Inherited sandbox and approval events were part of the constructor seed. Session.firstLiveSeq classifies every constructor event as replayed history, so telemetry adoption skipped these child-only creation facts even though no parent or prior process had exported them.
Capture the parent overrides at the same synchronous delegation boundary, but append the events during the child factory setup while the session is still unpublished. They remain ordered after fork history, persist with the first child batch, and retain last-event-wins behavior while landing on the live side of the telemetry boundary. This uses the existing setup and session append contracts instead of adding another seed category or telemetry special case.
Add regression coverage for exporting an unpublished suffix without re-exporting constructor history, assert the spawn and fork firstLiveSeq boundaries, and restore the public seed documentation to replay/fork history only.
The implementation no longer stores inherited policy in SessionHeader or resolves a second baseline chain, but the feature, sandbox, and approval notes still described that machinery. Keeping those claims would make the smaller design look incomplete and invite reintroduction of the generic persistence surface.
Rewrite the owning feature note around the actual delegation snapshot: source-tagged policy events follow the optional fork prefix, ordinary last-event-wins folds establish precedence, and persistence captures the constructor seed with the first materialized batch. Condense the alternatives and consequences to the decisions and coverage that remain load-bearing.
Align the sandbox and approval notes plus the subagent-inprocess consumer README with that contract. Update the four Chinese counterparts minimally and re-record each pairing hash so both languages describe the same shipped mechanism.
Review fix (ds-review-bot on #623): the ACP scenario runs at deployment
strength (the automation protocol has no session-scoped switch), so the
assembled-app path could not detect the delegation bypass itself. The new
keyless subagent-inheritance headless scenario closes that on the
semantic-checkpoint precedent: a seeded parent log carrying a real
sandbox/mode: read-only switch under a workspace-write deployment default
is resumed through the Loader-booted cli-demo app via a resume fixture
plugin and delegates through the real subagent tool; the child's real
write is denied by the real dsh-fs-sandbox fence (physical ENOENT
assertion), its persisted header carries the inherited baseline, and both
logs pin as expected outputs. Verified red: disabling the driver's capture
makes the scenario fail on the disk assertion (the child writes under the
deployment default).
Review fix (ds-review-bot on #623): the unconditional slice regressed the
public SessionStore.fork path — a generic fork child gets seedLength but no
policy baseline, so slicing discarded its seed-carried sandbox/approval
switches and silently widened it to the deployment defaults (a forked
read-only/never parent produced a workspace-write/ask child).
overrideOf now branches on baseline presence: with a header baseline (a
delegation child) the fold covers only own post-seed switches — the
baseline captured from the parent's FULL log subsumes seed history; without
one, the whole log — seeded switches ARE the replayed inherited truth. The
permission preset fold scopes the same way. Red-first: generic-fork
seed-carried override tests in both policy suites.
The snapshot-coverage consequence names the deployment-strength limit, why
the automation protocol cannot express a parent-only override, and the
headless semantic-checkpoint precedent (seeded parent log + resume fixture
plugin) as the pickup shape — so the deferred scenario is not re-derived.
Review fixes (ds-review-bot warnings on #623):
- One chain, every consumer: the override resolution (own post-seed
switches ?? header baseline, closed-vocabulary validated) moves into pure
exports (sandboxOverrideOf / approvalOverrideOf); the services delegate,
and the permission presets consume them — current(session) and set()
now see inherited baselines, so a child inheriting danger-full-access
gets REAL knob switches when workspace-write is selected instead of a
silent no-op, and a seed-carried preset selection is subsumed by the
baseline. current(events) becomes current(session) (pre-release; the
only callers were tests).
- Unconditional durable validation: a malformed header baseline fails
loud on every read, no longer shadowed by an own switch.
- The two policy peers are declared optional (peerDependenciesMeta), so a
thin spawn/fork deployment without policy plugins can consume the
driver; verify-runtime-closure honors the flag.
Red-first: inherited-preset derive/switch-away and seeded-selection tests
in the permission suite; malformed-baseline-with-own-switch tests in both
policy suites.
Review fix (ds-review-bot critical #2 on #623): the first-turn event stamp
had a durability hole no turn anchoring can close — an idle SessionStart-
style injection persists a complete one-shot turn before any prompt turn
opens, so a crash in that window left a resumable-looking child with no
inherited policy, falling back to a possibly wider deployment default.
The captured overrides now ride the child's creation meta into its
immutable SessionHeader (sandboxMode/approvalPolicy, neutral strings at the
session boundary — the delegationDepth precedent), durable from the moment
the session exists: no listener ordering can starve the baseline and no
crash window can lose it. overrideOf(session) on both policy services
resolves fold(events past header.seedLength) ?? header baseline, validating
against the closed vocabulary on read; stampOverride and the prompt-submit
listener machinery are deleted. The header field rides both persistence
backends (JSONL header line; SQLite sessions columns, SCHEMA_VERSION 11 —
pre-release, no migration). pty-local reads through overrideOf so PTY
spawns see the baseline too.
Red-first: header-durability-before-any-turn test (the injection crash
window shape), baseline/seed-boundary/closed-vocabulary contract tests in
both service suites; the real-wall suite (race, veto, fork stale-seed,
grandchild) re-anchored on header assertions and green. The Agent Note's
Alternatives now records the superseded event-stamping iteration with the
review evidence; bilingual docs updated.
The automation-only ACP refactor (#586) removed the bridge's pendingSwitches
idle-preset anchoring the inheritance note cited as precedent. Replace the
dangling analogy with the load-bearing fact a reviewer actually needs: an
injection-triggered first turn (a SessionStart hook racing the prompt)
dispatches no prompt-submit and no model request, so the one-shot stamp
listener still lands before the child's first model request.
Review fixes (ds-review-bot on #623):
- Capture-at-delegation: the driver now reads overrideOf(parent.session)
for both knobs synchronously before its first await, and the prompt-submit
listener stamps those captured values — a parent switch racing the child's
asynchronous creation belongs to the parent's future, not the child. The
inheritOverride(parent, child) service method is split into its two halves
(overrideOf / stampOverride) accordingly.
- Veto safety: the one-shot prompt-submit listener registers with
prepend: true, so a veto-capable listener (a denying UserPromptSubmit
hook) cannot close the child's first turn without the durable stamp.
Both regressions are pinned red-first in inheritance.spec.ts: the
delegation-vs-late-switch race (delegate tool flips the caller wider while
the creation transaction is pending) and a blocking prompt-submit listener
(stamp survives a promptless first turn). Service contract tests renamed to
the split API; READMEs and the bilingual Agent Note updated.
Per-session policy overrides (sandbox/mode, approval/policy) never crossed
the delegation boundary: a spawn child of a read-only-switched parent ran
under the wider deployment default, and a fork child missed any switch made
after its seed boundary — delegation was a bypass channel for a user's
tightening.
The in-process driver now snapshots the delegating parent's override chain
and stamps it onto the child through the canonical write paths
(SandboxPolicyService.inheritOverride / ApprovalService.inheritOverride),
anchored inside the child's first turn via a one-shot agent/prompt-submit
listener: turn-enclosed (durable), ahead of the first request (an inherited
'never' reaches the child's first system prompt), and positioned after any
stale fork-seed switch so the ordinary last-event-wins fold resolves it.
Only overrides are copied — an unswitched parent stamps nothing and the
child follows the live deployment default; both services are consumed
opportunistically, so compositions without them delegate unchanged. Nesting
composes by construction (each stamp folds the already-stamped parent log).
Evidence: inheritance.spec.ts drives scripted-model children into the real
dsh-fs-sandbox fence through the real write tool (disk-state + denial-marker
assertions; spawn, stale-seed fork, grandchild, escalation fail-closed, and
no-stamp guards), inheritOverride contract tests in both service suites, and
the recorded subagent-sandbox-inheritance ACP snapshot (read-only preset →
delegate → child denied, replayed keylessly).
See .agents/notes/implemented/feature/2026-07-25-subagent-policy-inheritance.md.
Tianyi Cui