@stigmer/runner 3.15.0 → 3.15.2-dev.20260913223433

package/src/activities/execute-cursor/approval-state.ts

@@ -29,9 +29,12 @@
  * name->category mapping are baked into the generated hook script (from
  * approval-policy.ts), not carried in the state file — only the dynamic inputs
  * (autoApproveAll, leasedCategories, mcpToolPolicies, approvedGrantTokens) live
- * here. This mirrors the native harness and avoids denying auto-approved MCP
- * tools, which are absent from the policy map and indistinguishable from unknown
- * tools by name.
+ * here. The gated set is the shared taxonomy (`shared/tool-kind.ts`
+ * `toolApprovalCategory`, the native gate's too), and the policy map is the
+ * runtime's merged one (`TurnInput.mcp.policies`), so this file adds no rule of
+ * its own; fail-open on an unknown name is what keeps auto-approved MCP tools
+ * — absent from the policy map and indistinguishable from unknown tools by
+ * name — from being denied.
  *
  * Approval leases (the scoped successor to autoApproveAll): `autoApproveAll` is
  * now ONLY the pre-armed spec.auto_approve_all global bypass. An interactive
@@ -208,9 +211,10 @@ export interface ApprovalStateFile {
    * CAS capture for gitignored writes (the deep-agent parity switch). When true,
    * a non-secret gitignored write/edit no longer stays on the deny-gate: the hook
    * stages its pre-write bytes into the runner-owned cas-observations sidecar and
-   * ALLOWS it to flow, and the turn boundary captures it into content-addressable
-   * storage as a `GIT_IGNORED_CAPTURED` change for per-file review (mirroring the
-   * deep-agent `CasCaptureFilesystemBackend` observer). A secret-like gitignored
+   * ALLOWS it to flow, and the runtime's capture (`harness/capture.ts`, reading
+   * the sidecar as this adapter's CAS observations) stores it as a
+   * `GIT_IGNORED_CAPTURED` change for per-file review (the deep-agent's
+   * `CasCaptureFilesystemBackend` observer is the same fact, in-process). A secret-like gitignored
    * path is instead hard-blocked (denied, nothing written) and recorded as an
    * unreviewable observation, so its bytes never reach durable storage.
    *
@@ -776,8 +780,12 @@ export async function removeActiveTurnPointer(gateDir: string): Promise<void> {
  * (PendingApprovalComputer) and CLEARS entries once they carry an approval_action,
  * so by the time the workflow reinvokes this activity, pending_approvals is empty
  * and the decision survives only on the tool call (status WAITING_APPROVAL +
- * approval_action set). This mirrors the native harness
- * (execute-deep-agent/hitl.ts extractApprovalDecisions).
+ * approval_action set). The runtime reads the same rows for the decisions
+ * themselves (`harness/approval-decisions.ts` `approvalDecisionsOf`, on
+ * `TurnInput.approvalDecisions`, for every harness); this reader exists for
+ * the two facts only this harness needs beside them — the pending-approval
+ * protos the grant and prompt builders take, and the content digests for the
+ * exact grant — and a test pins the two readers' agreement.
  *
  * Returns a PendingApproval list reconstructed from those tool calls (so the
  * existing grant/prompt builders work unchanged) alongside the decision map.

package/src/activities/execute-cursor/cas-observations.ts

@@ -11,7 +11,9 @@
  * invocation is a FRESH, EPHEMERAL process that cannot hold in-memory state
  * across writes. So Cursor's before-map must be DISK-BACKED: the hook stages each
  * first-touched gitignored path into a per-turn "cas-observations" sidecar, and
- * the runner reads it back at the turn boundary.
+ * the runtime reads it back — as the CAS observations this adapter binds on
+ * the sink ({@link readSidecarSnapshot}) — at each progress capture and at
+ * the turn boundary (`harness/capture.ts`).
  *
  * The sidecar lives under the session HITL directory
  * (`~/.stigmer/sessions/{id}/hitl/cas-observations/`), OUTSIDE the user's
@@ -22,7 +24,8 @@
  * never this scratch. A Temporal retry re-runs the reset and re-observes.
  *
  * ONE MODULE OWNS THE ON-DISK FORMAT. Both sides live here so they cannot drift:
- *  - the READER ({@link readCasObservations}) the runner boundary calls;
+ *  - the READER ({@link readCasObservations}, and its runtime-shaped view
+ *    {@link readSidecarSnapshot});
  *  - the WRITER-SCRIPT GENERATOR ({@link buildObservationStagingScript}) whose
  *    output the hook embeds and runs on the runner's own Node binary. The writer
  *    classifies secrets from the SAME {@link isSecretLikePath} pattern arrays the
@@ -43,6 +46,7 @@
 
 import { readFile, readdir, rm, mkdir } from "node:fs/promises";
 import { join } from "node:path";
+import type { CasTouchedSnapshot } from "../../shared/filereview/cas-touched.js";
 import { SECRET_BASENAME_PATTERNS, SECRET_PATH_PATTERNS } from "../../shared/filereview/secret-paths.js";
 
 /** Sidecar directory name under the session HITL dir. */
@@ -135,6 +139,20 @@ export async function readCasObservations(hitlDir: string): Promise<CasObservati
   return { captured, secretPaths };
 }
 
+/**
+ * One atomic read of the sidecar as the runtime's {@link CasTouchedSnapshot}
+ * — what this adapter binds through `TurnSink.bindCasObservations`. The
+ * sidecar is small (one marker plus one before-blob per touched path), so
+ * re-reading it per capture is cheap and always reflects a sub-agent's
+ * writes staged since the last read.
+ */
+export async function readSidecarSnapshot(hitlDir: string): Promise<CasTouchedSnapshot> {
+  const { captured, secretPaths } = await readCasObservations(hitlDir);
+  const before = new Map<string, Uint8Array | null>();
+  for (const c of captured) before.set(c.path, c.before);
+  return { before, blockedSecretPaths: new Set(secretPaths) };
+}
+
 /**
  * Emit a JS `RegExp` constructor byte-identical to a source pattern, safe to
  * embed inside a single-quoted bash string (JSON.stringify emits double quotes;

package/src/activities/execute-cursor/cursor-capabilities.ts

@@ -15,14 +15,33 @@
  *  - No tool restriction in the SDK config: the hook's "disabled" arm
  *    enforces `enabledTools` at call time (issue #350).
  *  - PNG and JPEG inline; the transport re-sniffs (`shared/attachment-vision.ts`).
- *  - File review under the `cursor` harness id, with the transient
- *    `.cursor/hooks.json` the gate writes excluded from every diff
- *    (`capture-flow.ts`).
+ *  - File review under the `cursor` harness id, with the two files the gate
+ *    writes into the repo excluded from the mid-run progress diff
+ *    ({@link CURSOR_RUNNER_OWNED_PATHS}). The capture itself is the runtime's
+ *    (`harness/capture.ts`, S3 M4); this adapter contributes only the hook
+ *    sidecar it binds as the runtime's CAS observations (`turn-setup.ts`).
  */
 
-import type { HarnessCapabilities } from "../../harness/capabilities.js";
+import type { FileReviewIdentity, HarnessCapabilities } from "../../harness/capabilities.js";
 import { CURSOR_VISION_PROFILE } from "../../shared/attachment-vision.js";
-import { CURSOR_FILE_REVIEW_IDENTITY } from "./capture-flow.js";
+
+/**
+ * Workspace-relative paths the Cursor gate writes into the repo for the
+ * turn's duration (`workspace-setup.ts`). Excluded from the runtime's capture
+ * so a turn's diff never shows the gate's own machinery: at the boundary the
+ * gate is already torn down (the adapter's `finally` restores both), so the
+ * exclusion is load-bearing for the MID-RUN progress slice, which reads the
+ * tree while the gate is installed. The workspace-scoped gate dir and the
+ * SDK state live under `~/.stigmer` / the git-excluded `.stigmer`, so they
+ * need no exclusion.
+ */
+const CURSOR_RUNNER_OWNED_PATHS: readonly string[] = [".cursor/hooks.json", ".cursor/rules/stigmer-tool-approval.mdc"];
+
+/** The two facts the runtime's capture and reconcile read from this harness (`harness/capabilities.ts` `FileReviewIdentity`). */
+export const CURSOR_FILE_REVIEW_IDENTITY: FileReviewIdentity = {
+  harnessId: "cursor",
+  excludePaths: CURSOR_RUNNER_OWNED_PATHS,
+};
 
 export const CURSOR_CAPABILITIES: HarnessCapabilities = {
   pausePrimitive: "deny-and-retry",

package/src/activities/execute-cursor/message-translator.ts

@@ -30,13 +30,11 @@
  * - approvalMessage: from the policy, with placeholder resolution
  */
 
-import { clone, create } from "@bufbuild/protobuf";
+import { create } from "@bufbuild/protobuf";
 import type { JsonObject } from "@bufbuild/protobuf";
-import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { AgentMessageSchema, ToolCallSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 import type { AgentMessage, ToolCall } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
-import { SubAgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/subagent_pb";
-import type { SubAgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/subagent_pb";
+import { SubAgentExecutionSchema, type SubAgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/subagent_pb";
 import { ApprovalAction, ApprovalPolicySource, MessageType, ToolCallStatus, SubAgentStatus, ToolKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { SDKMessage } from "@cursor/sdk";
 import type { MergedToolPolicy } from "./approval-policy.js";
@@ -730,29 +728,15 @@ export interface MessageAccumulatorOptions {
    */
   workspaceRoot?: string;
   /**
-   * Sub-agent executions carried over from the persisted transcript on a
-   * durable resume ({@link seededSubAgentsOf}). The accumulator re-registers
-   * them so a sub-agent's resumed lifecycle updates merge onto the seeded row
-   * instead of producing a duplicate, and so the row survives the round-trip
-   * rather than being dropped from the rebuilt status. Empty on a first run.
+   * The status's own `subAgentExecutions` array, wrapped BY REFERENCE exactly
+   * as `messages` is: the accumulator upserts into it in place, so the rows
+   * the runtime seeded on a resume (`harness/turn-context.ts`
+   * `seedFromPersistedStatus`) are indexed by id at construction and a
+   * resumed sub-agent's lifecycle updates merge onto its seeded row instead
+   * of producing a duplicate. Omitted in unit tests that only assert basic
+   * translation; the accumulator then owns a private array.
    */
-  seededSubAgents?: readonly SubAgentExecution[];
-}
-
-/**
- * The sub-agent rows a resumed turn re-registers, cloned from the persisted
- * execution so the input stays immutable. This accumulator OWNS
- * `status.subAgentExecutions` and overwrites it on every flush, which is why
- * the runtime's transcript seeding (`harness/turn-context.ts`
- * `seedTranscriptFromExecution`) leaves the sub-agents to this harness: they
- * are re-registered here, never pushed onto the status. Same "left a
- * transcript" test as the seeding, so a resume that seeded messages always
- * seeds their sub-agents too.
- */
-export function seededSubAgentsOf(execution: AgentExecution): SubAgentExecution[] {
-  const persisted = execution.status;
-  if (!persisted || persisted.messages.length === 0) return [];
-  return persisted.subAgentExecutions.map((sub) => clone(SubAgentExecutionSchema, sub));
+  subAgentExecutions?: SubAgentExecution[];
 }
 
 /**
@@ -787,7 +771,7 @@ export class MessageAccumulator {
   private readonly messages: AgentMessage[];
   private activeAiByRunId = new Map<string, AgentMessage>();
   private activeThinkingByRunId = new Map<string, AgentMessage>();
-  private readonly _subAgentExecutions: SubAgentExecution[] = [];
+  private readonly _subAgentExecutions: SubAgentExecution[];
   private readonly subAgentMap = new Map<string, SubAgentExecution>();
   private readonly mergedPolicies?: ReadonlyMap<string, MergedToolPolicy>;
   private readonly provenance?: ApprovalProvenanceContext;
@@ -797,20 +781,23 @@ export class MessageAccumulator {
 
   constructor(messages: AgentMessage[], options?: MessageAccumulatorOptions) {
     this.messages = messages;
+    this._subAgentExecutions = options?.subAgentExecutions ?? [];
     this.mergedPolicies = options?.mergedPolicies;
     this.provenance = options?.provenance;
     this.workspaceRoot = options?.workspaceRoot;
 
-    // Resume seeding. When constructed over a pre-seeded transcript (a durable
-    // resume — see seedCursorTranscriptFromExecution in index.ts), rebuild the
-    // by-id tool-call index so a cross-message completion for a seeded call
-    // resolves onto the existing proto, and re-register seeded sub-agents so
-    // their resumed lifecycle updates merge in place. A first run carries an
-    // empty transcript and no seed, so both are no-ops. Mirrors the deep-agent
-    // ExecutionState.rebuildToolCallIndex + sub-agent re-registration on resume.
+    // Resume seeding. When constructed over a pre-seeded status (the runtime's
+    // `seedFromPersistedStatus` on a resume), rebuild the by-id indexes so a
+    // cross-message completion for a seeded call resolves onto the existing
+    // proto and a resumed sub-agent's lifecycle updates merge onto its seeded
+    // row. A first run carries an empty status, so both are no-ops.
     this.rebuildToolCallIndex();
-    for (const sub of options?.seededSubAgents ?? []) {
-      this._subAgentExecutions.push(sub);
+    this.rebuildSubAgentIndex();
+  }
+
+  /** Index every sub-agent row already present in the (seeded) array by its id, so upserts land on it. */
+  private rebuildSubAgentIndex(): void {
+    for (const sub of this._subAgentExecutions) {
       if (sub.id) this.subAgentMap.set(sub.id, sub);
     }
   }
@@ -936,10 +923,11 @@ export class MessageAccumulator {
     // grants already use — see toolCallIdentityToken) and keep the original id.
     // Without this the seeded approved call and the re-run would both appear (a
     // duplicate row) and dropping the seeded id would trip the backend's
-    // append-only-at-identity guard, stalling the run. This generalizes the v2
-    // deep-agent StatusBuilder.findResumableSeededToolCall (a tool-name match)
-    // to the full Cursor identity, reusing the single existing identity
-    // definition rather than introducing a parallel one.
+    // append-only-at-identity guard, stalling the run. This generalizes what
+    // the native builder does by exact tool_call_id (`V3StatusBuilder`'s resume
+    // reconciliation; its v2 predecessor matched by tool name) to the full
+    // Cursor identity, reusing the single existing identity definition rather
+    // than introducing a parallel one.
     const seeded = this.findResumableSeededToolCall(tc);
     if (seeded) {
       // Re-key the fresh call_id onto the seeded proto so this call_id's later
@@ -1170,7 +1158,7 @@ export class MessageAccumulator {
  * WAITING_APPROVAL.
  *
  * This is the cursor analog of the native harness synthesizing WAITING_APPROVAL
- * tool calls from LangGraph interrupts (execute-deep-agent/index.ts). The hook
+ * tool calls from LangGraph interrupts (execute-deep-agent/turn-settle.ts). The hook
  * ledger — not the SDK-reported tool status — is the authoritative record of
  * what was gated, because the hook is the only component that makes the per-call
  * allow/deny decision. The backend then projects pending_approvals from these

package/src/activities/execute-cursor/prompt-builder.ts

@@ -1,52 +1,53 @@
 /**
- * Builds the enhanced prompt for the Cursor agent.
+ * The Cursor harness's prompt: the four shapes `buildPrompt` selects from how
+ * the agent resolved and whether the turn carries adjudicated approvals
+ * (`capabilities.systemPrompt` is false — `@cursor/sdk` takes no system
+ * prompt, so the blueprint and the standing context ride the session's FIRST
+ * user message and persist in the agent's own conversation store; a resumed
+ * agent receives only what is per-turn).
  *
- * Replicates prompt_builder.py::enhance_system_prompt() but delivers
- * the content via the first user message (Cursor SDK has no systemPrompt
- * parameter). On reinvocation, only the approval decisions are sent.
+ * What is this harness's and what is shared (S3 M5, Q-S3-10 / Q-M5-2):
+ *  - Shared through `shared/prompt-sections.ts`: WHICH standing sections
+ *    render and in WHAT order (`standingContextSections`) and the input-files
+ *    bullet and disclosure lines (`inputFileLines`). Their WORDS come from
+ *    each fact's own module; this builder only frames them.
+ *  - This harness's: the framing — `<xml_tag>` sections joined by `---`
+ *    rules, the idiom for structured content inside a USER message — and the
+ *    placement (which sections a first message carries, which a resumed
+ *    turn's prefix repeats, where the catchup and the protocol sit); every
+ *    text that quotes this engine: `<available_skills>` (`the Read tool`),
+ *    `<sub_agent_delegation>` and `<codebase_exploration>` (the Task tool and
+ *    the built-in `explore` agent), the response rules, the structured-output
+ *    directive (prose JSON the activity extracts); and the tool-approval
+ *    protocol, which exists because of this harness's deny-based gate (see
+ *    `formatToolApprovalProtocol`) and would be false on an engine that
+ *    interrupts before a tool runs.
  *
- * Sections (in order, conditionally included):
- * 1. Interaction-mode / implement-plan directives
- * 2. Agent instructions (persona/character)
- * 3. Available skills metadata
- * 4. Sub-agent delegation guidance
- * 5. Workspace context (multi-root only; single-dir is redundant with SDK cwd)
- * 6. Input files / referenced files
- * 7. Response rules (only when agent has no custom instructions)
- * 8. User's actual message
+ * The whole rendered prompt, per shape, is pinned by
+ * `__tests__/prompt-goldens.test.ts`; `__tests__/build-prompt.test.ts` pins
+ * every branch of the selection.
  */
 
 import { resolve } from "node:path";
 import type { SubAgent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
 import type { PendingApproval } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
 import { ApprovalAction, InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import { formatContextBridgeText } from "../../shared/context-bridge.js";
 import { formatConversationCatchupText } from "../../shared/conversation-catchup.js";
 import {
   formatChannelTemplatesSection,
   type ChannelMessagingInfo,
 } from "../../shared/channel-attachment.js";
+import type { SenderIdentity } from "../../shared/sender-identity.js";
+import type { DeclaredPreferencesContent } from "../../shared/declared-preferences.js";
+import type { RecalledMemoriesContent } from "../../shared/recalled-memories.js";
+import type { DownloadUrlKind } from "../../shared/attachment-download-urls.js";
+import type { ResolvedAttachment } from "../../shared/attachment-resolver.js";
 import {
-  formatSenderIdentityText,
-  type SenderIdentity,
-} from "../../shared/sender-identity.js";
-import { formatSessionContextText } from "../../shared/session-context.js";
-import {
-  formatDeclaredPreferencesText,
-  type DeclaredPreferencesContent,
-} from "../../shared/declared-preferences.js";
-import {
-  formatRecalledMemoriesText,
-  type RecalledMemoriesContent,
-} from "../../shared/recalled-memories.js";
-import {
-  visionDisclosureLines,
-  type NotViewableEntry,
-} from "../../shared/attachment-vision.js";
-import {
-  downloadUrlDisclosureLine,
-  type DownloadUrlKind,
-} from "../../shared/attachment-download-urls.js";
+  inputFileLines,
+  standingContextSections,
+  type StandingSectionKind,
+  type VisionPromptInfo,
+} from "../../shared/prompt-sections.js";
 import { formatTurnRecoveryText } from "./turn-recovery.js";
 import type { SkillMetadata } from "../../shared/skill-resolver.js";
 import type { AgentResolution, AgentResolutionReason } from "./session-lifecycle.js";
@@ -68,34 +69,29 @@ const RUNNER_PATH_MARKERS = [
   "/dist/main.js",
 ] as const;
 
-/**
- * Vision facts about this turn's attachments, rendered inside the
- * input-files section: which images the model can see inline (in send
- * order) and which degraded to the file-pointer story. Derived per turn
- * from the resolved attachments — never carried across turns.
- */
-export interface VisionPromptInfo {
-  inlineFilenames: string[];
-  notViewable: readonly NotViewableEntry[];
-}
+// The prompt renders the attachment resolver's own result type — a local
+// structural twin (`AttachmentPromptEntry`) lived here until S3 M5 and the
+// projection into it was the one reason `turn-setup.ts` had a
+// `prepareAttachmentPrompt` step; the twin dropped the size, so this
+// harness's input-files line never carried it. One type, one truth: the
+// runtime's `ResolvedAttachment`; the vision facts are the shared
+// `VisionPromptInfo` (prompt-sections.ts) for the same reason.
+
+export type { VisionPromptInfo };
 
 /**
- * One resolved attachment as the `<input_files>` section renders it —
- * the final workspace-relative path plus the duplicate-rename disclosure
- * (attachment-resolver.ts / shared/attachment-naming.ts).
+ * This harness's tag for each shared standing section (the section's
+ * identity and order are `prompt-sections.ts`'s; the XML framing is the
+ * idiom for structured content in a user message). Exhaustive by the
+ * compiler: a new kind fails here until it is named.
  */
-export interface AttachmentPromptEntry {
-  /** Workspace-relative path the agent reads (`.stigmer/inputs/{filename}`). */
-  path: string;
-  /** Original filename, present only when a duplicate name was renamed. */
-  renamedFrom?: string;
-  /**
-   * Download URL for the attachment's stored object, when one was minted
-   * (shared/attachment-download-urls.ts) — rendered beside the path so the
-   * agent can hand the file to tools that cannot read this filesystem.
-   */
-  downloadUrl?: string;
-}
+const STANDING_SECTION_TAGS: Record<StandingSectionKind, string> = {
+  "conversation-sender": "conversation_sender",
+  "declared-preferences": "declared_preferences",
+  "recalled-memories": "recalled_memories",
+  "session-context": "session_context",
+  "previous-conversation": "previous_conversation_context",
+};
 
 export interface EnhancedPromptOptions {
   instructions: string;
@@ -110,7 +106,8 @@ export interface EnhancedPromptOptions {
   subAgents: SubAgent[];
   workspaceDirs: string[];
   workspaceFileRefs: string[];
-  attachments: AttachmentPromptEntry[];
+  /** This turn's resolved input files, as the runtime's attachment phase returns them. */
+  attachments: readonly ResolvedAttachment[];
   /** Inline/degraded image facts for the input-files section (T04 vision). */
   vision?: VisionPromptInfo;
   /**
@@ -248,41 +245,16 @@ export function buildEnhancedPrompt(options: EnhancedPromptOptions): string {
     sections.push(formatResponseRules());
   }
 
-  // The sender identity precedes the bridge: it is standing context about
-  // WHO the conversation is with, which the carried conversation may refer
-  // back to.
-  if (options.senderIdentity) {
-    sections.push(formatSenderIdentitySection(options.senderIdentity));
-  }
-
-  // Platform-declared standing facts precede embedder-supplied context
-  // (DD-002 D3): both are standing background, but the declared preferences
-  // are platform-authored while session context is the embedder's overlay —
-  // the more specific overlay reads later and naturally refines.
-  if (options.declaredPreferences) {
-    sections.push(formatDeclaredPreferencesSection(options.declaredPreferences));
-  }
-
-  // Declared-by-humans precedes learned-and-confirmed (DD-006 D4): both
-  // are platform-authored standing background, but a preference is the
-  // user's exact words while a memory is an agent's confirmed inference —
-  // the exact statement reads first.
-  if (options.recalledMemories) {
-    sections.push(formatRecalledMemoriesSection(options.recalledMemories));
-  }
-
-  // Standing facts about the user (session context) come before the
-  // carried conversation (bridge): the bridge may refer back to them.
-  if (options.sessionContext) {
-    sections.push(formatSessionContextSection(options.sessionContext));
-  }
-
-  // The rollover context bridge sits directly before the protocol + task so
-  // the carried conversation is the freshest CONTEXT the model reads —
-  // while the approval protocol keeps its pinned last-before-task slot (it
-  // is an INSTRUCTION and must outweigh everything, including this bridge).
-  if (options.contextBridge) {
-    sections.push(formatContextBridgeSection(options.contextBridge));
+  // The standing context, in the shared order (the doctrine is stated once,
+  // on `standingContextSections`); this harness only frames each section.
+  // The block sits directly before the catchup, the protocol and the task so
+  // the carried conversation (its last section, the bridge) is the freshest
+  // CONTEXT the model reads — while the approval protocol keeps its pinned
+  // last-before-task slot (it is an INSTRUCTION and must outweigh
+  // everything, including the bridge).
+  for (const section of standingContextSections(options)) {
+    const tag = STANDING_SECTION_TAGS[section.kind];
+    sections.push(`<${tag}>\n${section.body}\n</${tag}>`);
   }
 
   // Catchup after the bridge (DD-007 D-d: bridge first, catchup second) —
@@ -328,6 +300,7 @@ export function buildReinvocationPrompt(
   const approved: string[] = [];
   const alreadyApplied: string[] = [];
   const skipped: string[] = [];
+  const rejected: string[] = [];
 
   for (const pa of pendingApprovals) {
     const action = approvalDecisions.get(pa.toolCallId);
@@ -339,6 +312,11 @@ export function buildReinvocationPrompt(
       approved.push(describeApproval(pa));
     } else if (action === ApprovalAction.SKIP) {
       skipped.push(describeApproval(pa));
+    } else if (action === ApprovalAction.REJECT) {
+      // A REJECT denies the tool and the run continues (stigmer#197); the
+      // runtime settles its row SKIPPED. Told apart from a SKIP in the prose
+      // so the model reads a refusal, not an omission (S3 M1, Q-S3-2).
+      rejected.push(describeApproval(pa));
     }
   }
 
@@ -366,6 +344,13 @@ export function buildReinvocationPrompt(
         skipped.map((a) => `- ${a}`).join("\n"),
     );
   }
+  if (rejected.length) {
+    parts.push(
+      "The user REJECTED the following action(s). Do not perform them; continue " +
+        "with the rest of the task without them:\n" +
+        rejected.map((a) => `- ${a}`).join("\n"),
+    );
+  }
 
   // The model's "ask the user first" bias recurs every turn, including resumes,
   // so restate the protocol: keep invoking tools directly to finish the task —
@@ -476,30 +461,10 @@ export function formatInstructions(instructions: string): string {
   return `<agent_instructions>\n${instructions}\n</agent_instructions>`;
 }
 
-export function formatContextBridgeSection(bridge: string): string {
-  return `<previous_conversation_context>\n${formatContextBridgeText(bridge)}\n</previous_conversation_context>`;
-}
-
-export function formatSenderIdentitySection(identity: SenderIdentity): string {
-  return `<conversation_sender>\n${formatSenderIdentityText(identity)}\n</conversation_sender>`;
-}
-
-export function formatDeclaredPreferencesSection(
-  preferences: DeclaredPreferencesContent,
-): string {
-  return `<declared_preferences>\n${formatDeclaredPreferencesText(preferences)}\n</declared_preferences>`;
-}
-
-export function formatRecalledMemoriesSection(
-  memories: RecalledMemoriesContent,
-): string {
-  return `<recalled_memories>\n${formatRecalledMemoriesText(memories)}\n</recalled_memories>`;
-}
-
-export function formatSessionContextSection(context: string): string {
-  return `<session_context>\n${formatSessionContextText(context)}\n</session_context>`;
-}
-
+/**
+ * The catchup is per-turn, not standing (it rides BOTH prompt paths), so it
+ * is framed here rather than through the shared standing block.
+ */
 export function formatConversationCatchupSection(digest: string): string {
   return `<conversation_catchup>\n${formatConversationCatchupText(digest)}\n</conversation_catchup>`;
 }
@@ -598,44 +563,24 @@ export function formatWorkspaceContext(dirs: string[]): string {
   ].join("\n");
 }
 
+/**
+ * The `<input_files>` section: this harness's intro around the shared lines
+ * (`prompt-sections.ts` `inputFileLines` says what each bullet and disclosure
+ * carries and why). The size on each bullet is new to this harness at S3 M5
+ * (Q-M5-3): the twin this builder rendered from had dropped it.
+ */
 export function formatInputFiles(
-  attachments: readonly AttachmentPromptEntry[],
+  attachments: readonly ResolvedAttachment[],
   vision?: VisionPromptInfo,
   downloadUrlKind?: DownloadUrlKind,
 ): string {
-  // A duplicate-renamed file (attachment-naming.ts) discloses its original
-  // name so the agent can connect "the two report.pdfs" in the user's
-  // message to distinct files on disk. A file with a minted download URL
-  // (attachment-download-urls.ts) lists it beside the path for the remote
-  // hand-off story.
-  const entries = attachments.map((a) => {
-    const rename =
-      a.renamedFrom !== undefined
-        ? ` (renamed from duplicate '${a.renamedFrom}')`
-        : "";
-    const url = a.downloadUrl !== undefined ? ` — download URL: ${a.downloadUrl}` : "";
-    return `- \`${a.path}\`${rename}${url}`;
-  });
-  // The URL hand-off line (shared wording, attachment-download-urls.ts)
-  // renders only when some listed file actually carries a URL — its wording
-  // keys on what kind of URL the storage backend mints.
-  const urlDisclosure =
-    downloadUrlKind !== undefined && attachments.some((a) => a.downloadUrl !== undefined)
-      ? [downloadUrlDisclosureLine(downloadUrlKind)]
-      : [];
-  // The vision lines (shared wording, attachment-vision.ts) tell the model
-  // which of these files it can already SEE inline versus which degraded to
-  // path-only — without them an agent silently ignores a photo the user
-  // believes it can see.
-  const disclosure = vision
-    ? visionDisclosureLines(vision.inlineFilenames, vision.notViewable)
-    : [];
+  const lines = inputFileLines(attachments, vision, downloadUrlKind);
   return [
     "<input_files>",
     "The following files have been provided as inputs. Read them when relevant to the task:",
-    ...entries,
-    ...urlDisclosure,
-    ...disclosure,
+    ...lines.entries,
+    ...(lines.urlHandoff !== undefined ? [lines.urlHandoff] : []),
+    ...lines.vision,
     "</input_files>",
   ].join("\n");
 }
@@ -684,14 +629,14 @@ export function formatInteractionModePrefix(
  */
 export function formatImplementPlanSection(
   buildFromPlan: boolean | undefined,
-  attachments: readonly AttachmentPromptEntry[],
+  attachments: readonly ResolvedAttachment[],
 ): string | undefined {
   if (!buildFromPlan) {
     return undefined;
   }
 
   const directive = buildImplementPlanDirective(
-    findApprovedPlanPath(attachments.map((a) => a.path)),
+    findApprovedPlanPath(attachments.map((a) => a.relativePath)),
   );
   return ["<implement_plan>", directive, "</implement_plan>"].join("\n");
 }
@@ -829,11 +774,8 @@ export interface BuildPromptInput {
   subAgents: SubAgent[];
   workspaceDirs: string[];
   workspaceFileRefs: string[];
-  /**
-   * This turn's resolved attachments for the `<input_files>` section —
-   * final paths plus duplicate-rename disclosure (attachment-resolver.ts).
-   */
-  attachments: AttachmentPromptEntry[];
+  /** This turn's resolved input files for the `<input_files>` section, as the runtime's attachment phase returns them. */
+  attachments: readonly ResolvedAttachment[];
   /**
    * Vision facts for the input-files section (T04): which attachments the
    * model sees inline and which degraded to path-only. PER-TURN like the