@try-works/dsh-recursive-mode 0.4.8 → 0.5.0

package/lib/config.d.ts

@@ -48,6 +48,13 @@ export interface RecursiveModeConfig {
 export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     shellOnly: z<boolean, boolean, "defined">;
     repoRoot: z<string, string, "plain">;
+    /**
+     * ⚠ THE THREE MODE DEFAULTS READ `DEFAULT_ENFORCEMENT_MODE` FROM `enforcement.ts`, and
+     * that is deliberate: the schema default and the runtime default are the SAME value, and
+     * two literals here would be two defaults. A caller that omits the section gets
+     * `DEFAULT_ENFORCEMENT` from the runtime; a caller that supplies a partial section gets
+     * the resolver's fill. Both must be the enforcing posture — see the const for why.
+     */
     enforcement: z<Schemastery.ObjectS<NoInfer<{
         preStep: z<"strict" | "advisory", "strict" | "advisory", "defined">;
         toolGuards: z<"strict" | "advisory", "strict" | "advisory", "defined">;
@@ -125,6 +132,13 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
 }>>, Schemastery.ObjectT<NoInfer<{
     shellOnly: z<boolean, boolean, "defined">;
     repoRoot: z<string, string, "plain">;
+    /**
+     * ⚠ THE THREE MODE DEFAULTS READ `DEFAULT_ENFORCEMENT_MODE` FROM `enforcement.ts`, and
+     * that is deliberate: the schema default and the runtime default are the SAME value, and
+     * two literals here would be two defaults. A caller that omits the section gets
+     * `DEFAULT_ENFORCEMENT` from the runtime; a caller that supplies a partial section gets
+     * the resolver's fill. Both must be the enforcing posture — see the const for why.
+     */
     enforcement: z<Schemastery.ObjectS<NoInfer<{
         preStep: z<"strict" | "advisory", "strict" | "advisory", "defined">;
         toolGuards: z<"strict" | "advisory", "strict" | "advisory", "defined">;

package/lib/enforcement.d.ts

@@ -1,4 +1,5 @@
 import { builtInToolPolicyDefault, type ToolPolicy } from './policy-globs.ts';
+import { type GateBlockAsk } from './recursive_ask.tool.ts';
 /**
  * The BUILT-IN default rule list (T16) is defined in `src/policy-globs.ts`,
  * beside the evaluator and the loader that use it as the ABSENT-file fallback,
@@ -40,6 +41,28 @@ export interface EnforcementConfig {
     /** T28: the caps. Always present, so a caller never has to guess a default. */
     budgets: BudgetConfig;
 }
+/**
+ * THE DEFAULT POSTURE: STRICT, on all three gates — and this const is the ONE literal.
+ *
+ * The owner's rule is *only one phase may be active at a time, and the phases should be
+ * sequential and the active phase must be locked before proceeding to next phase*. In
+ * `advisory` that rule is only WARNED about, and a live run showed what that costs: the
+ * run ignored the lock chain for over an hour, wrote phase 8 before phase 1.5 and locked
+ * nothing (twelve DRAFT artifacts, one operations entry). Strict was previously unsafe as
+ * a default because it also refused the run's OWN artifacts — a false positive. That was
+ * fixed, and `tests/strict-run-tree.spec.ts` now walks all twelve phases asserting the
+ * active artifact stays writable while a later one is refused. Strict therefore refuses
+ * exactly the ordering violations it is meant to refuse, so the default is the enforcing
+ * posture rather than a warning nobody has to act on.
+ *
+ * ⚠ WHY IT IS A NAMED CONST AND NOT THREE LITERALS. A default restated per site is this
+ * project's recurring failure: the same value exists in the Config schema, in
+ * `DEFAULT_ENFORCEMENT`, in an omitted config section, and in the parameter defaults of
+ * the helpers below, and moving only some of them leaves a caller that "still gets
+ * advisory". Every one of those sites now reads THIS const, so a revert is a one-line
+ * change and nothing can drift from it.
+ */
+export declare const DEFAULT_ENFORCEMENT_MODE: EnforcementMode;
 /**
  * Validate the enforcement config shape (unknown keys fail at plugin load).
  *
@@ -49,14 +72,26 @@ export interface EnforcementConfig {
  * A config error is loud at load, not mysterious later.
  */
 export declare function resolveEnforcementConfig(config: unknown): EnforcementConfig;
+/**
+ * The runtime default: what a caller gets when it supplies no `enforcement` section at all
+ * (a profile mounting this plugin with no config, e.g. `preset/recursive.patch.yml`). It is
+ * `DEFAULT_ENFORCEMENT_MODE` per gate, so this object and the resolver cannot disagree —
+ * see that const for WHY the default is strict.
+ */
 export declare const DEFAULT_ENFORCEMENT: EnforcementConfig;
 /**
  * T15: the rule that produced a guard decision (a machine-readable reason for
  * every allow/deny/ask the guard hands back). `'none'` means no guard predicate
  * fired; `'transition'` marks a decision whose only dissenting gate was the
  * advisory transition gate (see consultTransitionGate).
+ *
+ * `'phase-order'` is the WRITE half of the ordering rule the owner states as *only
+ * one phase may be active at a time, and the phases should be sequential and the
+ * active phase must be locked before proceeding to next phase*: `'lock-order'` refuses
+ * locking ahead, `'phase-order'` refuses WRITING ahead. Two labels rather than one,
+ * because the guard log has to tell the owner which of the two the agent attempted.
  */
-export type GuardRule = 'lock-order' | 'tdd-evidence' | 'locked-write' | 'transition' | 'none';
+export type GuardRule = 'lock-order' | 'phase-order' | 'tdd-evidence' | 'locked-write' | 'transition' | 'none';
 /** T15: the transition gate's verdict as attached to a decision (advisory only). */
 export interface GuardTransition {
     passed: boolean;
@@ -71,6 +106,12 @@ export interface GuardTransition {
  * optional — `coerceAskToDecision` is asserted with `toEqual({ kind: ... })`
  * (an EXACT match) in tests/enforcement.spec.ts, so the coercion path may never
  * grow extra keys. `evaluateToolGuard` itself always sets `rule`.
+ *
+ * ⚠ FU-7: `ask` IS OPTIONAL AND ADDITIVE TOO, for the same reason and one more. A refusal that a
+ * PERSON has to resolve carries the gate-block decision alongside its sentence (see `verdictFor`),
+ * and the payload is built by `buildGateBlockAsk` — the SAME builder the lock tool uses, so the two
+ * refusals cannot offer different options. It is absent on every decision that is not a lock-order
+ * refusal decided from real blockers, which is why every reader must treat it as optional.
  */
 export type ToolGuardDecision = {
     kind: 'allow';
@@ -82,6 +123,7 @@ export type ToolGuardDecision = {
     reason: string;
     rule?: GuardRule;
     transition?: GuardTransition;
+    ask?: GateBlockAsk;
 } | {
     kind: 'ask';
     reason?: string;
@@ -108,7 +150,7 @@ export interface ToolExecLike {
  * `recursive:policy` later — can read the effective rules instead of inferring
  * them from a code path.
  */
-export declare function resolveToolPolicyForGuard(worktreeRoot: string, runId: string): ToolPolicy;
+export declare function resolveToolPolicyForGuard(worktreeRoot: string, runId: string, activePhaseArtifact?: string): ToolPolicy;
 /**
  * The artifact whose phase baseline applies: the HIGHEST-numbered phase artifact
  * present in the run (a run at phase 3 has `00`-`03` on disk). Read from the
@@ -116,12 +158,36 @@ export declare function resolveToolPolicyForGuard(worktreeRoot: string, runId: s
  * needs, because a cached phase would apply yesterday's baseline to today's lock.
  */
 export declare function currentPhaseArtifact(worktreeRoot: string, runId: string): string;
+/**
+ * `mode` is the gate's configured posture. Its parameter default FOLLOWS the config
+ * default by REFERENCE (`DEFAULT_ENFORCEMENT.toolGuards`) rather than repeating the
+ * literal: a bare call is "the caller had no mode to hand", and the answer to that must
+ * be the same posture the config would have produced. Two literals are two defaults, and
+ * a helper left on the old `advisory` literal while the config moved to `strict` is
+ * exactly the twin-default hole this change closes — a caller that forgot the argument
+ * would silently get the permissive branch, which no config could then undo. Every
+ * production call site passes the mode explicitly (`index.ts` `runToolGuard`,
+ * `runtime.ts` `guardTool`, the preview tool); this default serves bare callers, and a
+ * bare caller must not be the one place enforcement quietly turns itself off.
+ */
 export declare function evaluateToolGuard(exec: ToolExecLike, worktreeRoot: string, activeRunId: string, mode?: EnforcementMode): ToolGuardDecision;
 /**
  * T6 (approval ask→policy bridge): an `ask` decision must never be a silent
  * allow. Under `strict` it coerces to `deny`; under `advisory` it stays `allow`
  * but flags a `warn` so the caller never lets it through unlogged. Non-ask
  * decisions pass through unchanged.
+ *
+ * ⚠ THE `mode` DEFAULT IS DELIBERATE, and it is NOT a neutral fallback — there is no
+ * neutral branch here. The domain is two postures, one of which ALLOWS the call, so
+ * "unspecified" has to be resolved rather than left open, and this codebase's rule for an
+ * undecidable path is to fail CLOSED (`index.ts`: *"we could not decide" is not
+ * permission*). It therefore FOLLOWS the config default by REFERENCE
+ * (`DEFAULT_ENFORCEMENT.toolGuards`), for the same reason as `evaluateToolGuard`'s: an
+ * `advisory` literal here would be a second, hidden copy of the old default inside the
+ * very module this change moves, and a future caller that omitted the argument would
+ * re-open the permissive path with no config able to close it. The production call site
+ * (`index.ts` `runToolGuard`) always passes the configured mode, so this changes no live
+ * behaviour — it removes the last place where "we were not told" meant "allow".
  */
 export declare function coerceAskToDecision(decision: ToolGuardDecision, mode?: EnforcementMode): ToolGuardDecision;
 /**

package/lib/guard-log.d.ts

@@ -1,8 +1,14 @@
 import type { GuardRule } from './enforcement.ts';
+import type { GateBlockAsk } from './recursive_ask.tool.ts';
 /**
  * One logged guard decision (the JSONL record shape the board/tests read).
  * `rule` is always set (the guard's own machine-readable reason for the
  * verdict); `transition` is present whenever the transition gate was consulted.
+ *
+ * FU-7: a REFUSAL that a person has to resolve also carries `ask` — the gate-block decision, in the
+ * same shape `recursive_lock` attaches to its own refusal. It is recorded because the log is where
+ * "why was this lock refused?" is answered, and the options are the other half of that answer; a
+ * caller (or a board) reading the trace can act on the refusal without parsing the sentence.
  */
 export interface GuardDecisionRecord {
     at: string;
@@ -15,6 +21,7 @@ export interface GuardDecisionRecord {
         passed: boolean;
         failures: string[];
     };
+    ask?: GateBlockAsk;
 }
 /** One logged observed-write tamper (a LOCKED artifact whose hash no longer matches). */
 export interface ObservedTamperRecord {

package/lib/index.js

@@ -1409,7 +1409,7 @@ function evaluateToolPolicy(policy, id, args = {}, ctx) {
 		if (rule.predicate) {
 			const match = rule.predicate(id, args, context);
 			if (match === null) continue;
-			return decide(rule, match.verdict, match.detail ? rule.reason + " " + match.detail : rule.reason);
+			return decide(rule, match.verdict, match.detail ? rule.reason + " " + match.detail : rule.reason, match.blockers);
 		}
 		return decide(rule, rule.verdict, rule.reason);
 	}
@@ -1418,13 +1418,20 @@ function evaluateToolPolicy(policy, id, args = {}, ctx) {
 		reason: "no policy rule matches " + id + " - ask is the no-match default"
 	};
 }
-/** One place where a rule's verdict becomes a decision, so `label` cannot drift. */
-function decide(rule, kind, reason) {
+/**
+* One place where a rule's verdict becomes a decision, so `label` cannot drift.
+*
+* `blockers` rides along untouched when the predicate supplied any (see `Decision.blockers`);
+* an EMPTY list is dropped rather than carried, so `blockers` on a decision always means "there
+* were blockers", never "the rule looked and found none".
+*/
+function decide(rule, kind, reason, blockers) {
 	const decision = {
 		kind,
 		reason
 	};
 	if (rule.label) decision.rule = rule.label;
+	if (blockers !== void 0 && blockers.length > 0) decision.blockers = blockers;
 	return decision;
 }
 /**
@@ -1484,7 +1491,8 @@ function lockOrderRule(artifact, runDir) {
 	if (blockers.length === 0) return null;
 	return {
 		verdict: "deny",
-		detail: blockers.map((b) => b.artifact + " (" + b.status + ")").join(", ")
+		detail: blockers.map((b) => b.artifact + " (" + b.status + ")").join(", "),
+		blockers
 	};
 }
 /**
@@ -1512,11 +1520,91 @@ function lockedWriteRule(target, worktreeRoot) {
 	};
 }
 /**
+* The file name when `abs` is a DIRECT CHILD of `runDir`, and `null` otherwise.
+*
+* ⚠ THE DIRECT-CHILD TEST IS NOT TIDINESS — IT IS WHAT KEEPS THE RULE OFF THE SUPPORT
+* FILES. `phaseNumberForArtifact` reads the leading digits of a NAME, so
+* `<run>/evidence/01-as-is.md` or `<run>/subagents/child/03-brief.md` would look like
+* phase 1 and phase 3 artifacts if the name were all that was examined. A phase artifact
+* is a file the run tree holds DIRECTLY beside the others (`recursive_init` writes all
+* twelve into `<run>/` itself), so the parent directory is part of the definition.
+*
+* The comparison normalizes separators and case: the same run directory reached through
+* a Windows spelling that differs in case is the same directory, and the rule must not
+* abstain on one spelling and fire on the other.
+*/
+function directChildName(abs, runDir) {
+	const normalize = (path) => resolve(path).replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+	if (normalize(dirname(abs)) !== normalize(runDir)) return null;
+	return basename(abs);
+}
+/**
+* PHASE-ORDER rule: a denial when the target is a LATER phase's artifact than the phase
+* currently active, `null` when it is not.
+*
+* ⚠ THE HOLE THIS CLOSES. The monotonic rule was enforced on `recursive_lock` ONLY. An
+* agent could therefore write `08-memory-impact.md` while the run sat at phase 0 — and a
+* live run did exactly that: twelve artifacts, not one of them locked, written out of
+* order, with a single line in `operations/operations.jsonl`. Ordering that only binds
+* the lock tool is not ordering; the model's ordinary `write` is the path that mattered.
+*
+* The owner's rule, verbatim: *only one phase may be active at a time, and the phases
+* should be sequential and the active phase must be locked before proceeding to next
+* phase*. The ACTIVE phase is the one the selector names (`ctx.activePhaseArtifact`), so:
+*
+*   - the target is the ACTIVE artifact, or shares its phase number (`00-requirements.md`
+*     and `00-worktree.md` are both phase 0; `01-as-is.md` and `01.5-root-cause.md` are
+*     both phase 1) -> ABSTAIN, the write is allowed;
+*   - the target is an EARLIER phase -> ABSTAIN. Such an artifact is LOCKED by
+*     construction (the active phase is the lowest UNLOCKED one), so the locked-artifact
+*     rule above decides it, and its rule label is preserved;
+*   - the target is a LATER phase -> DENY: working ahead.
+*
+* ⚠ THE ALLOW HALF IS LOAD-BEARING. An enforcement rule in this exact area was once the
+* bug: strict enforcement denied the run's OWN artifacts in every phase and made the
+* workflow unusable (see `resolveFrom` and `currentPhaseArtifact`). "The active artifact
+* stays writable at every phase" is therefore asserted by walking every phase, not by
+* one case — `tests/strict-run-tree.spec.ts` (d).
+*
+* WHAT IT ABSTAINS ON, deliberately:
+*   - no `activePhaseArtifact` (a caller with no run context, or a run with no phase
+*     artifacts yet) -> abstain, never guess a phase;
+*   - a target outside the active run's own directory -> abstain. The rule is about THIS
+*     run's sequence; another run's tree is a different question and denying it here
+*     would be a false positive;
+*   - a support file (anything not a direct child) -> abstain: `evidence/`, `scratch/`,
+*     `addenda/`, `subagents/`, `operations/` and a plain `<run>/notes.md` are not phases.
+*
+* The predicate adds only the per-call particular — which artifact, which phase, which is
+* active; the rule keeps the static, auditable sentence.
+*/
+function phaseOrderRule(target, ctx) {
+	const active = ctx.activePhaseArtifact;
+	if (!target || !ctx.runDir || !ctx.worktreeRoot) return null;
+	if (typeof active !== "string" || active === "") return null;
+	const activePhaseText = phaseNumberForArtifact(active);
+	if (!activePhaseText) return null;
+	const normalized = target.replace(/\\/g, "/");
+	if (!normalized.endsWith(".md")) return null;
+	const abs = resolveFrom(ctx.worktreeRoot, normalized);
+	if (!abs) return null;
+	const name = directChildName(abs, ctx.runDir);
+	if (name === null) return null;
+	const phaseText = phaseNumberForArtifact(name);
+	if (!phaseText) return null;
+	if (Number(phaseText) <= Number(activePhaseText)) return null;
+	return {
+		verdict: "deny",
+		detail: name + " is phase " + phaseText + " but the ACTIVE phase is " + active + " (phase " + activePhaseText + ") - the active phase must be locked before writing a later phase"
+	};
+}
+/**
 * The BUILT-IN default rule list — the pre-T16 guard behaviour expressed as
 * data:
 *
 *   `recursive_lock*`  -> the monotonic lock-order denial;
 *   the write-tool ids -> the locked-artifact write denial;
+*   the write-tool ids -> the phase-order (write-ahead) denial;
 *   `*`                -> allow, so an ordinary tool is not turned into an `ask`.
 *
 * Every `deny` precedes the `allow`, which is what makes "deny wins over allow" a
@@ -1543,6 +1631,13 @@ function builtInToolPolicyRules() {
 		label: "locked-write",
 		predicate: (id, args, ctx) => WRITE_TOOL_NAMES.has(id) ? lockedWriteRule(policyTargetPath(args), ctx.worktreeRoot) : null
 	});
+	for (const name of WRITE_TOOL_NAMES) rules.push({
+		pattern: name,
+		verdict: "deny",
+		reason: "phase order: only one phase may be active at a time - the active phase must be locked before a later phase artifact is written",
+		label: "phase-order",
+		predicate: (id, args, ctx) => WRITE_TOOL_NAMES.has(id) ? phaseOrderRule(policyTargetPath(args), ctx) : null
+	});
 	rules.push({
 		pattern: "*",
 		verdict: "allow",
@@ -1581,6 +1676,10 @@ function attachPolicyPredicate(rule) {
 		...rule,
 		predicate: (id, args, ctx) => LOCK_TOOL_NAMES.has(id) ? lockOrderRule(args.artifact, ctx.runDir) : null
 	};
+	if (rule.label === "phase-order") return {
+		...rule,
+		predicate: (id, args, ctx) => WRITE_TOOL_NAMES.has(id) ? phaseOrderRule(policyTargetPath(args), ctx) : null
+	};
 	if (WRITE_TOOL_NAMES.has(rule.pattern)) return {
 		...rule,
 		predicate: (id, args, ctx) => WRITE_TOOL_NAMES.has(id) ? lockedWriteRule(policyTargetPath(args), ctx.worktreeRoot) : null
@@ -7237,6 +7336,31 @@ function buildAskQuestion(gateId) {
 		options: gate.options.map((option) => ({ ...option }))
 	});
 }
+/** The payload, as the refusal carries it. Validated through `buildAskQuestion`. */
+function buildGateBlockAsk(artifact, blocked) {
+	return {
+		gate: "gate-block",
+		...buildAskQuestion("gate-block"),
+		artifact,
+		blocked
+	};
+}
+/**
+* FU-7 — THE OPTIONS AS TEXT, DERIVED FROM THE PAYLOAD rather than restated.
+*
+* WHY A RENDERER IS NEEDED AT ALL: the harness renders a `tools/pre-execute` denial as
+* `Error: <reason>` and drops every other field of the decision (measured in
+* `packages/core/tools`: `content: [{ type: 'text', text: 'Error: ' + denialReason }]`), so an
+* ask that rode along as a SIBLING field would reach the model as nothing at all — which is
+* exactly how a strict-by-default guard made the recovery path unreachable. The refusal
+* therefore renders the payload into the text it hands back, and it renders THIS object, so
+* the visible sentence and the structured payload cannot disagree.
+*/
+function renderGateBlockAsk(ask) {
+	const options = ask.options.map((option) => option.label + (option.description === void 0 ? "" : " (" + option.description + ")")).join(" ");
+	const target = ask.artifact === "" ? "recursive_ask gate=gate-block" : "recursive_ask gate=gate-block artifact=" + ask.artifact;
+	return ask.header + ": " + ask.question + " Options: " + options + " Answer with " + target + ".";
+}
 /**
 * PHASE 0 — build the question for ANY accepted gate, including the run-start gate.
 *
@@ -7701,7 +7825,7 @@ function coupleGateBlockToGoal(goalService, agent, ref, reason) {
 * (Phase C R3/R4/R7/R8, PROPOSAL 8.4/8.6/13.5).
 *
 * Layer 2 (tool guards) and Layer 8 (tamper) are the remaining enforcement
-* layers. Configurable strict|advisory per gate (default advisory).
+* layers. Configurable strict|advisory per gate (default strict).
 */
 /**
 * The BUILT-IN default rule list (T16) is defined in `src/policy-globs.ts`,
@@ -7733,6 +7857,28 @@ const BUDGET_KEYS = [
 	"maxResultBytes"
 ];
 /**
+* THE DEFAULT POSTURE: STRICT, on all three gates — and this const is the ONE literal.
+*
+* The owner's rule is *only one phase may be active at a time, and the phases should be
+* sequential and the active phase must be locked before proceeding to next phase*. In
+* `advisory` that rule is only WARNED about, and a live run showed what that costs: the
+* run ignored the lock chain for over an hour, wrote phase 8 before phase 1.5 and locked
+* nothing (twelve DRAFT artifacts, one operations entry). Strict was previously unsafe as
+* a default because it also refused the run's OWN artifacts — a false positive. That was
+* fixed, and `tests/strict-run-tree.spec.ts` now walks all twelve phases asserting the
+* active artifact stays writable while a later one is refused. Strict therefore refuses
+* exactly the ordering violations it is meant to refuse, so the default is the enforcing
+* posture rather than a warning nobody has to act on.
+*
+* ⚠ WHY IT IS A NAMED CONST AND NOT THREE LITERALS. A default restated per site is this
+* project's recurring failure: the same value exists in the Config schema, in
+* `DEFAULT_ENFORCEMENT`, in an omitted config section, and in the parameter defaults of
+* the helpers below, and moving only some of them leaves a caller that "still gets
+* advisory". Every one of those sites now reads THIS const, so a revert is a one-line
+* change and nothing can drift from it.
+*/
+const DEFAULT_ENFORCEMENT_MODE = "strict";
+/**
 * Validate the enforcement config shape (unknown keys fail at plugin load).
 *
 * A budget must be a POSITIVE INTEGER. Zero and negatives are rejected rather than
@@ -7744,7 +7890,7 @@ function resolveEnforcementConfig(config) {
 	const raw = config ?? {};
 	const unknown = Object.keys(raw).filter((k) => !CONFIG_KEYS.includes(k));
 	if (unknown.length > 0) throw new Error("EnforcementConfig has unknown key(s) " + unknown.join(", ") + " - config is { preStep, toolGuards, tamper, budgets }");
-	const mode = (value) => value === "strict" ? "strict" : "advisory";
+	const mode = (value) => value === "strict" ? "strict" : value === "advisory" ? "advisory" : DEFAULT_ENFORCEMENT_MODE;
 	const rawBudgets = raw.budgets ?? {};
 	if (typeof raw.budgets !== "undefined" && (raw.budgets === null || typeof raw.budgets !== "object")) throw new Error("EnforcementConfig budgets must be an object of caps");
 	const unknownBudget = Object.keys(rawBudgets).filter((k) => !BUDGET_KEYS.includes(k));
@@ -7763,10 +7909,16 @@ function resolveEnforcementConfig(config) {
 		budgets
 	};
 }
+/**
+* The runtime default: what a caller gets when it supplies no `enforcement` section at all
+* (a profile mounting this plugin with no config, e.g. `preset/recursive.patch.yml`). It is
+* `DEFAULT_ENFORCEMENT_MODE` per gate, so this object and the resolver cannot disagree —
+* see that const for WHY the default is strict.
+*/
 const DEFAULT_ENFORCEMENT = {
-	preStep: "advisory",
-	toolGuards: "advisory",
-	tamper: "advisory",
+	preStep: DEFAULT_ENFORCEMENT_MODE,
+	toolGuards: DEFAULT_ENFORCEMENT_MODE,
+	tamper: DEFAULT_ENFORCEMENT_MODE,
 	budgets: DEFAULT_BUDGETS
 };
 /**
@@ -7784,8 +7936,8 @@ const DEFAULT_ENFORCEMENT = {
 * `recursive:policy` later — can read the effective rules instead of inferring
 * them from a code path.
 */
-function resolveToolPolicyForGuard(worktreeRoot, runId) {
-	return withPhaseBaseline(loadToolPolicyFile(worktreeRoot).policy, currentPhaseArtifact(worktreeRoot, runId));
+function resolveToolPolicyForGuard(worktreeRoot, runId, activePhaseArtifact) {
+	return withPhaseBaseline(loadToolPolicyFile(worktreeRoot).policy, activePhaseArtifact ?? currentPhaseArtifact(worktreeRoot, runId));
 }
 /**
 * The artifact whose phase baseline applies: the HIGHEST-numbered phase artifact
@@ -7829,41 +7981,83 @@ function currentPhaseArtifact(worktreeRoot, runId) {
 	}
 	return inForce !== "" ? inForce : best;
 }
-function evaluateToolGuard(exec, worktreeRoot, activeRunId, mode = "advisory") {
+/**
+* `mode` is the gate's configured posture. Its parameter default FOLLOWS the config
+* default by REFERENCE (`DEFAULT_ENFORCEMENT.toolGuards`) rather than repeating the
+* literal: a bare call is "the caller had no mode to hand", and the answer to that must
+* be the same posture the config would have produced. Two literals are two defaults, and
+* a helper left on the old `advisory` literal while the config moved to `strict` is
+* exactly the twin-default hole this change closes — a caller that forgot the argument
+* would silently get the permissive branch, which no config could then undo. Every
+* production call site passes the mode explicitly (`index.ts` `runToolGuard`,
+* `runtime.ts` `guardTool`, the preview tool); this default serves bare callers, and a
+* bare caller must not be the one place enforcement quietly turns itself off.
+*/
+function evaluateToolGuard(exec, worktreeRoot, activeRunId, mode = DEFAULT_ENFORCEMENT.toolGuards) {
 	const name = exec.name;
 	const args = exec.arguments ?? {};
 	const runId = typeof activeRunId === "string" ? activeRunId.trim() : "";
 	const runDir = join(worktreeRoot, ".recursive", "run", runId);
 	const transition = consultTransitionGate(name, args, worktreeRoot, runId);
-	return advisory(verdictFor(mode, evaluateToolPolicy(resolveToolPolicyForGuard(worktreeRoot, runId), name, args, {
+	const activePhaseArtifact = currentPhaseArtifact(worktreeRoot, runId);
+	return advisory(verdictFor(mode, evaluateToolPolicy(resolveToolPolicyForGuard(worktreeRoot, runId, activePhaseArtifact), name, args, {
 		args,
 		runDir,
 		runId,
-		worktreeRoot
-	})), transition);
+		worktreeRoot,
+		activePhaseArtifact
+	}), String(args.artifact ?? "")), transition);
 }
 /**
 * Map the policy's verdict onto the guard's decision kind: `strict` denies,
 * `advisory` asks (the pre-T16 wording, unchanged), `allow` stays an allow. The
 * decision's `rule` is the label of the rule that decided it, so a policy
 * verdict is traceable to an auditable line in the policy file.
-*/
-function verdictFor(mode, decision) {
+*
+* ⚠ FU-7 — THE ORDERING REFUSAL CARRIES THE HUMAN'S CHOICE. `fix | reopen | abandon` is how a
+* person unblocks a lock, and before this the ask was attached ONLY by `recursive_lock`'s own
+* catch — the branch that runs when the guard ABSTAINS. Under the strict default the guard
+* refuses a lock ahead of its prerequisites BEFORE dispatch, so that branch never ran on the
+* default path and the caller got a bare sentence: the recovery options existed in the code and
+* were unreachable in the product, which is worse than the advisory posture they replaced (an
+* advisory `ask` at least surfaced the reason).
+*
+* THE TRIGGER IS THE BLOCKERS, NOT THE LABEL. `PolicyDecision.blockers` is present exactly when a
+* predicate read prerequisite blockers from disk and they were non-empty, so gating on it means
+* "this refusal was decided from an ordering violation" — including a policy FILE whose
+* `recursive_lock*` deny carries no label (the file-authored rule is given the same condition by
+* `attachPolicyPredicate`, and its `rule` would otherwise read `none`). Nothing is recomputed
+* here: the blockers arrive from the rule that already resolved them.
+*
+* IT IS ATTACHED TO THE REFUSAL ONLY. Under `advisory` the same verdict becomes an `ask` that the
+* live path coerces to an allow-with-warning, and the tool then refuses with its OWN payload when
+* `lockArtifact` throws — so an ask attached here would be a claim about a refusal that this layer
+* did not make. One refusal, one ask.
+*/
+function verdictFor(mode, decision, artifact) {
 	const rule = decision.rule ?? "none";
 	if (decision.kind === "allow") return {
 		kind: "allow",
 		rule
 	};
 	const reason = decision.reason ?? "tool policy denied this call";
-	return mode === "strict" ? {
-		kind: "deny",
+	if (mode !== "strict") return {
+		kind: "ask",
 		reason,
 		rule
-	} : {
-		kind: "ask",
+	};
+	const blocked = decision.blockers;
+	if (blocked === void 0 || blocked.length === 0) return {
+		kind: "deny",
 		reason,
 		rule
 	};
+	return {
+		kind: "deny",
+		reason,
+		rule,
+		ask: buildGateBlockAsk(artifact, reason)
+	};
 }
 /**
 * T15 — consult the transition gate (`validateTransition`) from the guard,
@@ -7915,7 +8109,7 @@ function advisory(decision, transition) {
 	return {
 		...decision,
 		rule: "transition",
-		warn: "transition gate (advisory) failed: " + transition.failures.join("; "),
+		warn: "transition gate (report-only) failed: " + transition.failures.join("; "),
 		transition
 	};
 }
@@ -7924,8 +8118,20 @@ function advisory(decision, transition) {
 * allow. Under `strict` it coerces to `deny`; under `advisory` it stays `allow`
 * but flags a `warn` so the caller never lets it through unlogged. Non-ask
 * decisions pass through unchanged.
-*/
-function coerceAskToDecision(decision, mode = "advisory") {
+*
+* ⚠ THE `mode` DEFAULT IS DELIBERATE, and it is NOT a neutral fallback — there is no
+* neutral branch here. The domain is two postures, one of which ALLOWS the call, so
+* "unspecified" has to be resolved rather than left open, and this codebase's rule for an
+* undecidable path is to fail CLOSED (`index.ts`: *"we could not decide" is not
+* permission*). It therefore FOLLOWS the config default by REFERENCE
+* (`DEFAULT_ENFORCEMENT.toolGuards`), for the same reason as `evaluateToolGuard`'s: an
+* `advisory` literal here would be a second, hidden copy of the old default inside the
+* very module this change moves, and a future caller that omitted the argument would
+* re-open the permissive path with no config able to close it. The production call site
+* (`index.ts` `runToolGuard`) always passes the configured mode, so this changes no live
+* behaviour — it removes the last place where "we were not told" meant "allow".
+*/
+function coerceAskToDecision(decision, mode = DEFAULT_ENFORCEMENT.toolGuards) {
 	if (decision.kind !== "ask") return decision;
 	if (mode === "strict") return {
 		kind: "deny",
@@ -8086,6 +8292,7 @@ function renderStableContract(config = DEFAULT_ENFORCEMENT) {
 		"- Gates in force: pre-step " + config.preStep + ", tool guards " + config.toolGuards + ", tamper detection " + config.tamper + ".",
 		"- A transition that fails its gates is BLOCKED (strict) or warns (advisory); no rejected transition proceeds silently.",
 		"- Writes to a Status: LOCKED phase doc are denied/asked; reopen explicitly to edit.",
+		"- Phase order binds WRITES as well as locks: only the ACTIVE phase (the lowest-numbered artifact not yet LOCKED) may be written; a write to a LATER phase artifact is denied/asked. Run support files (evidence/, scratch/, addenda/, subagents/, operations/) are not phases.",
 		"- Phase 3 lock requires TDD evidence (strict) or rationale (pragmatic); Phase 5 requires QA evidence.",
 		"- The control-plane root is resolved STRICTLY from this session workspace (never scanned from another)."
 	].join("\n");
@@ -11422,7 +11629,7 @@ var RecursiveRuntime = class extends Service {
 	coupleGateBlockToGoal(goalService, agent, ref, reason) {
 		return coupleGateBlockToGoal(goalService, agent, ref, reason);
 	}
-	/** Phase C R7: resolve the enforcement config (strict|advisory, default advisory). */
+	/** Phase C R7: resolve the enforcement config (strict|advisory, default strict). */
 	get enforcementConfig() {
 		return this._enforcementConfig ?? DEFAULT_ENFORCEMENT;
 	}
@@ -11838,12 +12045,7 @@ function createRecursiveLockTool(recursive) {
 				const refusal = codeRuntimeRefusal(message);
 				if (message.startsWith("Prerequisite blockers:")) return {
 					error: refusal,
-					ask: {
-						gate: "gate-block",
-						...buildAskQuestion("gate-block"),
-						artifact: args.artifact ?? "",
-						blocked: message
-					}
+					ask: buildGateBlockAsk(args.artifact ?? "", message)
 				};
 				return { error: refusal };
 			}
@@ -14460,10 +14662,17 @@ const enforcementMode = z.union([z.const("strict"), z.const("advisory")]);
 const Config = z.object({
 	shellOnly: z.boolean().default(false).description("Client-shell only: registers nothing on the server (no tools, no command, no projection)."),
 	repoRoot: z.string().description("Control-plane root. Defaults to the process working directory when unset."),
+	/**
+	* ⚠ THE THREE MODE DEFAULTS READ `DEFAULT_ENFORCEMENT_MODE` FROM `enforcement.ts`, and
+	* that is deliberate: the schema default and the runtime default are the SAME value, and
+	* two literals here would be two defaults. A caller that omits the section gets
+	* `DEFAULT_ENFORCEMENT` from the runtime; a caller that supplies a partial section gets
+	* the resolver's fill. Both must be the enforcing posture — see the const for why.
+	*/
 	enforcement: z.object({
-		preStep: enforcementMode.default("advisory").description("Phase pre-step enforcement: strict refuses an out-of-order transition, advisory warns and proceeds."),
-		toolGuards: enforcementMode.default("advisory").description("Tool guard mode: strict DENIES an out-of-order tool call, advisory allows it and carries the warning."),
-		tamper: enforcementMode.default("advisory").description("Tamper detection: strict refuses an artifact whose LockHash no longer matches its body."),
+		preStep: enforcementMode.default(DEFAULT_ENFORCEMENT_MODE).description("Phase pre-step enforcement: strict refuses an out-of-order transition, advisory warns and proceeds."),
+		toolGuards: enforcementMode.default(DEFAULT_ENFORCEMENT_MODE).description("Tool guard mode: strict DENIES an out-of-order tool call, advisory allows it and carries the warning."),
+		tamper: enforcementMode.default(DEFAULT_ENFORCEMENT_MODE).description("Tamper detection: strict refuses an artifact whose LockHash no longer matches its body."),
 		budgets: z.object({
 			maxAuditRounds: z.natural().default(DEFAULT_BUDGETS.maxAuditRounds).description("Rounds one phase audit loop may run, even while every round makes progress."),
 			maxRepairAttempts: z.natural().default(DEFAULT_BUDGETS.maxRepairAttempts).description("How many times a phase may be sent back for repair before the loop stops."),
@@ -14543,6 +14752,7 @@ function runToolGuard(recursive, exec, root, runId) {
 			if (final.warn) record.reason = final.warn;
 		} else if (final.reason) record.reason = final.reason;
 		if (final.transition) record.transition = final.transition;
+		if (final.kind === "deny" && final.ask) record.ask = final.ask;
 		appendGuardDecision(root, record);
 	}
 	return final;
@@ -14697,8 +14907,11 @@ function apply(ctx, config) {
 				kind: "deny",
 				reason: "the tool guard produced no decision"
 			};
-			if (final.kind === "deny") return final;
-			if (final.kind === "allow" && final.warn) console.warn("[recursive] tool guard (advisory): " + final.warn + " — allowing");
+			if (final.kind === "deny") return final.ask === void 0 ? final : {
+				...final,
+				reason: final.reason + " " + renderGateBlockAsk(final.ask)
+			};
+			if (final.kind === "allow" && final.warn) console.warn("[recursive] tool guard (" + recursive.enforcementConfig.toolGuards + ") allowed this call: " + final.warn);
 			return typeof next === "function" ? next() : { kind: "allow" };
 		}));
 		const observationRuntime = ctx;
@@ -14815,4 +15028,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { Config, DEFAULT_BUDGETS, DEFAULT_ENFORCEMENT, OPTIONAL_PHASES, PHASES, PHASE_POSITIONS, PHASE_SEQUENCE, RECURSIVE_API_PREFIX, RUN_ARTIFACT_SEQUENCE, RUN_STATES, RecursiveRuntime, actionRecordStatus, apply, auditToPass, buildDelegationPrompt, buildReviewBundle, buildWorkSlice, builtInToolPolicy, capabilityProbe, childScratchPath, coerceAskToDecision, contentSha256, contractDigest, coupleGateBlockToGoal, createChildBrief, createHandoff, createRecursiveCloseoutTool, createRecursiveInitTool, createRecursiveLintTool, createRecursiveLockTool, createRecursivePhaseTool, createRecursiveScratchTool, createRecursiveStatusTool, createRecursiveWorktreeTool, currentPhaseArtifact, defaultReviewToolFilter, delegate, delegateContinuable, delegationDecisionBasis, delegationError, detectTamper, discoverRuns, drainContinuableChildren, drainContinuableDescendants, escapeRegExp, evaluateDelegationResult, evaluateToolGuard, foldDiagnostics, foldRun, foldRunCard, getAllStaleReceipts, getArtifactState, getGateStatus, getLatestRunDirectory, getLockStatus, getMdFieldValue, getNextLegalPhase, getPrerequisiteBlockers, getPrerequisites, getStaleDownstreamPhases, getTodoStats, getWorkflowProfile, inject, interruptContinuable, invalidateReceipt, isCoreArtifact, isTaskClaimedBy, loadRouterPolicy, lockHashFromContent, makeRecursiveRoutes, mountRecursiveRoutesOnce, name, normalizeForLockHash, parseReplyVerdict, pendingWork, phaseIndex, phasePosition, probeCapabilities, readReceipt, readRepairFromReply, readRepairFromStructured, readVerdictFromReply, readVerdictFromStructured, receiptPath, referencesFromResult, registerRecursiveSkill, remainingDepthFor, renderPhaseTail, renderRecursivePolicy, renderStableContract, renderTaskHistory, replyPath, resetFoldCache, resolveEnforcementConfig, resolveRole, resolveRunDir, resolveToolPolicyForGuard, reviewBundleDir, reviewOutputSchema, routerPolicyPath, snapshotWorkspace, tamperCandidatePath, trimMdValue, validateChain, validateReferences, validateTransition, writeActionRecord, writeReceipt };
+export { Config, DEFAULT_BUDGETS, DEFAULT_ENFORCEMENT, DEFAULT_ENFORCEMENT_MODE, OPTIONAL_PHASES, PHASES, PHASE_POSITIONS, PHASE_SEQUENCE, RECURSIVE_API_PREFIX, RUN_ARTIFACT_SEQUENCE, RUN_STATES, RecursiveRuntime, actionRecordStatus, apply, auditToPass, buildDelegationPrompt, buildReviewBundle, buildWorkSlice, builtInToolPolicy, capabilityProbe, childScratchPath, coerceAskToDecision, contentSha256, contractDigest, coupleGateBlockToGoal, createChildBrief, createHandoff, createRecursiveCloseoutTool, createRecursiveInitTool, createRecursiveLintTool, createRecursiveLockTool, createRecursivePhaseTool, createRecursiveScratchTool, createRecursiveStatusTool, createRecursiveWorktreeTool, currentPhaseArtifact, defaultReviewToolFilter, delegate, delegateContinuable, delegationDecisionBasis, delegationError, detectTamper, discoverRuns, drainContinuableChildren, drainContinuableDescendants, escapeRegExp, evaluateDelegationResult, evaluateToolGuard, foldDiagnostics, foldRun, foldRunCard, getAllStaleReceipts, getArtifactState, getGateStatus, getLatestRunDirectory, getLockStatus, getMdFieldValue, getNextLegalPhase, getPrerequisiteBlockers, getPrerequisites, getStaleDownstreamPhases, getTodoStats, getWorkflowProfile, inject, interruptContinuable, invalidateReceipt, isCoreArtifact, isTaskClaimedBy, loadRouterPolicy, lockHashFromContent, makeRecursiveRoutes, mountRecursiveRoutesOnce, name, normalizeForLockHash, parseReplyVerdict, pendingWork, phaseIndex, phasePosition, probeCapabilities, readReceipt, readRepairFromReply, readRepairFromStructured, readVerdictFromReply, readVerdictFromStructured, receiptPath, referencesFromResult, registerRecursiveSkill, remainingDepthFor, renderPhaseTail, renderRecursivePolicy, renderStableContract, renderTaskHistory, replyPath, resetFoldCache, resolveEnforcementConfig, resolveRole, resolveRunDir, resolveToolPolicyForGuard, reviewBundleDir, reviewOutputSchema, routerPolicyPath, snapshotWorkspace, tamperCandidatePath, trimMdValue, validateChain, validateReferences, validateTransition, writeActionRecord, writeReceipt };