pack-hygiene.test.ts",
@@ -64,7 +64,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.41.2",
+    "@sema-agent/core": "7.42.1",
     "@sema-agent/settings-schema": "8.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",

package/scripts/drain-check-local.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
  * 换钉前的**排空检查 —— `DB_BACKEND=local`(File 店)车道**,只读。随 npm 包出(`scripts/drain-check-local.mjs`)。
- * 一次跑**四条判据**(判据表 {@link DRAIN_CRITERIA},每条一行末行、各自的命中行;SQL 车道的同一判据是同目录随包的 `drain-check.mysql.sql` / `drain-check.pg.sql`,
+ * 一次跑**五条判据**(判据表 {@link DRAIN_CRITERIA},每条一行末行、各自的命中行;SQL 车道的同一判据是同目录随包的 `drain-check.mysql.sql` / `drain-check.pg.sql`,
  * 每条判据一段、段首标记 `-- drain-check:<判据名>:<后端>`,判据名与本表的 `name` 同一个词):
  *  · `skill-grants-rollback`(**回滚**到 7.115.x 前,即引擎从 7.41 退回 7.40):四样任一 ——
  *    ① pending 行带 `state.skillGrants`(本次 run 冻结在行上的技能授予行:模型激活 / 子代捕获写下的放行与禁止);
@@ -16,11 +16,16 @@
  *  · `retired-skill-manifest`(升级到 7.116.0 前,core 7.41.0 退役技能上的 `manifest` 键):pending 行所在会话的续跑上下文(`checkpoint-ctx/*.json`)里,提交体顶层 `skills[]` 或某只子代定义的
  *    `agents[].skills[]` 仍带 `manifest`(任何值)—— 升级后续跑顶层那种会被引擎按名拒(行仍 pending,只能取消重提),子代那种不被拒、而是那只子代定义被整只丢掉并留一条警告日志(任务照跑、少一只子代)。命中行点名是哪一层(`member=skills` / `member=agents.skills`)。
  *    「带 `manifest`」的判据是服务里**一只**函数(`src/http/retired-skill-manifest.ts`,提交口的顶层技能门读同一只),经包里脚本隔壁的编译产物 `dist/http/retired-skill-manifest.js` 取 —— 本脚本不写第二份;
+ *  · `skill-deny-inert`(换钉 7.117.0 前,引擎 7.42 逐字读规则条目):pending 行所在会话的续跑上下文里,提交体顶层 `skills[]` 或某只子代的 `agents[].skills[]`
+ *    某只技能的 `disallowedTools` 有引擎读成空的条目(例:带首尾空白的 `"Bash "` —— 7.41 去白后是一条有效的拒,7.42 什么也不拒)—— 这样的行在 7.117.0 上续跑会被拒
+ *    (行字节不动;出路 = 取消、改好条目重提,见随包 `MIGRATION.md` 7.117.0 节)。命中行点名是哪一层(`member=skills` / `member=agents.skills`)。
+ *    判据**就是**服务提交与续跑两腿同经的那一只函数(`src/rule-entry-list.ts` 的 `skillDenyInertEntryOf`,它调引擎包根的 `compileAllowList`),经编译产物
+ *    `dist/rule-entry-list.js` 取 —— 本脚本不写第二份;
  *  · `retired-mode-seed`(换钉 7.113.0 前,core 7.39.0 删掉退役 mode-seed 的一次性迁移):pending 行的 `state.inheritedGate` 仍带退役成员;
- *  · `permissions-allow-list`(换钉 7.115.0 前,本服务把 `settings.permissions.allow` 从名单改成 allow 规则):pending 行所在会话的续跑上下文
- *    (`checkpoint-ctx/*.json` 的信封 `{ sessionId, updatedAt, ctx }`)里,`ctx.body.settings.permissions.allow` 是非空数组,且 `ctx.permissionsAllowReading` 不是 `"statement"`
- *    —— 这样的行在 7.115.0 上续跑会被拒(行字节不动;出路按停驻种类分,见随包 `MIGRATION.md` 7.115.0 节)。判据**就是**服务续跑腿拒臂的那一只函数(`src/http/checkpoint-ctx.ts` 的 `allowListReadingUnstated`),
- *    经包里脚本隔壁的编译产物 `dist/http/checkpoint-ctx.js` 取(与缺省数据根经 `dist/local-data-root.js` 取同一姿势;该模块只有类型 import,编出来零运行期依赖)—— 本脚本不写第二份。
+ *  · `permissions-allow-list`(换钉 7.117.0 前,本服务把 `settings.permissions.allow` 整份交给引擎的 allow 层):pending 行所在会话的续跑上下文
+ *    (`checkpoint-ctx/*.json` 的信封 `{ sessionId, updatedAt, ctx }`)里,`ctx.body.settings.permissions.allow` 是非空数组,且 `ctx.permissionsAllowReading` 不是 `"allow_layer"`
+ *    (无记号 = 名单时代写下的;`"statement"` = 表态时代写下的)—— 这样的行在 7.117.0 上续跑会被拒(行字节不动;出路按停驻种类分,见随包 `MIGRATION.md` 7.117.0 节)。判据**就是**服务续跑腿拒臂的那一只函数(`src/http/checkpoint-ctx.ts` 的 `allowListReadingUnstated`),
+ *    经包里脚本隔壁的编译产物 `dist/http/checkpoint-ctx.js` 取(与缺省数据根经 `dist/local-data-root.js` 取同一姿势;7.117.0 起该模块经 `dist/rule-entry-list.js` 依赖引擎包根 `@sema-agent/core` —— 随包安装时它就是包的依赖,解开的 tarball 没装依赖时本判据与 `skill-deny-inert` 同读成 criterion-unavailable、rc 2)—— 本脚本不写第二份。
  * 扫描骨架(快照 + 账本折成当前行、一致性重读、数据根判定)各条判据共用;判据只回答「这一条 pending 行算不算命中」。
  *
  * ## 为什么是一只脚本,不是一行 grep
@@ -56,10 +61,12 @@
  *
  * ## 读数(机读末行 + 退出码)
  *  · 每条命中一行:`SKILL-GRANTS-ROW token=<token> sessionId=<id> createdAt=<ms> member=<skillGrants|boundGrantDigest|userInvokedSkills|disallowedTools>` / `SKILL-MANIFEST-ROW token=<token> sessionId=<id> createdAt=<ms> member=<skills|agents.skills>` /
+ *    `SKILL-DENY-INERT-ROW token=<token> sessionId=<id> createdAt=<ms> member=<skills|agents.skills>` /
  *    `ALLOW-LIST-ROW token=<token> sessionId=<id> createdAt=<ms>` / `RETIRED-ROW token=<token> sessionId=<id> createdAt=<ms> member=<成员>`;
  *  · 每条判据一行末行(表序;`RETIRED-MODE-SEED` 那一行恒在最后,7.113.0 起读「最后一行」的下游不受影响;`PERMISSIONS-ALLOW-LIST` 仍是倒数第二行):
  *    `SKILL-GRANTS rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `RETIRED-SKILL-MANIFEST rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
+ *    `SKILL-DENY-INERT rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `PERMISSIONS-ALLOW-LIST rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `RETIRED-MODE-SEED rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`;
  *    `corrupt` = 共用扫描的坏记录 + 这条判据自己读不懂的旁路输入(`permissions-allow-list`:读不懂的 ctx 档,文件名进 stderr —— 一份读不懂的 ctx 可能正是某条 pending 行带 `allow` 的那一份);
@@ -74,7 +81,7 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 /** 从脚本隔壁的编译产物取来的服务判据(脚本不持第二份实现)。
- * @typedef {{ allowListReadingUnstated: (ctx: Record<string, unknown>) => boolean, retiredSkillManifestLayerOf: (body: unknown) => "skills" | "agents.skills" | undefined }} ServiceCriteria */
+ * @typedef {{ allowListReadingUnstated: (ctx: Record<string, unknown>) => boolean, retiredSkillManifestLayerOf: (body: unknown) => "skills" | "agents.skills" | undefined, skillDenyInertEntryOf: (body: unknown) => { layer: "skills" | "agents.skills", message: string } | undefined }} ServiceCriteria */
 
 /** 读期间文件在变时的有界重读次数(含第一次)。 */
 const STABLE_READ_ATTEMPTS = 3;
@@ -332,6 +339,23 @@ export const DRAIN_CRITERIA = [
       return layer === undefined ? undefined : ` member=${layer}`;
     },
   },
+  {
+    // 换钉 7.117.0 之前:停驻、持久化体里某只技能的拒侧清单有引擎读成空的条目(头注里那一条)。判据函数是服务提交与续跑两腿同经的那一只(`skillDenyInertEntryOf`,经编译产物取);
+    // 命中行点名层。表序在 `permissions-allow-list` 之前 —— 那一条仍倒数第二、`RETIRED-MODE-SEED` 仍最后。
+    name: "skill-deny-inert",
+    tail: "SKILL-DENY-INERT",
+    hit: "SKILL-DENY-INERT-ROW",
+    load: (root, service) => {
+      const idx = readCtxIndex(root);
+      return { input: { bySession: idx.bySession, entryOf: service.skillDenyInertEntryOf }, corrupt: idx.corrupt, unreadable: idx.unreadable };
+    },
+    judge: (row, input) => {
+      const { bySession, entryOf } = /** @type {{ bySession: Map<string, Record<string, unknown>>, entryOf: ServiceCriteria["skillDenyInertEntryOf"] }} */ (input);
+      const ctx = typeof row.sessionId === "string" ? bySession.get(row.sessionId) : undefined;
+      const hit = ctx === undefined ? undefined : entryOf(ctx.body);
+      return hit === undefined ? undefined : ` member=${hit.layer}`;
+    },
+  },
   {
     name: "permissions-allow-list",
     tail: "PERMISSIONS-ALLOW-LIST",
@@ -376,6 +400,7 @@ async function loadServiceCriteria(rootEcho) {
   const wanted = [
     ["dist/http/checkpoint-ctx.js", () => import("../dist/http/checkpoint-ctx.js"), "allowListReadingUnstated"],
     ["dist/http/retired-skill-manifest.js", () => import("../dist/http/retired-skill-manifest.js"), "retiredSkillManifestLayerOf"],
+    ["dist/rule-entry-list.js", () => import("../dist/rule-entry-list.js"), "skillDenyInertEntryOf"],
   ];
   /** @type {Record<string, unknown>} */
   const fns = {};

package/scripts/drain-check.mysql.sql

@@ -8,12 +8,13 @@
 --   sessions   命中行所在的会话 id,逗号连接,新的在前。以 hit_rows 为准:这一列被会话变量 group_concat_max_len(缺省 1024 字节)截断时,列出的会话数会少于 hit_rows ——
 --              先处理列出的再跑一次,或先在同一个会话里 SET SESSION group_concat_max_len = 1048576; 再跑本文件(本文件自己只含 SELECT)。
 -- 每段只数 pending 行(已决 / 已过期的行不数);判据只看**键在不在 / 值形**,不读行的其余内容。
--- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,四条判据同名。
+-- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,五条判据同名。
 --
--- 四条判据(顺序同 drain-check-local.mjs 的判据表):
+-- 五条判据(顺序同 drain-check-local.mjs 的判据表):
 --   skill-grants-rollback   回滚到 7.115.x(引擎 7.40)之前:7.116.0 停驻的行带 7.40 不读的技能授予节 / 卡绑定 / 会话上下文里的人点名技能 / 还没被激活的技能声明的禁止清单。
 --   retired-skill-manifest  升级到 7.116.0 之前:停驻、持久化提交体里技能(顶层 skills[] 或子代 agents[].skills[])还带已退役的 manifest 键。
---   permissions-allow-list  换钉 7.115.0 之前:停驻、提交体 settings.permissions.allow 是非空数组且没有「按表态读」的记号。
+--   skill-deny-inert        换钉 7.117.0 之前:停驻、提交体里技能(顶层 skills[] 或子代 agents[].skills[])的 disallowedTools 有引擎会读成空的条目的**候选**(见该段注)。
+--   permissions-allow-list  换钉 7.117.0 之前:停驻、提交体 settings.permissions.allow 是非空数组且读法记号不是当前的 "allow_layer"(无记号 = 名单时代;"statement" = 表态时代)。
 --   retired-mode-seed       换钉 7.113.0 之前:检查点的 inheritedGate 里仍带退役 mode-seed 成员。
 
 -- drain-check:skill-grants-rollback:mysql —— 期望 hit_rows = 0;每一行 = 一条回滚到 7.115.x 后续跑会丢技能禁止行 / 不核卡绑定的停驻行。
@@ -45,16 +46,40 @@ WHERE k.status = 'pending'
        OR (JSON_TYPE(JSON_EXTRACT(c.ctx, '$.body.agents')) = 'ARRAY'
            AND JSON_CONTAINS_PATH(c.ctx, 'one', '$.body.agents[*].skills[*].manifest')));
 
+-- drain-check:skill-deny-inert:mysql —— 期望 hit_rows = 0;每一行 = 一条**候选**:升级后续跑可能被拒的停驻行(拒的是提交体里技能的一条 disallowedTools 条目 ——
+-- 读哪一份续跑上下文:与续跑腿同 —— workflow 子代的停驻行(在 workflow_agent_session 里登记过)续跑时读的是**发起这条 workflow 的会话**那一份
+-- (workflow_run.run 的 originatingSessionId);其余行读自己会话那一份。
+-- 引擎 7.42 逐字读规则条目,读成空的拒什么也不拒,服务对这种体在提交与续跑上同拒;7.41 去首尾空白,所以 7.116.x 上它可能还是一条有效的拒)。
+-- SQL 不能逐条照引擎判读(引擎的文法 —— 非 ASCII 空白、内容形不受支持的工具、括号不配对 —— 在 SQL 里复刻不全,逐形枚举的表必漏),所以这里数的是**真超集**:
+--   顶层 skills[*] 或子代 agents[*].skills[*] 的 disallowedTools **非空**的停驻行(与回滚判据 skill-grants-rollback 的第四样同一只形)。两方言都 ⊇ 运行期判据;拒侧清单不是数组的形(受理口 400,盘上不该有)两边数法不同 —— pg 只认数组,MySQL 的 [0] 把非数组当一元数组读。
+-- 命中行逐条按运行期的拒核:续跑时服务按引擎的读法拒(409 resume_blocked_by_policy,blockedBy = request.field_invalid,句子点名条目);拒侧清单全部有效的行放过。
+-- local 车道的同名判据调的就是运行期那一只,是精确的。
+SELECT 'skill-deny-inert' AS criterion, COUNT(*) AS hit_rows,
+       COALESCE(GROUP_CONCAT(k.session_id ORDER BY k.created_at_ms DESC SEPARATOR ','), '') AS sessions
+FROM checkpoint k
+LEFT JOIN workflow_agent_session w ON w.session_id = k.session_id
+LEFT JOIN workflow_run r ON r.id = w.run_id
+JOIN checkpoint_ctx c ON c.session_id = COALESCE(JSON_UNQUOTE(JSON_EXTRACT(r.run, '$.originatingSessionId')), k.session_id)
+WHERE k.status = 'pending'
+  AND ((JSON_TYPE(JSON_EXTRACT(c.ctx, '$.body.skills')) = 'ARRAY'
+        AND JSON_CONTAINS_PATH(c.ctx, 'one', '$.body.skills[*].disallowedTools[0]'))
+       OR (JSON_TYPE(JSON_EXTRACT(c.ctx, '$.body.agents')) = 'ARRAY'
+           AND JSON_CONTAINS_PATH(c.ctx, 'one', '$.body.agents[*].skills[*].disallowedTools[0]')));
+
 -- drain-check:permissions-allow-list:mysql —— 期望 hit_rows = 0;每一行 = 一条升级后续跑会被拒的停驻行。
--- 判据 = 服务续跑腿拒臂的同一句话:提交体 settings.permissions.allow 是非空数组,且上下文没有读法记号 permissionsAllowReading = "statement"。
+-- 读哪一份续跑上下文:与续跑腿同 —— workflow 子代的停驻行(在 workflow_agent_session 里登记过)续跑时读的是**发起这条 workflow 的会话**那一份
+-- (workflow_run.run 的 originatingSessionId);其余行读自己会话那一份。
+-- 判据 = 服务续跑腿拒臂的同一句话:提交体 settings.permissions.allow 是非空数组,且上下文的读法记号 permissionsAllowReading 不是当前的 "allow_layer"。
 SELECT 'permissions-allow-list' AS criterion, COUNT(*) AS hit_rows,
        COALESCE(GROUP_CONCAT(k.session_id ORDER BY k.created_at_ms DESC SEPARATOR ','), '') AS sessions
 FROM checkpoint k
-JOIN checkpoint_ctx c ON c.session_id = k.session_id
+LEFT JOIN workflow_agent_session w ON w.session_id = k.session_id
+LEFT JOIN workflow_run r ON r.id = w.run_id
+JOIN checkpoint_ctx c ON c.session_id = COALESCE(JSON_UNQUOTE(JSON_EXTRACT(r.run, '$.originatingSessionId')), k.session_id)
 WHERE k.status = 'pending'
   AND JSON_TYPE(JSON_EXTRACT(c.ctx, '$.body.settings.permissions.allow')) = 'ARRAY'
   AND JSON_LENGTH(JSON_EXTRACT(c.ctx, '$.body.settings.permissions.allow')) > 0
-  AND COALESCE(JSON_UNQUOTE(JSON_EXTRACT(c.ctx, '$.permissionsAllowReading')), '') <> 'statement';
+  AND COALESCE(JSON_UNQUOTE(JSON_EXTRACT(c.ctx, '$.permissionsAllowReading')), '') <> 'allow_layer';
 
 -- drain-check:retired-mode-seed:mysql —— 期望 hit_rows = 0;每一行 = 一条升级后会被拒的停放行。
 -- 判据逐字照引擎 refuseRetiredModeSeed:inheritedGate 带 autoModeRequested / approverPosture(任何值,含 JSON null),或 shellGate 不是 "always"(含 JSON null)。