@sema-agent/server 3.2.0 → 3.2.1

package/dist/approval-hmac.js

@@ -10,12 +10,12 @@
  * FULL activation chain (an independent 2026-07-25 cross-check caught the first draft of this note naming only the
  * leaf conditions — record it completely so a deployment engineer isn't surprised): the crypto branch lives ONLY
  * under the durable-checkpoint /decide path, whose route block is gated on `deps.checkpointStore`
- * (`http/server.ts:4517`), which needs `backend?.checkpoint && config.durableApproval` (`main.ts:1902`). That is NOT
+ * (A9 拆分后行级坐标弃用:grep `deps.checkpointStore` in `http/server.ts` resumeCheckpoint 链), which needs `backend?.checkpoint && config.durableApproval` (A10 后住 `src/boot/stores.ts`/装配表:grep `durableApproval` in main.ts+boot/). That is NOT
  * an extra thing to remember, because `directDoorActive` ALREADY requires `DURABLE_APPROVAL=true` by construction
- * (`config.ts:1264` — and see the 🔴 note above it: without it, checkpointStore is undefined, this branch is
+ * (config.ts approval 域,grep `directDoorActive` — and see the 🔴 note above it: without it, checkpointStore is undefined, this branch is
  * skipped, and the LEGACY trusted-header /decide becomes live = a full crypto bypass). So `directDoorActive` really
  * is the single load-bearing switch — it just transitively implies the durable store, rather than being independent
- * of it. A half-configured door refuses to boot (`config.ts:1266`+), so "looks on, verifies nothing" is impossible.
+ * of it. A half-configured door refuses to boot (config.ts 同域 boot 不变量,grep `half-configured`/`门 D-G`), so "looks on, verifies nothing" is impossible.
  * This is the crypto FOUNDATION for D-G (the direct-connect approval door): it proves the decision envelope
  * `{checkpointToken, boundCallId, boundInputHash, decision}` was not tampered in transit. It is INTEGRITY, NOT
  * identity — `isOperator(principal)` stays the identity gate (a valid MAC says "the bytes are intact", never

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",