@sema-agent/server 7.117.0 → 7.118.0

package/dist/standing-answer-grant.d.ts

@@ -1,8 +1,20 @@
-/** 读口的入参:任何一种载着「这一问」的形(活的 `AskRequest`、`ToolCallRequest`、待决条目、停驻行的 `tool_approval` 臂)都结构上满足。 */
+/** 读口的入参:任何一种载着「这一问」的形(活的 `AskRequest`、`ToolCallRequest`、停驻行的 `tool_approval` 臂)都结构上满足。 */
 export interface StandingAnswerGrantCarrier {
     readonly toolName?: unknown;
     readonly boundGrantDigest?: unknown;
 }
-/** 这一问的应答是否授予这一次调用之外的东西(读法见文件头注)。 */
+/** 一问的授予绑定(闭集):`none` = 应答只覆盖这一次调用;`bound` = 授予、绑定可读;`unreadable` = 授予、绑定读不出。 */
+export type GrantBinding = {
+    readonly kind: "none";
+} | {
+    readonly kind: "bound";
+    readonly digest: string;
+} | {
+    readonly kind: "unreadable";
+};
+/** 这一问的授予绑定(读法见文件头注)。 */
+export declare function grantBindingOf(carrier: StandingAnswerGrantCarrier): GrantBinding;
+/** 这一问的应答是否授予这一次调用之外的东西(= 绑定不是 `none`)。**按工具名记**的读者(耐久豁免店的读写口、豁免列表)据它不碰这类问:
+ *  它们的键没有绑定这一维,记下 / 代答都会越过绑定。 */
 export declare function answerGrantsBeyondCall(carrier: StandingAnswerGrantCarrier): boolean;
 //# sourceMappingURL=standing-answer-grant.d.ts.map

package/dist/standing-answer-grant.js

@@ -1,5 +1,12 @@
 import { SKILL_TOOL_NAME } from "@sema-agent/core";
+export function grantBindingOf(carrier) {
+    if (Object.hasOwn(carrier, "boundGrantDigest")) {
+        const d = carrier.boundGrantDigest;
+        return typeof d === "string" && d.length > 0 ? { kind: "bound", digest: d } : { kind: "unreadable" };
+    }
+    return carrier.toolName === SKILL_TOOL_NAME ? { kind: "unreadable" } : { kind: "none" };
+}
 export function answerGrantsBeyondCall(carrier) {
-    return Object.hasOwn(carrier, "boundGrantDigest") || carrier.toolName === SKILL_TOOL_NAME;
+    return grantBindingOf(carrier).kind !== "none";
 }
 //# sourceMappingURL=standing-answer-grant.js.map

package/dist/task-settings.js

@@ -1,11 +1,12 @@
 import { combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, ruleToolGrammarOf, } from "@sema-agent/core";
 import { unmatchableToolNamesRefusal } from "./config.js";
 import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
-import { allowLayerEntryCountIssue, describeAllowLayerOverCap, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { allowLayerEntryCountIssue, describeAllowLayerOverCap, describeEmptyToolSegmentEntry, emptyToolSegmentEntryOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 import { heldRuleName } from "./tool-rule-names.js";
+import { policyAskStandingAnswerFacts, standingAnswerDurablyRecordable } from "./tool-approval.js";
 export const PERMISSION_MODE_REQUEST_FACE = {
     default: "request",
     acceptEdits: "request",
@@ -304,7 +305,8 @@ function createWorkflowAskPolicy(isExempt) {
         async check(req) {
             if (heldRuleName(req, isWorkflowName) === undefined)
                 return { action: "allow" };
-            if (isExempt) {
+            const ask = { action: "ask", message: `dynamic workflow "${req.toolName}" requires approval in this permission mode`, decisionReason: "rule" };
+            if (isExempt && standingAnswerDurablyRecordable(policyAskStandingAnswerFacts(req, ask))) {
                 try {
                     if (await isExempt(req.toolName))
                         return { action: "allow", decisionReason: "rule" };
@@ -312,7 +314,7 @@ function createWorkflowAskPolicy(isExempt) {
                 catch {
                 }
             }
-            return { action: "ask", message: `dynamic workflow "${req.toolName}" requires approval in this permission mode`, decisionReason: "rule" };
+            return ask;
         },
         nameSets: [{ ask: WORKFLOW_ASK_NAMES }],
     };
@@ -346,7 +348,6 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
     const judgments = [
         ["permissions.ask", perms.ask, { consumer: "rule-policy", behavior: "ask", ...(pathBases !== undefined ? { pathBases } : {}) }],
         ["permissions.deny", perms.deny, { consumer: "rule-policy", behavior: "deny", ...(pathBases !== undefined ? { pathBases } : {}) }],
-        ["permissions.allow", perms.allow, { consumer: "allow-layer" }],
     ];
     for (const [field, names, judgment] of judgments) {
         if (!names)
@@ -355,6 +356,9 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
         if (unmatchable !== undefined)
             throw new Error(unmatchable.message);
     }
+    const emptyAllow = perms.allow !== undefined ? emptyToolSegmentEntryOf(perms.allow) : undefined;
+    if (emptyAllow !== undefined)
+        throw new Error(describeEmptyToolSegmentEntry("permissions.allow", emptyAllow));
 }
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const perms = settings.permissions;

package/dist/tool-approval.d.ts

@@ -1,6 +1,6 @@
-import type { HostDecidedBy, HostSettledBy } from "./host-decision.js";
+import { type ApprovalDecidedBy, type HostSettledBy } from "./host-decision.js";
 import type { IncomingMessage } from "node:http";
-import { type AskClass, type AskRequest, type AskOutcome, type CheckpointGate, type PendingAction, type PersistedRuleMandate, type ReadRootGrantCandidate, type RuleOffer } from "@sema-agent/core";
+import { type AskClass, type AskRequest, type AskOutcome, type PermissionResult, type CheckpointGate, type PendingAction, type PersistedRuleMandate, type ReadRootGrantCandidate, type RuleOffer, type AutoModeFallbackCause, type BoundSkillGrants } from "@sema-agent/core";
 import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js";
 import { type AllowRuleShadowProjection, type DenialLimitFallback, type RuleOffersAbsence, type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
 import { type ApprovalAskStore, type AskRow } from "./plugins/approval-ask-store-sql.js";
@@ -8,6 +8,7 @@ import type { ApprovalAskAuditSink } from "./approval-ask-audit-store.js";
 import type { ParkCommitWatch } from "./plugins/park-commit-watch.js";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 import { type GovernancePosture } from "./runtime-governance.js";
+import { type GrantBinding, type StandingAnswerGrantCarrier } from "./standing-answer-grant.js";
 /** [ref]:审批 gate kind 闭集(core gateMatch 的 `human`/`irreversible_ask` ↔ outcome.gate "policy_ask")。
  *  此前 7 份手写副本散在两只 checkpoint store 的数组/SQL 字面与 /decide 守卫——core 加审批味 kind 时
  *  全部静默漂移。core 无导出词表(全大写导出面零命中,2026-08-09 亲验),属主落此;SQL IN 片段从
@@ -56,13 +57,10 @@ export interface ParkedAskRedeemRequest {
     decision: "approve" | "deny";
     /** [ref] 同源的人写理由(deny 时 core 把它交给模型;allow 只进审计面)。 */
     note?: string;
-    /** #1016:回决体自报的**结算来源**,原样过境到耐久腿的 `hostDecision.decidedBy`(缺席 ⇒ `"person"`)。
-     *  live 命中臂与本 PARKED 臂读**同一格** —— 同一份体落在哪条臂上只取决于副本与时序。
-     *  型 = `string`(本层证得出的全部);判词的是耐久座的属主 core,cast 在 `hostDecisionFacts` 那一处。
-     *  ⚠️ 两座的**词表并不相同**(live = `human`/`timeout`/`policy`,耐久 = `person`/`sla_timeout`/`policy`,
-     *  只在 `policy` 上相交)—— 这正是这条 wire 键只开 `"policy"` 一个词的原因,也是它不能声明成其中任何
-     *  一只闭集的原因:同一个串要落到两个不同词表的座上。 */
-    settledBy?: string;
+    /** S-1154:决定体的**出处位**(已过 `readDecidedBy` 的 wire 词,缺席已落成 `"person"`),经 `hostDecisionFacts` 落到停驻座的
+     *  `hostDecision.decidedBy`。live 命中臂与本 PARKED 臂读**同一格** —— 同一份体落在哪条臂上只取决于副本与时序;两臂各走自己座的
+     *  那一只映射(live = `liveSettledBy`,停驻 = 恒等),词表只有一份。 */
+    decidedBy: ApprovalDecidedBy;
     /** [ref] ctrl+g 编辑放行的实参整体替换(approve 才有意义)。 */
     updatedInput?: unknown;
     /** 发起本次 respond 的**已验证**调用方(live 腿 `gatedPrincipal` 的那一把)。席在赎回之前拿它与
@@ -79,9 +77,21 @@ export type ParkedAskRedeem = (req: ParkedAskRedeemRequest) => Promise<{
     body: Record<string, unknown>;
 }>;
 /**
- * 一问身上与「站着的答案」有关的三个事实位 —— {@link standingAnswerMayRetire} 的全部入参。
+ * 本仓**策略层自己交出去的一问**的 {@link StandingAnswerFacts}。读者一个:workflow 问句门(`task-settings.ts`)—— 它在交出这一问之前先读按工具名记的
+ * 耐久豁免店(「本会话不再询问」在本层兑现,继承链上的同一问才够得着;审批席依约不退役继承问),而**能不能读**与审批席 / 回决写侧是同一只判据
+ * ({@link standingAnswerDurablyRecordable}):记得下的才代答,记不下的(规则车道清不掉的类、带授予绑定的问 ……)不代答,存量行也不例外 —— 一事一读。
+ * 部署名单门不读店(它的问带 `matchedAskRule` ⇒ 类 `ask_rule` ⇒ 规则车道清不掉,本函数对它也答这一类 —— `test/approval-exemption.test.ts` 的同判钉)。
+ * 事实取自**这一问本身**:类集经 core 包根唯一的类派生 `classifyAsk`;它的第二参是闸内的事实,本层看不到 ⇒ 给诚实的空(core 对「不持席位的站」的同一句;
+ * 只读决定半场的 `decisionAskClassesOf` 不在包根导出,所以空闸事实不是手造的第二种读法,而是同一只派生在本层能交出的全部输入)。
+ * `requiresRealApproval` / `mandated` 读这一问自报的成员;治理位恒假(本层不是治理层);授予绑定读调用(`grantBindingOf`)。
+ */
+export declare function policyAskStandingAnswerFacts(req: StandingAnswerGrantCarrier, ask: Extract<PermissionResult, {
+    action: "ask";
+}>): StandingAnswerFacts;
+/**
+ * 一问身上与「站着的答案」有关的事实位 —— {@link standingAnswerMayRetire} 的全部入参。
  *
- * 🔴 **三格全必填布尔**,刻意不做 `?: true` 的「只记真」形:判据哪天多一位,每个读者都要当场编译红,
+ * 🔴 **全必填**,刻意不做 `?: true` 的「只记真」形:判据哪天多一位,每个读者都要当场编译红,
  * 而不是漏传一格被静默读成 `false`(那是安全轴上的 fail-open)。读者各自从自己手里的形折成这三格,
  * 然后交**同一只** {@link standingAnswerMayRetire}(判据只有一份,折法各归读者):
  *  · live 读侧取 `req` + 本地治理 peek;live 写侧取 pending 条目;
@@ -95,10 +105,13 @@ export interface StandingAnswerFacts {
     readonly requiresRealApproval: boolean;
     /** core 闸站盖的强制位([ref]):规则清不掉、站着的答案退不掉,只有对**这一次调用**的应答能答。 */
     readonly mandated: boolean;
-    /** 7.116.0(审计修复批 S4,core 7.41.0 `Skill` 卡):这一问的应答**还授予**这一次调用之外的东西(批准 `Skill` = 激活技能 + 本 run 内
-     *  清单免问)。站着的答案要代答它必须读得出授予绑定、且绑定相同;core 7.41.0 在活的问上不给绑定 ⇒ 两侧都读不出 ⇒ 不可记、不被代答。
-     *  读者一律经 `standing-answer-grant.ts` 的 `answerGrantsBeyondCall`(唯一读口)折这一位。 */
-    readonly grantsBeyondCall: boolean;
+    /** 这一问的应答**授不授予**这一次调用之外的东西、授予的话绑定是什么(批准引擎的 `Skill` = 激活技能 + 本 run 内清单免问)。
+     *  `bound` ⇒ 站着的答案按「工具 + 绑定」记、只代答绑定相同的问(core 7.43.0 #1348 / #1357:活的问与停驻行同带 `boundGrantDigest`);
+     *  `unreadable` ⇒ 不可记、不被代答(fail-closed)。读者一律经 `standing-answer-grant.ts` 的 `grantBindingOf`(唯一读口)折这一位。 */
+    readonly grantBinding: GrantBinding;
+    /** 引擎盖在这一问上的**类集**(`AskRequest.classes` / 停驻行孪生座;经 core 的屏 `screenAskClassMembers` 读)。`undefined` = 卡上没有类
+     *  (老引擎 / 不盖类的站)或屏拒 —— 读不出的类不是「无类」。 */
+    readonly classes: readonly AskClass[] | undefined;
 }
 /**
  * 🔴 **S-660 —— 会话级放行的唯一判据:站着的答案能不能退掉这一问。** 纯谓词,三个读者:
@@ -133,6 +146,14 @@ export interface StandingAnswerFacts {
  * `mandated` 孪生座由**耐久** `/decide` 腿读,见 {@link parkRowStandingAnswerFacts}。)
  */
 export declare function standingAnswerMayRetire(facts: StandingAnswerFacts): boolean;
+/**
+ * **耐久**豁免店能不能记下这一问的答案:先得退得掉({@link standingAnswerMayRetire}),再得没有授予绑定 —— 耐久店按 `(会话, 工具名)` 记,
+ * 没有绑定这一维,记下一张带绑定的答案就会代答同名工具的每一种绑定(`plugins/approval-exemption-store.ts`)。读者两处:耐久 `/decide` 腿的
+ * remember 可记性(`http/resume-legs.ts`)与运维队列行的 `rememberRefused`(`http/routes/approvals-assistant.ts`)—— 两处同答。
+ * 读侧同理:耐久店不代答带绑定的问(`standingGrantSettles` 经 `answerGrantsBeyondCall`;策略层的豁免探针 —— workflow 问句门 ——
+ * 经本判据 + {@link policyAskStandingAnswerFacts})。
+ */
+export declare function standingAnswerDurablyRecordable(facts: StandingAnswerFacts): boolean;
 /**
  * 🔴 **S-663 → NP-1(7.100.0 合并复审 [ref] 交叉表 #2)—— 耐久 `/decide` 腿的 {@link StandingAnswerFacts}:从 park 行铸三位。**
  * 纯投影,**不判**:判据是同一只 {@link standingAnswerMayRetire}(唯一读点 = `http/resume-legs.ts` 的 remember 可记性,
@@ -311,6 +332,18 @@ export interface ToolApprovalFrame {
     /** S-934 ②:这一问属于的**全部**类(core `ASK_CLASSES` 序,`classes[0] === askClass`,非空)—— 读整只集合,别只读 {@link askClass}(一问可同属
      *  几类)。与 `askClass` 同在同缺、同一只窄读;逐字同序过境,不排序不去重。 */
     classes?: AskClass[];
+    /**
+     * core 7.43.0 #1348 / #1357(**ADDITIVE**,`"tool_approval"` only)—— 对引擎 `Skill` 工具的调用,批准它**还授予**的东西的摘要
+     * (`AskRequest.boundGrantDigest`,技能名 + 两只清单规范拼写的哈希);别的卡缺席。与停驻行 / inbox 行的同名位同值(core:同一只工厂铸,
+     * 活卡与它的停驻孪生按 `(toolCallId, boundGrantDigest)` 对账)。逐字过境,本仓不重算;站着的答案按「工具 + 它」记(S-1115)。
+     */
+    boundGrantDigest?: string;
+    /** 上一位哈希的那一份值:`{ skill, allowedTools, disallowedTools }`(`skill: null` = 调用没点名任何已载技能)。与摘要同在同缺;**部署文本**,
+     *  壳按上下文转义渲染(core:display metadata)。逐字过境。 */
+    boundGrants?: BoundSkillGrants;
+    /** core 7.43.0 #1353:分类器没给判词的成因词(`error` / `timeout` / `parse_error`;只在类 `classifier_no_ruling` 的卡上)。闭集经 core 的
+     *  `readClosedWordSeat(req, "classifierNoRuling")` 窄读(筛 = core `isAutoModeFallbackCause`),集外 ⇒ 缺席 + 计一次。display:本仓不按它裁决。 */
+    classifierNoRuling?: AutoModeFallbackCause;
     /**
      * **[ref]**(core 7.19.0;**ADDITIVE**,`"tool_approval"` only)—— 这只**根外读** ask 的**清障目录**:
      * 把 `dir` 加进本会话的读目录(壳侧既有的 `/add-dir` 口),同一条调用就不会再问。
@@ -713,83 +746,6 @@ export declare const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOffe
  * 指定 scope = 让一次「在项目 A 里点的同意」写成一条覆盖项目 B(或全局)的常驻放行 —— 那是这条轴上
  * 最贵的一次扩权。静默忽略同样不行:客户端会以为自己设上了。响亮拒,一句话说清谁拥有这一格。
  */
-/**
- * #1016 —— `settledBy` 与 allow 族**互斥**的那一句(两条回决腿共用一份文本:同一个体在两条口上必须
- * 拿到同一句话)。判的是**键在不在**,不是它是什么词。
- */
-/**
- * #1016 —— `settledBy` 的**形**拒句(两条回决腿共用一份文本,与 {@link SETTLED_BY_DENY_ONLY} 同姿势)。
- *
- * 🔴 **判形 ≠ 判词**:本层证得出的只有「它是个串」;「它是不是词表里的那个串」由**引擎**判(两条腿各有
- * 一处响亮拒,读数在收车档)。加这道形门的理由是**类型必须说真话**(wire 边界强类型宪法):
- * 一个非串值往下会落进 `AskOutcome.settledBy`(core 的串闭集)与本仓审计账本的 `settledBy?: string` 席 ——
- * 两处都声明成串,而运行期塞进去一个数字。引擎对它照样响亮拒(实测三形一致:`"bogus"` / `1` / `null`
- * 都是 `approver_contract` 的 fail-closed deny),所以这不是在补一个 fail-open,而是**不让本层的类型撒谎**;
- * 顺带把「一个非串永远不可能是闭集成员」这件必然的事拒在最早的地方,与同一只 parser 里 `note` /
- * `persistRule.rule` / `persistRule.edited` 三道既有形门**同族**(那三道在,只有本格没有 = 本格才是特例)。
- */
-export declare const SETTLED_BY_MUST_BE_STRING = "settledBy must be a string \u2014 the settlement source is one word from the engine's closed set, and this layer judges only the SHAPE (which word it is, the engine decides)";
-/**
- * #1016 / S-558 —— **live 座的那一次边界 cast,全仓只此一处**(耐久座的那一次在 `hostDecisionFacts` 里,
- * 一座一次)。它说的是「我把一个**未判词**的串放到只收词的座上」:判词的是 core —— `resolveAsk` 对词表外
- * 是 `approver_contract` 的响亮 fail-closed deny,不是静默当人拒(实测三形同判,特征钉在
- * `test/tool-approval.test.ts` 的 #1016 组)。本层判过的只有**形**(是个串、只与 deny 同行,见
- * {@link SETTLED_BY_MUST_BE_STRING} / {@link SETTLED_BY_DENY_ONLY}),而形不是词。
- *
- * 两个座位读它:这次回决的**即时结算**(`entry.settle` 的自报参)与**持久行**(`decideAsk` 的
- * `settledBy` 列)。S-558 之前只有前者 —— 于是同一个事实在「当次」与「重放」上是两个答案。
- * S-843:耐久 ask 回决口(`POST /v1/tasks/:taskId/asks/:askId/decision`)写的是**同一个座**(同一列,经
- * `outcomeOfDecidedRow` 交给同一个 `AskOutcome.settledBy`),所以它也走这一只 —— cast 仍是一座一次。
- */
-export declare function respondSettledBy(parsed: Pick<ParsedApprovalResponse, "settledBy">): HostSettledBy | undefined;
-export declare const SETTLED_BY_DENY_ONLY = "settledBy is only meaningful with decision \"deny\" \u2014 only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door's own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision";
-/**
- * S-843 / 车QK F7 —— `settledBy` 的**宽**拒句(三条回决腿共用一份文本,与 {@link SETTLED_BY_DENY_ONLY} 同姿势)。句子逐字是 S-843 在
- * 耐久 ask 回决口路由里写下的那一句(车QK F7 起搬到判官旁,路由不再自己写),尺 = 店的同一个常量({@link MAX_SETTLED_BY_CHARS})。
- */
-export declare const SETTLED_BY_TOO_WIDE = "settledBy must be 1-16 characters \u2014 the settlement source is one word from the engine's closed set and lands in a fixed-width column on the decision row";
-/**
- * S-843 —— 决议体上 `settledBy` 的判据,**一处成形**。三条 HTTP 回决腿共读:
- * `POST /v1/approvals/:sessionId/decide`(耐久 park 腿)、`POST /v1/tasks/:taskId/asks/:askId/decision`(耐久 ask 腿)与
- * live `POST /v1/tool-approvals/:id/respond`(经 {@link parseToolApprovalResponse};车QK F7 起 —— 此前那只 parser 手写了 ②③ 两臂、
- * 没有 ④,是这条判据的第二个写者)。
- *
- * 次序即契约(①–③ = decide 腿修前那三道 if 的原序,逐字搬来,不是新判据):
- *  ① 直连门在场 ⇒ `not_in_proof` —— 键不在决策证明的签名载荷里(§6.3 同族第四条,理由在 approvals-assistant 的
- *     `DECIDE_NOT_IN_PROOF_KEYS` 注);
- *  ② 不是 deny ⇒ `deny_only` —— {@link SETTLED_BY_DENY_ONLY};
- *  ③ 不是串 ⇒ `not_string` —— {@link SETTLED_BY_MUST_BE_STRING};
- *  ④ 长度不在 1..{@link MAX_SETTLED_BY_CHARS} ⇒ `too_wide` —— {@link SETTLED_BY_TOO_WIDE}(车QK F7 / A3,7.104.0 合并复审)。
- *     尺与店门口的形门同一只谓词({@link settledByFitsColumn}):`/respond` 与耐久 ask 口写的是**同一列**
- *     (`approval_ask.settled_by`,`VARCHAR(16)`),列宽是列的事实,不是某一条腿的事实。修前这一道只长在耐久 ask 口的路由里:
- *     `/respond` 上一只超宽 / 空串的来源位要到 CAS 里才被店门抛,落进 D5「店抖动不挡真实回决」臂 —— 行没决,决议照样交给了引擎,200。
- *     `/decide` 的来源位不落这一列(交给 core 的 checkpoint,core 在 CAS 之前按词表拒),这一道对它同样成立:core 的闭集词
- *     (`human` / `timeout` / `policy`)都远短于这把尺,尺外的串不可能是一个词 ⇒ 三条口对同一个体同判同句,不为一条腿开特例。
- * 判的是**键在不在 / 配不配这个决议 / 形**,**从不判词**(词表属主是 core;三条腿的词都由引擎响亮拒)。
- *
- * 返回判决而不是直接回 400:各条腿在调用点按自己的码约定发出(错误文案冻结门按字面站点采集,码是 wire 契约);
- * 调用点对判决做穷举 `switch` + `never` 兜底(加一臂 = 编译红,[ref])。`accepted` 臂带着已证形的串 —— 调用点拿它往下传,
- * 不再对 `body.settledBy` 做第二次窄化。第三参给字面 `false` 的调用点(live `/respond`:那条口没有直连门证明)拿到的判决型里
- * **没有** `not_in_proof` 臂(重载),不必为一条结构上不可达的臂写兜底。
- */
-export type SettledByBodyVerdict = {
-    kind: "absent";
-} | {
-    kind: "accepted";
-    settledBy: string;
-} | {
-    kind: "not_in_proof";
-} | {
-    kind: "deny_only";
-} | {
-    kind: "not_string";
-} | {
-    kind: "too_wide";
-};
-export declare function judgeSettledByBody(settledBy: unknown, decision: string, directDoorActive: false): Exclude<SettledByBodyVerdict, {
-    kind: "not_in_proof";
-}>;
-export declare function judgeSettledByBody(settledBy: unknown, decision: string, directDoorActive: boolean): SettledByBodyVerdict;
 /** S-720(core 7.32.0 #1093)—— `readRootGrant` 只随 `decision:"allow"`(CC 卡的第三选项「Yes, and add directory」= 放行这一次
  *  + 加目录;`allow_session` 不是那一个选项,`deny` 上它没有意义)。裁决之前响亮拒,不静默丢。 */
 export declare const READ_ROOT_GRANT_ALLOW_ONLY = "readRootGrant is only meaningful with decision \"allow\" \u2014 it is the card's \"Yes, and add directory\" answer (allow this call and add the card's readRootCandidate.dir to this run's read directories)";
@@ -803,27 +759,12 @@ export declare function parseToolApprovalResponse(body: unknown): {
     updatedInput?: unknown;
     persistRule?: ParsedPersistRule;
     note?: string;
-    settledBy?: string;
+    decidedBy: ApprovalDecidedBy;
     readRootGrant?: string;
 } | {
     ok: false;
     error: string;
 };
-/** [ref] 车2:`parseToolApprovalResponse` 的成功分支形——`respond()` 拆分出的私有收尾方法(`finishRespond`/
- *  `respondWithCas`)复用,避免裸内联匿名类型重复三处。 */
-type ParsedApprovalResponse = Extract<ReturnType<typeof parseToolApprovalResponse>, {
-    ok: true;
-}>;
-/**
- * #1016 —— wire 上**开给调用方**的那一个词,从 core 的两只闭集里取**交集**。
- *
- * 🔴 它是一条**文档钉**,不是过境值的型(过境值是 `string`,理由在 `parseToolApprovalResponse` 那处注):
- * `"human"` 与缺席同义、`"timeout"` 是本仓自己观察到的窗(客户端说出来就是替服务端伪证一件只有服务端
- * 看得见的事),而耐久座那边的 `"person"` / `"sla_timeout"` 同理。两只词表**只在 `"policy"` 上相交** ——
- * 这条 wire 键因此恰好只开那一个词。core 哪天退役它,这里**编译期先红**,而不是在 wire 上静默留一个
- * 两个座都已经不收的词;`test/tool-approval.test.ts` 的 #1016 那组按它写判据。
- */
-export type RespondSettledBy = Extract<HostSettledBy, HostDecidedBy>;
 /**
  * [ref] R-13 C —— `UNATTENDED_APPROVAL_POLICY` 的**闭集**词表([ref]Q1「裁2:A+C」/[ref] 裁②)。
  *
@@ -1038,9 +979,9 @@ type DecidedRowFacts = Pick<AskRow, "decision" | "settledBy"> & {
  *  · **结算来源**(S-558)—— 行上非 null 即宿主自报的那个词(`null` = 人决,与「不铸这个键」同义;
  *    语义属主 = `AskRow.settledBy` 顶注)。
  *
- * 🔴 approve 臂**不读**来源位,而且那不是「静默丢」:store 的入店形门(`assertDecideSettledBy`)让
- * 「approve 行带来源位」在**写面不可表示** —— core 对 `{allow:true, settledBy}` 是 fail-closed 拒,
- * 一条那样的行没有任何读回路径能诚实地交还给引擎,所以它在落库那一刻就被拒掉了,而不是在这里被吞掉。
+ * 🔴 S-1154:来源位**两向都读**。决定体的出处位 `decidedBy:"policy"` 在 allow 与 deny 上都会落列(引擎 7.39.0 起铸
+ * `policy_allowed`),所以 approve 行带来源位是一条合法的行,它的每条读回路径交还 `{allow:true, settledBy:"policy", updatedInput?}`
+ * —— 与当次回决交给引擎的那一只逐字同形。
  */
 export declare function outcomeOfDecidedRow(row: DecidedRowFacts): DecidedAskOutcome;
 /**
@@ -1085,7 +1026,7 @@ export declare class ToolApprovalCoordinator {
      *  askId 下全部本地条目(自己 + 兄弟 + 重复注册),直接调用它们各自的 `settle`,而不是被动等一个永远
      *  不会来的本地信号。 */
     private readonly pendingByAskId;
-    /** Per-capability session grants — keys = sessionAllowKey(owner, sessionId, category) (修2; bounded). */
+    /** Per-capability session grants — keys = sessionAllowKey(owner, sessionId, category, grant binding) (修2; bounded). */
     private readonly allowAllSessions;
     /** [ref] HIGH-1(broker)→[ref]四 core 产品裁定「多活集合+广播+首决胜出」:per-(owner, host-session)
      *  的**当前活跃连接集合**——boundAsk 闭包只携身份,emit 时广播给该 key 下**全部**活连接(宿主重连/

package/dist/tool-approval.js

@@ -1,6 +1,7 @@
 import { contentKindOf } from "./approval-content-kind.js";
+import { liveSettledBy, policyCannotAllow, readDecidedBy, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK, SETTLED_BY_RETIRED } from "./host-decision.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
+import { uuidv7, classifyAsk, foldArbitrationRow, screenAskClassMembers, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets, redactSecretsWithArms } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -9,11 +10,11 @@ import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
 import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readRuleEvidence, readAllowRuleShadowed, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
-import { MAX_SETTLED_BY_CHARS, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, settledByFitsColumn } from "./plugins/approval-ask-store-sql.js";
+import { POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 import { governanceOriginOf } from "./runtime-governance.js";
-import { answerGrantsBeyondCall } from "./standing-answer-grant.js";
+import { answerGrantsBeyondCall, grantBindingOf } from "./standing-answer-grant.js";
 const defaultLogger = createLogger();
 export const APPROVAL_GATE_KINDS = ["human", "irreversible_ask"];
 export function isApprovalGateKind(k) {
@@ -81,11 +82,37 @@ const FS_WRITE_TOOLS = pathConfinableWriteToolNames();
 function sessionAllowCategory(toolName) {
     return FS_WRITE_TOOLS.has(toolName) ? "fs-write" : `tool:${toolName}`;
 }
-function sessionAllowKey(owner, sessionId, category) {
-    return JSON.stringify([owner, sessionId, category]);
+function sessionAllowKey(owner, sessionId, category, binding) {
+    return JSON.stringify([owner, sessionId, category, binding.kind === "bound" ? binding.digest : null]);
+}
+function askStandingAnswerFacts(req, governanceForced) {
+    return {
+        governanceForced,
+        requiresRealApproval: req.requiresRealApproval === true,
+        mandated: req.mandated === true,
+        grantBinding: grantBindingOf(req),
+        classes: screenAskClassMembers(req.askClass, req.classes)?.classes,
+    };
+}
+export function policyAskStandingAnswerFacts(req, ask) {
+    return {
+        governanceForced: false,
+        requiresRealApproval: ask.requiresRealApproval === true,
+        mandated: ask.mandated === true,
+        grantBinding: grantBindingOf(req),
+        classes: [...classifyAsk(ask, { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} }).classes],
+    };
 }
 export function standingAnswerMayRetire(facts) {
-    return !facts.governanceForced && !facts.requiresRealApproval && !facts.mandated && !facts.grantsBeyondCall;
+    return (!facts.governanceForced &&
+        !facts.requiresRealApproval &&
+        !facts.mandated &&
+        facts.grantBinding.kind !== "unreadable" &&
+        facts.classes !== undefined &&
+        foldArbitrationRow(new Set(facts.classes)).ruleMayClear);
+}
+export function standingAnswerDurablyRecordable(facts) {
+    return standingAnswerMayRetire(facts) && facts.grantBinding.kind === "none";
 }
 export function parkRowStandingAnswerFacts(pending, gate, governance) {
     const riskDescriptor = "riskDescriptor" in gate ? gate.riskDescriptor : undefined;
@@ -93,7 +120,8 @@ export function parkRowStandingAnswerFacts(pending, gate, governance) {
         governanceForced: governanceOriginOf({ riskDescriptor }, governance) === true,
         requiresRealApproval: readParkRowTrueSeat(pending, "requiresRealApproval"),
         mandated: readParkRowTrueSeat(pending, "mandated") || mandatedFromSeat(readRuleOffersAbsenceSeat(pending)),
-        grantsBeyondCall: answerGrantsBeyondCall(pending),
+        grantBinding: grantBindingOf(pending),
+        classes: screenAskClassMembers(pending.askClass, pending.classes)?.classes,
     };
 }
 function pendingEntryStandingAnswerFacts(entry) {
@@ -101,7 +129,8 @@ function pendingEntryStandingAnswerFacts(entry) {
         governanceForced: entry.governanceForced === true,
         requiresRealApproval: entry.requiresRealApproval === true,
         mandated: entry.mandated === true,
-        grantsBeyondCall: answerGrantsBeyondCall(entry),
+        grantBinding: entry.grantBinding,
+        classes: entry.classes,
     };
 }
 function mandatedFromSeat(seat) {
@@ -118,25 +147,6 @@ export const PERSIST_RULE_TEXT_ERROR = `persistRule.rule must be a non-empty str
 export const PERSIST_RULE_EDITED_FLAG_ERROR = "persistRule.edited must be a boolean when present";
 export const PERSIST_RULE_BATCH_INDEX_ERROR = "persistRule.batchOfferIndex must be a non-negative integer when present";
 export const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOfferIndex is mutually exclusive with persistRule.rule / persistRule.edited — send exactly one arm";
-export const SETTLED_BY_MUST_BE_STRING = "settledBy must be a string — the settlement source is one word from the engine's closed set, and this layer judges only the SHAPE (which word it is, the engine decides)";
-export function respondSettledBy(parsed) {
-    return parsed.settledBy;
-}
-export const SETTLED_BY_DENY_ONLY = 'settledBy is only meaningful with decision "deny" — only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door\'s own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision';
-export const SETTLED_BY_TOO_WIDE = `settledBy must be 1-${MAX_SETTLED_BY_CHARS} characters — the settlement source is one word from the engine's closed set and lands in a fixed-width column on the decision row`;
-export function judgeSettledByBody(settledBy, decision, directDoorActive) {
-    if (settledBy === undefined)
-        return { kind: "absent" };
-    if (directDoorActive)
-        return { kind: "not_in_proof" };
-    if (decision !== "deny")
-        return { kind: "deny_only" };
-    if (typeof settledBy !== "string")
-        return { kind: "not_string" };
-    if (!settledByFitsColumn(settledBy))
-        return { kind: "too_wide" };
-    return { kind: "accepted", settledBy };
-}
 export const READ_ROOT_GRANT_ALLOW_ONLY = 'readRootGrant is only meaningful with decision "allow" — it is the card\'s "Yes, and add directory" answer (allow this call and add the card\'s readRootCandidate.dir to this run\'s read directories)';
 export const READ_ROOT_GRANT_SHAPE = `readRootGrant must be the card's readRootCandidate.dir sent back byte for byte — a non-empty string of at most ${READ_ROOT_CANDIDATE_DIR_MAX} characters`;
 export const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope — the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
@@ -183,23 +193,19 @@ export function parseToolApprovalResponse(body) {
             }
             note = rawNote;
         }
-        const settledByVerdict = judgeSettledByBody(body.settledBy, d, false);
-        let settledBy;
-        switch (settledByVerdict.kind) {
-            case "deny_only":
-                return { ok: false, error: SETTLED_BY_DENY_ONLY };
-            case "not_string":
-                return { ok: false, error: SETTLED_BY_MUST_BE_STRING };
-            case "too_wide":
-                return { ok: false, error: SETTLED_BY_TOO_WIDE };
-            case "absent":
-                break;
+        if (body.settledBy !== undefined)
+            return { ok: false, error: SETTLED_BY_RETIRED };
+        const decidedByReading = readDecidedBy(body.decidedBy, false);
+        let decidedBy;
+        switch (decidedByReading.kind) {
+            case "outside_closed_set":
+                return { ok: false, error: DECIDED_BY_OUTSIDE_CLOSED_SET };
             case "accepted":
-                settledBy = settledByVerdict.settledBy;
+                decidedBy = decidedByReading.decidedBy;
                 break;
             default: {
-                const unreachable = settledByVerdict;
-                throw new Error(`unhandled settledBy verdict: ${JSON.stringify(unreachable)}`);
+                const unreachable = decidedByReading;
+                throw new Error(`unhandled decidedBy reading: ${JSON.stringify(unreachable)}`);
             }
         }
         const rawGrant = body.readRootGrant;
@@ -214,7 +220,7 @@ export function parseToolApprovalResponse(body) {
             ...(d !== "deny" && u !== undefined ? { updatedInput: u } : {}),
             ...(persistRule !== undefined ? { persistRule } : {}),
             ...(note !== undefined ? { note } : {}),
-            ...(settledBy !== undefined ? { settledBy } : {}),
+            decidedBy,
             ...(readRootGrant !== undefined ? { readRootGrant } : {}),
         };
     }
@@ -310,9 +316,10 @@ function replayTerminalAskRow(row) {
     return false;
 }
 export function outcomeOfDecidedRow(row) {
-    if (row.decision !== "approve")
-        return row.settledBy !== null ? { allow: false, settledBy: row.settledBy } : false;
-    return row.updatedInput !== undefined ? { allow: true, updatedInput: row.updatedInput } : true;
+    const allow = row.decision === "approve";
+    const source = row.settledBy !== null ? { settledBy: row.settledBy } : {};
+    const edit = allow && row.updatedInput !== undefined ? { updatedInput: row.updatedInput } : {};
+    return row.settledBy === null && !("updatedInput" in edit) ? allow : { allow, ...edit, ...source };
 }
 function settleArgsOfDecided(outcome) {
     if (typeof outcome === "boolean")
@@ -751,13 +758,14 @@ export class ToolApprovalCoordinator {
         return (this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(origin.owner, origin.sessionId, origin.taskId))).isMarked(req.toolCallId);
     }
     async standingGrantSettles(origin, req, governanceForced) {
-        if (!standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true, grantsBeyondCall: answerGrantsBeyondCall(req) }))
+        const facts = askStandingAnswerFacts(req, governanceForced);
+        if (!standingAnswerMayRetire(facts))
             return false;
         const sessionId = origin.sessionId;
         if (!sessionId)
             return false;
-        const live = this.allowAllSessions.has(sessionAllowKey(origin.owner, sessionId, sessionAllowCategory(req.toolName)));
-        const durable = !live && (await this.durableGrantHas(sessionId, req.toolName));
+        const live = this.allowAllSessions.has(sessionAllowKey(origin.owner, sessionId, sessionAllowCategory(req.toolName), facts.grantBinding));
+        const durable = !live && !answerGrantsBeyondCall(req) && (await this.durableGrantHas(sessionId, req.toolName));
         if (!live && !durable)
             return false;
         if (!(await this.sessionGrantUncontestedByRow(origin, req)))
@@ -1071,6 +1079,7 @@ export class ToolApprovalCoordinator {
         let effectiveGovernanceForced = governanceForced;
         let ruleLaneMaterial = this.buildRuleLaneMaterial(req, origin.owner, governanceForced, origin.sessionId);
         const mandateWord = readClosedWordSeat(req, "mandate");
+        const noRulingCause = readClosedWordSeat(req, "classifierNoRuling");
         const originWord = typeof req.origin === "string" && req.origin.length > 0 ? req.origin : undefined;
         const askClassPair = readAskClassPair(req);
         const frame = {
@@ -1098,7 +1107,9 @@ export class ToolApprovalCoordinator {
             ...(governanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(req.mandated === true ? { mandated: true } : {}),
-            ...(standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true, grantsBeyondCall: answerGrantsBeyondCall(req) }) ? {} : { rememberRefused: true }),
+            ...(standingAnswerMayRetire(askStandingAnswerFacts(req, governanceForced)) ? {} : { rememberRefused: true }),
+            ...(typeof req.boundGrantDigest === "string" ? { boundGrantDigest: req.boundGrantDigest, ...(req.boundGrants !== undefined ? { boundGrants: req.boundGrants } : {}) } : {}),
+            ...(noRulingCause !== undefined ? { classifierNoRuling: noRulingCause } : {}),
             ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
             ...(originWord !== undefined ? { origin: originWord } : {}),
             ...(askClassPair ?? {}),
@@ -1306,11 +1317,12 @@ export class ToolApprovalCoordinator {
                 return unattended === "unavailable" ? unattended : shapeDeny(unattended);
             }
             if (settled.allowed) {
-                if (settled.updatedInput === undefined && settled.readRootGrant === undefined)
+                if (hostSettled === undefined && settled.updatedInput === undefined && settled.readRootGrant === undefined)
                     return true;
                 return {
                     allow: true,
                     ...(settled.updatedInput !== undefined ? { updatedInput: settled.updatedInput } : {}),
+                    ...(hostSettled !== undefined ? { settledBy: hostSettled } : {}),
                     ...(settled.readRootGrant !== undefined ? { readRootGrant: settled.readRootGrant } : {}),
                 };
             }
@@ -1623,11 +1635,14 @@ export class ToolApprovalCoordinator {
                 return shapeOutcome(await allowedP);
             }
         }
+        const entryGrantBinding = grantBindingOf(req);
+        const entryClasses = askClassPair?.classes;
         const rememberRefused = !standingAnswerMayRetire(pendingEntryStandingAnswerFacts({
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(req.mandated === true ? { mandated: true } : {}),
-            toolName: req.toolName,
+            grantBinding: entryGrantBinding,
+            classes: entryClasses,
         }));
         if (rememberRefused)
             frame.rememberRefused = true;
@@ -1648,6 +1663,8 @@ export class ToolApprovalCoordinator {
             ...(origin.sessionId ? { sessionId: origin.sessionId } : {}),
             frame,
             toolName: req.toolName,
+            grantBinding: entryGrantBinding,
+            ...(entryClasses !== undefined ? { classes: entryClasses } : {}),
             registeredAtMs: Date.now(),
             expiresAtMs: persistedExpiresAtMs,
             ...(ruleLaneMaterial !== undefined ? { ruleLane: ruleLaneMaterial } : {}),
@@ -1785,6 +1802,9 @@ export class ToolApprovalCoordinator {
         const preRule = this.precheckEditedRuleBeforeDecision(entry, parsed);
         if (preRule !== undefined)
             return preRule;
+        if (policyCannotAllow(parsed.decidedBy, parsed.value !== "deny", entry.requiresRealApproval === true)) {
+            return { status: 400, body: { error: POLICY_CANNOT_ALLOW_PERSON_ASK, errorCode: "request.body_shape" } };
+        }
         const ruleEligibility = { eligible: true };
         const settled = this.askStore && entry.askId !== undefined && entry.batchId !== undefined
             ? this.respondWithCas(this.askStore, entry.askId, entry.batchId, id, entry, parsed, ruleEligibility)
@@ -1945,7 +1965,7 @@ export class ToolApprovalCoordinator {
                     gateBoundInputHash: row.gateBoundInputHash,
                     decision,
                     ...(parsed.note !== undefined ? { note: parsed.note } : {}),
-                    ...(parsed.settledBy !== undefined ? { settledBy: parsed.settledBy } : {}),
+                    decidedBy: parsed.decidedBy,
                     ...(parsed.updatedInput !== undefined && parsed.value !== "deny" ? { updatedInput: parsed.updatedInput } : {}),
                     ...(principal !== undefined ? { principal } : {}),
                     ...(httpReq !== undefined ? { httpReq } : {}),
@@ -2183,7 +2203,7 @@ export class ToolApprovalCoordinator {
                 decision: parsed.value === "deny" ? "deny" : "approve",
                 ...(parsed.note !== undefined ? { decisionNote: parsed.note } : {}),
                 ...(parsed.value !== "deny" && parsed.updatedInput !== undefined ? { updatedInput: parsed.updatedInput } : {}),
-                ...(parsed.settledBy !== undefined ? { settledBy: respondSettledBy(parsed) } : {}),
+                ...((sb) => (sb !== undefined ? { settledBy: sb } : {}))(liveSettledBy(parsed.decidedBy)),
             }), "decideAsk", DURABLE_CALL_TIMEOUT_MS, (late) => {
                 if (late.ok)
                     this.notifyExternalDecision(askId, outcomeOfDecidedRow(late.row));
@@ -2244,10 +2264,10 @@ export class ToolApprovalCoordinator {
                 if (oldest !== undefined)
                     this.allowAllSessions.delete(oldest);
             }
-            this.allowAllSessions.add(sessionAllowKey(entry.owner, entry.sessionId, sessionAllowCategory(entry.toolName)));
+            this.allowAllSessions.add(sessionAllowKey(entry.owner, entry.sessionId, sessionAllowCategory(entry.toolName), entry.grantBinding));
         }
         const allowed = parsed.value !== "deny";
-        const settleArgs = opts?.settleOutcome !== undefined ? settleArgsOfDecided(opts.settleOutcome) : { allowed, updatedInput: parsed.updatedInput, settledBy: respondSettledBy(parsed) };
+        const settleArgs = opts?.settleOutcome !== undefined ? settleArgsOfDecided(opts.settleOutcome) : { allowed, updatedInput: parsed.updatedInput, settledBy: liveSettledBy(parsed.decidedBy) };
         const readRootGrant = opts?.settleOutcome === undefined || opts.settleOutcomeIsThisRequest === true ? parsed.readRootGrant : undefined;
         entry.settle(settleArgs.allowed, settleArgs.allowed ? "allowed" : "denied", settleArgs.updatedInput, settleArgs.settledBy, settleArgs.allowed ? undefined : parsed.note, readRootGrant);
         const updatedInputDelivered = opts?.updatedInputDelivered ?? true;