@sema-agent/server 4.3.0 → 5.0.0

package/USAGE.md

@@ -97,7 +97,9 @@ MAX_PRINCIPAL_COST_USD=5.00   COST_QUOTA_WINDOW_SEC=86400   # 0/不设 = 不限;
 MODEL_DEGRADE_TO=deepseek-v4-flash
 MODEL_DEGRADE_AT_COST_FRACTION=0.7    # ① 近预算(1.40):累计成本到 0.7×maxCostUsd 切(需任务有 cost ceiling)
 MODEL_DEGRADE_REACTIVE=true           # ② 反应式(1.39):主模型 rate_limit/breaker-open 时切(brain 级,最外层)
-MODEL_DEGRADE_ON=rate_limit,breaker_open   # 可选,反应式触发器子集;默认两者都开
+MODEL_DEGRADE_ON=rate_limit,breaker_open   # 可选,反应式触发器子集;词表=breaker_open|rate_limit|budget|server_error|last_resort
+# ⚠️ core 5.1.0 起,不设 MODEL_DEGRADE_ON 时引擎默认**含 server_error**(主模型 5xx 也切便宜模型)。
+#    不想要 5xx 触发就显式设回 rate_limit,breaker_open。拼错词 boot 拒启(不静默忽略)。
 ```
 - 反应式降级 brain 包在**最外层**(core council #8);fallback brain 用自己的凭据(decorator 清掉主模型的 per-call key 防泄漏给别的 provider)。**坑**:`MODEL_DEGRADE_TO` 最好别和被限流的是同一网关/账号,否则反应式切过去照样撞同一个 rate_limit。
 - **定价怎么设**:`model.cost` 来自 `MODEL_COST_INPUT/OUTPUT/CACHE_READ/CACHE_WRITE`(**USD per 1M tokens**,默认 0 = `costUsd` 读 0)。云模型(如 review-gw 的 deepseek-v4-pro)必须设,否则 spend 恒为 $0;本地自托管(qwen)留 0 即对(无 per-token 外部花费)。字段名是 `costUsd`,**非美元计价的网关要先折算**(如 DeepSeek 官方 CNY ÷ 汇率)。配置控制面管的模型走 `CenterModel.cost`(中心存价、不存 secret)。
@@ -373,8 +375,8 @@ curl -N http://<host>:8090/v1/tasks/stream -H 'content-type: application/json' \
 | 端点 | 用途 |
 |---|---|
 | `GET /v1/sessions/<id>` | 审计回溯:当前上下文 + 摘要(owner 校验) |
-| `GET /v1/approvals?owner=user:42` | 高危写审批:**operator** 看待办队列(可按 owner 过滤);非 operator 只看自己的 |
-| `POST /v1/approvals/<id>` `{"decision":"approve"|"deny","reason":"…"}` | 批/否(CAS,重复决议 409);**仅 operator**(非 operator → 403) |
+| `GET /v1/approvals?owner=user:42` | 高危写审批(durable,需 `DURABLE_APPROVAL=true`):**operator** 看待办队列(可按 owner 过滤);非 operator 只看自己的 |
+| `POST /v1/approvals/<sessionId>/decide` `{"decision":"approve"|"deny","reason":"…"}` | 批/否并恢复挂起任务(CAS,重复决议 409);**仅 operator**(非 operator → 403)。5.0.0 起旧轮询腿 `POST /v1/approvals/<id>` 已退役 |
 | `GET /health` | 健康(无需鉴权) |
 | `GET /metrics` | Prometheus 指标(有 token 时需带) |
 

package/dist/approval-hmac.js

@@ -1,6 +1,6 @@
 /**
  * design/80 D-G: approval-envelope HMAC (INTEGRITY, not identity). Split out of `security.ts` (design/158
- * A13, internal-lossless — the facade re-exports every symbol below unchanged; verifyDirectDoorProof in
+ * A13; consumers import from HERE — [2354] cleared the security.ts compat re-exports; verifyDirectDoorProof in
  * ./principal-jwt.ts imports {@link verifyApprovalHmac} from here for the combined proof).
  *
  * ✅ WIRED into the resolve path (was "🔴 SCAFFOLD — NOT YET WIRED" — that claim went STALE; a 2026-07-25 doc-rot

package/dist/approval.d.ts

@@ -1,14 +1,9 @@
 /**
- * OA human-in-the-loop approval gate (F4) — a `ToolPolicy` that holds a gated tool call until an
- * operator approves/denies, with the pending state in TiDB so the decision can arrive on any instance.
- *
- * Built on core's `createApprovalPolicy` (which routes requireApproval/deny and races the wait against
- * the task's AbortSignal). Our `approve` records a pending row and polls it for a decision; it also
- * honors the signal directly (marks the request expired and releases) so a never-answered approval is
- * dropped at the task deadline instead of holding the worker — design/06 F4 self-protection.
+ * Human-in-the-loop approval gate (F4) — durable-only since 5.0.0 ([2354]/[2356] A-5:OA 轮询车道
+ * (createOaApprovalPolicy + ApprovalStore pending 行轮询)整体退役;唯一门形 = durable checkpoint
+ * suspend/resume,见 createDurableAskPolicy 与 /v1/approvals 的 checkpointStore 腿)。
  */
 import { type ToolPolicy } from "@sema-agent/core";
-import type { ApprovalStore } from "./plugins/store-backend.js";
 /**
  * 运维**是否表达了门意图** —— boot 的单用户 allow-all 基线只在"零门意图"时才允许铺开,
  * 所以这个谓词漏一格 = 那一格的意图被 allow-all 静默吞掉。
@@ -33,7 +28,8 @@ export declare function hasOperatorGateIntent(config: {
  * Durable approval policy (core 1.67 / design/45): returns three-state **`ask`** for gated tools instead of
  * polling. With `TaskSpec.durableApproval` set + a `checkpointStore` on the Runner, core turns that `ask` into
  * a **suspend** (persists a checkpoint, ends `status:"suspended"`) — no held connection, resumable on any
- * replica. (Contrast {@link createOaApprovalPolicy}, which holds the call open by polling a TiDB row.)
+ * replica. (The former poll-lane
+ * twin, createOaApprovalPolicy, was retired in 5.0.0 — durable is the only gate.)
  */
 export interface DurableAskOptions {
     requireApproval: string[];
@@ -48,32 +44,4 @@ export interface DurableAskOptions {
     onExempted?: (canonicalToolName: string, rawToolName: string) => void;
 }
 export declare function createDurableAskPolicy(opts: DurableAskOptions): ToolPolicy;
-export interface OaApprovalOptions {
-    store: ApprovalStore;
-    /** Tool names that require an operator decision before they run. */
-    requireApproval: string[];
-    /** Safety tools that must ALWAYS reach a human — checked BEFORE the exemption probe (workflow audit
-     *  2026-07-13: the OA leg consumed exemptions without the neverAuto guard, so a grant made in durable mode
-     *  could silently auto-approve a NEVER_AUTO tool after an ops switch back to the poll gate). */
-    neverAuto?: string[];
-    /** Session exemption probe — same contract as createDurableAskPolicy.exempt (fail-closed). */
-    exempt?: (sessionId: string, canonicalToolName: string) => Promise<boolean>;
-    /** Audit hook for an exemption short-circuit. */
-    onExempted?: (sessionId: string, canonicalToolName: string) => void;
-    /** Per-run context captured for the approval row (operator UI shows session/tool/args). */
-    context: () => {
-        taskId?: string | null;
-        sessionId?: string | null;
-        owner?: string | null;
-    };
-    /** Always-denied tools. */
-    deny?: string[];
-    /** Poll interval for the decision. Default 1500ms. */
-    pollMs?: number;
-}
-export declare function createOaApprovalPolicy(opts: OaApprovalOptions): ToolPolicy;
-/** Poll the approval row until decided, or release (deny) when the task aborts. Exported for unit tests.
- *  `scope` is the run's tenant identity (owner-sourced) — carried on every read/decide so a run only ever
- *  observes/aborts its OWN pending row (single-DB fleet read guard; defense-in-depth). */
-export declare function waitForDecision(store: ApprovalStore, id: string, scope: string | null, signal: AbortSignal | undefined, pollMs: number): Promise<boolean>;
 //# sourceMappingURL=approval.d.ts.map

package/dist/approval.js

@@ -1,15 +1,9 @@
 /**
- * OA human-in-the-loop approval gate (F4) — a `ToolPolicy` that holds a gated tool call until an
- * operator approves/denies, with the pending state in TiDB so the decision can arrive on any instance.
- *
- * Built on core's `createApprovalPolicy` (which routes requireApproval/deny and races the wait against
- * the task's AbortSignal). Our `approve` records a pending row and polls it for a decision; it also
- * honors the signal directly (marks the request expired and releases) so a never-answered approval is
- * dropped at the task deadline instead of holding the worker — design/06 F4 self-protection.
+ * Human-in-the-loop approval gate (F4) — durable-only since 5.0.0 ([2354]/[2356] A-5:OA 轮询车道
+ * (createOaApprovalPolicy + ApprovalStore pending 行轮询)整体退役;唯一门形 = durable checkpoint
+ * suspend/resume,见 createDurableAskPolicy 与 /v1/approvals 的 checkpointStore 腿)。
  */
-import { createApprovalPolicy, canonicalToolName, uuidv7 } from "@sema-agent/core";
-import { createLogger } from "./observability/logger.js";
-const logger = createLogger();
+import {} from "@sema-agent/core";
 /**
  * 运维**是否表达了门意图** —— boot 的单用户 allow-all 基线只在"零门意图"时才允许铺开,
  * 所以这个谓词漏一格 = 那一格的意图被 allow-all 静默吞掉。
@@ -31,14 +25,13 @@ export function hasOperatorGateIntent(config) {
         config.durableApproval);
 }
 export function createDurableAskPolicy(opts) {
-    // 🔒 CANONICAL-space matching (mirrors core 1.202 `createAllowDenyPolicy` + the design/116 S8 discipline):
-    // configured names AND the live request name both normalize via `canonicalToolName`, so an operator rule written
-    // against a legacy alias ("Task"/"KillShell"/"MultiEdit") keeps gating after a core CC-parity rename, and a
-    // durable-resume replay carrying a pre-rename `req.toolName` can't slip a rule written in the new names. A raw
-    // compare here is the same silent fail-open class the 1.202 rename exposed in main.ts's read-only strip.
-    const require = new Set(opts.requireApproval.map(canonicalToolName));
-    const deny = new Set((opts.deny ?? []).map(canonicalToolName));
-    const neverAuto = new Set((opts.neverAuto ?? []).map(canonicalToolName));
+    // 🔒 RAW-name matching(core 5.0.0 RB-476:canonicalToolName 折叠面整体退役)。安全前提没有变松,
+    // 只是换了执行者:live 请求名恒为 CC canonical(旧名在 core roster 层响亮 miss,永远到不了本 policy);
+    // 配置侧写了退役名 = core prepare 硬失败 `config.legacy_tool_name`(+ 本仓 config 装配墓碑先一步拒启)。
+    // 旧的双侧归一防的「旧名滑过新名规则」在 5.0.0 下无成立路径——折叠臂留着才是静默兼容层。
+    const require = new Set(opts.requireApproval);
+    const deny = new Set(opts.deny ?? []);
+    const neverAuto = new Set(opts.neverAuto ?? []);
     const budget = Math.max(0, Math.floor(opts.autoBudget ?? 0));
     // design/80 D-E (upgrade-budget): a per-run-leg counter of NORMAL gated calls auto-approved so far. The policy
     // is rebuilt per resolveSpec call (= per submit AND per resume — server.ts), so this closure is per-leg —
@@ -47,7 +40,7 @@ export function createDurableAskPolicy(opts) {
     let autoApproved = 0;
     return {
         check: (req) => {
-            const toolName = canonicalToolName(req.toolName); // canonical-space lookup; messages keep the raw name for the operator
+            const toolName = req.toolName; // RAW(5.0.0):live 名恒 canonical,折叠面已随 core RB-476 退役
             if (deny.has(toolName))
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             // inv#2: a never-auto (irreversible / safety) tool ALWAYS asks a human — UNCONDITIONALLY, even if it was not
@@ -120,97 +113,4 @@ export function createDurableAskPolicy(opts) {
         return { action: "ask", message: `approval required to run "${req.toolName}"` };
     }
 }
-export function createOaApprovalPolicy(opts) {
-    const pollMs = opts.pollMs ?? 1500;
-    const neverAuto = new Set((opts.neverAuto ?? []).map(canonicalToolName));
-    return createApprovalPolicy({
-        requireApproval: opts.requireApproval,
-        deny: opts.deny,
-        approve: async (req, signal) => {
-            const ctx = opts.context();
-            // Session exemption — core already routed deny (deny wins before approve is ever called);
-            // a remembered (sessionId, toolName) auto-approves without a pending row. Fail-closed on a store error.
-            // neverAuto ALWAYS wins the exemption (same ordering lock as the durable policy — the OA leg previously
-            // lacked this guard, workflow audit 2026-07-13).
-            if (opts.exempt && ctx.sessionId) {
-                const toolName = canonicalToolName(req.toolName);
-                if (toolName !== "AskUserQuestion" && !neverAuto.has(toolName)) {
-                    let exempted = false;
-                    try {
-                        exempted = (await opts.exempt(ctx.sessionId, toolName)) === true; // strict boolean, same as the durable twin
-                    }
-                    catch {
-                        exempted = false;
-                    }
-                    if (exempted) {
-                        opts.onExempted?.(ctx.sessionId, toolName);
-                        return true;
-                    }
-                }
-            }
-            const id = uuidv7();
-            // scope = the run's tenant identity, owner-sourced (single-DB fleet read guard; defense-in-depth). The
-            // poll/abort paths below carry the SAME scope so this run only ever reads/aborts its own pending row.
-            const scope = ctx.owner ?? null;
-            await opts.store.createPending(id, scope, { ...ctx, toolName: req.toolName, args: req.args });
-            return waitForDecision(opts.store, id, scope, signal, pollMs);
-        },
-    });
-}
-/** Consecutive poll errors tolerated before giving up (a persistent outage still fail-closes to deny). */
-const MAX_POLL_ERRORS = 5;
-/** Poll the approval row until decided, or release (deny) when the task aborts. Exported for unit tests.
- *  `scope` is the run's tenant identity (owner-sourced) — carried on every read/decide so a run only ever
- *  observes/aborts its OWN pending row (single-DB fleet read guard; defense-in-depth). */
-export async function waitForDecision(store, id, scope, signal, pollMs) {
-    let consecutiveErrors = 0;
-    for (;;) {
-        if (signal?.aborted) {
-            // C1(failloud):最小对症=失败留痕,不必重试——这是最后一次尝试把行标 expired,任务本身已经在
-            // abort 路径上收尾,重试没有下一个时机。裸吞会让一次真实的店写故障(TiDB blip)在观测面上
-            // 与"成功标了 expired"毫无区别;补 error 留痕,行为(deny)不变。
-            await store.decide(id, scope, "expired", "task aborted before decision", null).catch((e) => {
-                logger.error("approval_expire_write_failed", { id, scope, err: e instanceof Error ? e.message : String(e) });
-            });
-            return false;
-        }
-        let s;
-        try {
-            s = await store.getStatus(id, scope);
-            consecutiveErrors = 0;
-        }
-        catch (e) {
-            // A single transient TiDB blip must NOT throw out of the poll loop — core fail-closes a thrown
-            // approval policy to DENY, so one hiccup would deny an already-approved high-risk call after the
-            // operator clicked approve. Tolerate a few consecutive errors (keep polling); only give up (re-throw →
-            // deny) on a persistent outage.
-            if (++consecutiveErrors >= MAX_POLL_ERRORS)
-                throw e;
-            await sleepAbortable(pollMs, signal);
-            continue;
-        }
-        if (s?.status === "approved")
-            return true;
-        if (s?.status === "denied" || s?.status === "expired")
-            return false;
-        await sleepAbortable(pollMs, signal);
-    }
-}
-function sleepAbortable(ms, signal) {
-    return new Promise((resolve) => {
-        if (signal?.aborted) {
-            resolve();
-            return;
-        }
-        const onAbort = () => {
-            clearTimeout(timer);
-            resolve();
-        };
-        const timer = setTimeout(() => {
-            signal?.removeEventListener("abort", onAbort);
-            resolve();
-        }, ms);
-        signal?.addEventListener("abort", onAbort, { once: true });
-    });
-}
 //# sourceMappingURL=approval.js.map

package/dist/auth-bridge.d.ts

@@ -2,7 +2,6 @@ import { type AuthBridgeErrorCode, type VerifiedIdentity } from "@sema-agent/reg
 import type { Logger } from "./observability/logger.js";
 import type { Metrics } from "./observability/metrics.js";
 export type { VerifiedIdentity } from "@sema-agent/registry-core/api/auth-bridge";
-export { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
 export interface RegistryJwtVerifierOptions {
     /** R4 — 期望 iss(registry 的 SSO_ISSUER;默认=SEMA_REGISTRY_URL,双侧去尾斜杠比较)。 */
     issuer: string;

package/dist/auth-bridge.js

@@ -11,7 +11,6 @@
  */
 import { createPublicKey, verify as cryptoVerify } from "node:crypto";
 import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, REGISTRY_JWKS_PATH, RegistryJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, } from "@sema-agent/registry-core/api/auth-bridge";
-export { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
 const DEFAULT_JWKS_TTL_SEC = 15 * 60;
 /** JWKS 响应体字节上限(一个配错或超大响应的端点不应让 worker 无界缓冲;正常 JWKS 千字节级)。 */
 const MAX_JWKS_BYTES = 256 * 1024;

package/dist/auth-keys.d.ts

@@ -5,7 +5,7 @@
  * IDENTITY). config.ts consumes ONLY these two functions + their row types at env-load time, and importing them from
  * security.ts made the base config layer value-depend on the whole 55KiB auth module (lens2 §F). This file is a pure
  * leaf (JSON.parse + shape filters, zero repo imports); the VERIFIERS that consume the parsed key-sets
- * (verifyApprovalHmac / verifyPrincipalJwt) stay in security.ts, which re-exports these four names for compat.
+ * (verifyApprovalHmac / verifyPrincipalJwt) stay in ./approval-hmac.ts and ./principal-jwt.ts; consumers import these four names from HERE ([2354] 兼容面全清).
  */
 /** One key in the rotating HMAC key-set. `kid` lets the verifier pick the signing key (or fall back to trying the
  *  whole set); `status` lets sema-registry rotate without breaking in-flight approvals: `active` = sign + verify,

package/dist/auth-keys.js

@@ -5,7 +5,7 @@
  * IDENTITY). config.ts consumes ONLY these two functions + their row types at env-load time, and importing them from
  * security.ts made the base config layer value-depend on the whole 55KiB auth module (lens2 §F). This file is a pure
  * leaf (JSON.parse + shape filters, zero repo imports); the VERIFIERS that consume the parsed key-sets
- * (verifyApprovalHmac / verifyPrincipalJwt) stay in security.ts, which re-exports these four names for compat.
+ * (verifyApprovalHmac / verifyPrincipalJwt) stay in ./approval-hmac.ts and ./principal-jwt.ts; consumers import these four names from HERE ([2354] 兼容面全清).
  */
 /** Parse APPROVAL_HMAC_KEYS — a sema-registry-managed, rotating key-SET, as a JSON array of {kid,key,status}.
  *  Empty / unset / unparseable ⇒ `[]` ⇒ HMAC verification is OFF (D-G inactive; back-compat, BFF-only door). */

package/dist/bench/s1/run-firm.js

@@ -278,7 +278,7 @@ function dryRunMockFactory() {
             sessionId: `dry-${String(seed)}`,
             status: "completed",
             result: "DONE",
-            stats: { turns: 3, tokens: 1200, costMicroUsd: 50_000, costUsd: 0.05, nested: { tokens: 0, turns: 0, tasks: 0, costMicroUsd: 0 }, ...stats },
+            stats: { turns: 3, tokens: 1200, costMicroUsd: 50_000, nested: { tokens: 0, turns: 0, tasks: 0, costMicroUsd: 0 }, ...stats },
             verification: { verdict: green ? "PASS" : "FAIL", rounds: 1, findings: [] },
         };
         const deps = {

package/dist/boot/config-center.d.ts

@@ -1,6 +1,6 @@
 import { CenterPromptSource } from "@sema-agent/core";
 import { buildPricing } from "../budget.js";
-import { type PromptsDomainFaces } from "../capabilities/center-prompts.js";
+import { type PromptsDomainFaces } from "../prompts-domain-validate.js";
 import { type Scenario, type ScenarioDeps, type ScenarioDetail } from "../capabilities/scenarios.js";
 import type { LoadedSkill } from "../capabilities/skills.js";
 import { type ServiceConfig } from "../config.js";

package/dist/boot/config-center.js

@@ -38,7 +38,8 @@ import { skillContentHash } from "@sema-agent/registry-core";
 import { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "@sema-agent/core";
 import { buildPricing } from "../budget.js";
 import { applyCenterPlugins } from "../capabilities/center-plugins.js";
-import { validatePromptsDomain, applyCatalogToSource, CORE_ENGINE_VERSION, withPromptArtifactBackfill } from "../capabilities/center-prompts.js";
+import { applyCatalogToSource, withPromptArtifactBackfill } from "../capabilities/center-prompts.js";
+import { validatePromptsDomain, CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
 import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
 import { configLkgEnabled } from "../config.js";
 import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg } from "../config-lkg.js";
@@ -104,7 +105,7 @@ export async function createConfigCenterRuntime(ctx) {
         sealedKeys = await ensureSealedKeyStore(join(config.localDataRoot ?? localRoot, "sealed-key"), logger);
         void reportExecutionPublicKey({
             baseUrl: cc?.baseUrl,
-            adminToken: process.env.SEMA_REGISTRY_ADMIN_TOKEN || process.env.REGISTRY_ADMIN_TOKEN,
+            adminToken: process.env.SEMA_REGISTRY_ADMIN_TOKEN, // [2373]B-1:REGISTRY_ADMIN_TOKEN 双读已墓碑(在场即拒启)
             key: sealedKeys.latest,
             ...(cc?.worker ? { notes: `worker ${cc.worker}` } : {}),
             logger,

package/dist/boot/reapers.d.ts

@@ -20,7 +20,7 @@ import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import type { WorkflowNotifyGate, WorkflowNotifyJournalStore } from "../orchestration/workflow-notify-journal.js";
 import type { TaskAttachmentStore } from "../plugins/task-attachment-store.js";
-import type { ApprovalStore, CheckpointStoreFull, CostQuotaStore, ImageBake, RateLimiterStore, ServiceWorkflowJournalStore, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
+import type { CheckpointStoreFull, CostQuotaStore, ImageBake, RateLimiterStore, ServiceWorkflowJournalStore, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
 export interface ReapersCtx {
     config: ServiceConfig;
     logger: Logger;
@@ -30,7 +30,6 @@ export interface ReapersCtx {
     subRunner: Runner;
     runStore: ReturnType<StoreBackend["run"]> | undefined;
     checkpointStore: CheckpointStoreFull | undefined;
-    approvalStore: ApprovalStore | undefined;
     rateLimiter: RateLimiter | RateLimiterStore | undefined;
     costQuota: CostQuota | CostQuotaStore | undefined;
     toolResultStore: ToolResultStoreFull | undefined;

package/dist/boot/reapers.js

@@ -17,7 +17,7 @@ import { sweepStaleScratchpads } from "../env-facts.js";
 import { CostQuota } from "../observability/cost-quota.js";
 /** 起后台维护 tick,返回定时器 handle(收尾段 clearInterval 用)。 */
 export function startReapers(ctx) {
-    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, approvalStore, rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, getRunDenySweep, } = ctx;
+    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, getRunDenySweep, } = ctx;
     // S7 (SILENT-FALLBACK P0-d): the sweeps' return counts were discarded — an instance death that batch-fails
     // N orphans was indistinguishable from organic failures. Count + log ONLY when a sweep flipped rows (>0),
     // so healthy ticks stay silent. Tolerant of void-returning stores (typeof guard).
@@ -137,11 +137,10 @@ export function startReapers(ctx) {
             // continues with the denial), vs the abort reapExpired gives the other kinds. Bounded per tick.
             void getRunDenySweep()?.(Date.now()).catch(() => undefined); // A10 搬运改写:晚绑取值(原 `runDenySweep?.`)
         }
-        // The finer, OPT-IN per-approval TTL sweeps (APPROVAL_TIMEOUT_SEC): the F4 poll-gate store + the
-        // time-based suspended-run reaper. Stay gated — reapSuspended with a 0 TTL would nuke ALL suspended rows
-        // (cutoff = now). The absolute backstop above is the safety floor; this is the operator-chosen deadline.
+        // The finer, OPT-IN time-based suspended-run reaper (APPROVAL_TIMEOUT_SEC). Stays gated — reapSuspended
+        // with a 0 TTL would nuke ALL suspended rows (cutoff = now). The absolute backstop above is the safety
+        // floor; this is the operator-chosen deadline. ([2354] A-5:F4 轮询店的 expireStale 腿随车道退役。)
         if (config.approvalTimeoutSec > 0) {
-            void approvalStore?.expireStale(config.approvalTimeoutSec * 1000).catch(() => undefined);
             void runStore?.reapSuspended(config.approvalTimeoutSec * 1000).then(reapCount("runs_reaped_total", { kind: "suspended" })).catch(() => undefined);
         }
         // GC checkpoint_ctx rows whose checkpoint is gone (bound to the checkpoint lifecycle).

package/dist/boot/resolve-spec.d.ts

@@ -1,5 +1,5 @@
 import { type MemoryBackend, type RunnerDeps } from "@sema-agent/core";
-import { type PromptsDomainFaces } from "../capabilities/center-prompts.js";
+import type { PromptsDomainFaces } from "../prompts-domain-validate.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { selectScenario } from "../capabilities/scenarios.js";
@@ -56,8 +56,6 @@ export interface ResolveSpecCtx {
     } | undefined;
     durableEnabled: boolean;
     approvalExemptionStore: ReturnType<StoreBackend["approvalExemption"]> | undefined;
-    approvalEnabled: boolean | undefined;
-    approvalStore: ReturnType<NonNullable<StoreBackend["approval"]>> | undefined;
     singleUserAutoAcceptBaseline: boolean;
     checkpointStore: ReturnType<NonNullable<StoreBackend["checkpoint"]>> | undefined;
     deploymentHooks: NonNullable<RunnerDeps["hooks"]>;

package/dist/boot/resolve-spec.js

@@ -20,7 +20,7 @@
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
 import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, expandTiers, tightenTaskSpec } from "@sema-agent/core";
-import { createOaApprovalPolicy, createDurableAskPolicy } from "../approval.js";
+import { createDurableAskPolicy } from "../approval.js";
 import { cappedCeiling } from "../budget.js";
 import { centerPromptProvider, centerIdentityAssembled } from "../capabilities/center-prompts.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
@@ -39,7 +39,8 @@ import { resourceSuspendOptIn } from "../resource-suspend.js";
 import { isIsolatedExecEnv, routeServiceTask, supPostureOverrides } from "../router/route-orchestration.js";
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { applyRuntimeGovernance, stripDelegationTools } from "../runtime-governance.js";
-import { HttpError, memorySpecForRequest, encodeCheckpointScope } from "../security.js";
+import { HttpError, encodeCheckpointScope } from "../security.js";
+import { memorySpecForRequest } from "../memory-scope.js";
 import { mcpForScenario } from "../config-center/facade.js";
 import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptProfileFromBody, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolNameListFromBody } from "../spec-fields.js";
 import { cwdHonored, effectiveHostWorkspace, inProcessSingleUserLane, isValidCwd, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
@@ -48,7 +49,7 @@ import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, acceptAppendSystemPrompt, applyTaskSet
 import { enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, approvalEnabled, approvalStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, } = ctx;
     // Deployment-owned mapping. Tools/prompt/skills come from the selected scenario (assembled once,
     // bound per request); identity/session/policy stay server-side. Never taken from the request body.
     // design/158 A8:从 createHttpServer 实参里提出来(原地占该字面量 1,093 行中的 967 行)——
@@ -692,8 +693,9 @@ export function createResolveSpec(ctx) {
             // provider 才不会各看一版(TOCTOU:门判安全、pick 到已组装包=core 侧静默丢 rider 复活)。
             promptProvider: centerDecls ? centerPromptProvider(centerDecls, scenarioName) : cap.promptProvider,
             // F4: high-risk write approval gate. DURABLE (design/45, opt-in): the gated `ask` SUSPENDS the task
-            // (durable checkpoint, resumable on any replica). Else the legacy POLL gate: the call waits on a
-            // durable pending row any instance can decide via /v1/approvals, releasing at the task deadline.
+            // (durable checkpoint, resumable on any replica). [2354]/[2356] A-5(5.0.0): the legacy POLL gate
+            // (createOaApprovalPolicy over ApprovalStore pending rows) is retired — durable is the ONLY gate; an
+            // operator with approval intent but no checkpointStore falls to `undefined` (core's UNGATED warning).
             // Durable ask (TC-5.4, core 1.95): in durable mode an AskUserQuestion call suspends like an F4 gate —
             // the question policy adjudicates it `ask`, the operator answers out-of-band, and the resume carries
             // the QuestionAnswer (server.ts `body.answer` → onQuestion closure). Suspend side mounts the tool with
@@ -711,36 +713,20 @@ export function createResolveSpec(ctx) {
                         }
                         : {}),
                 }))
-                : approvalEnabled && approvalStore
-                    ? createOaApprovalPolicy({
-                        store: approvalStore,
-                        requireApproval: config.approvalRequire,
-                        deny: config.approvalDeny,
-                        pollMs: config.approvalPollMs,
-                        context: () => ({ sessionId: auth?.sessionId ?? null, owner: auth?.principal ?? null }),
-                        neverAuto: config.approvalNeverAuto, // workflow audit 2026-07-13: the ordering lock must hold on the OA leg too
-                        // Same probe on the legacy poll gate (sessionId threaded via ctx here).
-                        ...(approvalExemptionStore
-                            ? {
-                                exempt: (sessionId, toolName) => approvalExemptionStore.has(sessionId, toolName),
-                                onExempted: (sessionId, toolName) => logger.info("approval_exempted", { sessionId, toolName }),
-                            }
-                            : {}),
-                    })
-                    : singleUserAutoAcceptBaseline
-                        // 🔴 (live finding: single-user host-lane Bash ran UNGATED, no adjudication): a
-                        // single-user turnkey worker with NO expressed gate intent previously left `toolPolicy` UNDEFINED →
-                        // core's write-capable hand tools mount UNADJUDICATED (core error-logs it every task; host lane has NO
-                        // sandbox to fall back on). CC's trust model is auto-accept, but the GATE MECHANISM must be PRESENT
-                        // (core 原则: "机制留、默认可更宽 auto-accept"). So wire an adjudicated auto-accept BASELINE
-                        // (`createAllowDenyPolicy({})` = a present, effect-aware policy that allows all): satisfies core's
-                        // `hasEffectAwareGate`, restores observability + a hook/tighten point, and the operator STILL tightens
-                        // irreversible ops via `AUTONOMY` / `commandPolicy` (layered TIGHTEN-ONLY by applyRuntimeGovernance).
-                        // Interactive approval routed to the shell HITL = follow-on. 🔴 `singleUserAutoAcceptBaseline` requires
-                        // ZERO gate intent — a single-user op who SET approval flags but wired no store falls to `undefined`
-                        // (core warns = real misconfig, not masked); multi-tenant likewise stays `undefined` (approval required).
-                        ? createAllowDenyPolicy({})
-                        : undefined,
+                : singleUserAutoAcceptBaseline
+                    // 🔴 (live finding: single-user host-lane Bash ran UNGATED, no adjudication): a
+                    // single-user turnkey worker with NO expressed gate intent previously left `toolPolicy` UNDEFINED →
+                    // core's write-capable hand tools mount UNADJUDICATED (core error-logs it every task; host lane has NO
+                    // sandbox to fall back on). CC's trust model is auto-accept, but the GATE MECHANISM must be PRESENT
+                    // (core 原则: "机制留、默认可更宽 auto-accept"). So wire an adjudicated auto-accept BASELINE
+                    // (`createAllowDenyPolicy({})` = a present, effect-aware policy that allows all): satisfies core's
+                    // `hasEffectAwareGate`, restores observability + a hook/tighten point, and the operator STILL tightens
+                    // irreversible ops via `AUTONOMY` / `commandPolicy` (layered TIGHTEN-ONLY by applyRuntimeGovernance).
+                    // Interactive approval routed to the shell HITL = follow-on. 🔴 `singleUserAutoAcceptBaseline` requires
+                    // ZERO gate intent — a single-user op who SET approval flags but wired no store falls to `undefined`
+                    // (core warns = real misconfig, not masked); multi-tenant likewise stays `undefined` (approval required).
+                    ? createAllowDenyPolicy({})
+                    : undefined,
             // Durable suspend needs both the store (here, per-task) and the opt-in scope key (multi-tenant =
             // principal; "_" when auth is off). core suspends on a policy `ask` only when these are present.
             ...(durableEnabled

package/dist/boot/stores.js

@@ -27,7 +27,7 @@ import { LocalTaskAttachmentStore } from "../plugins/local-task-attachment-store
 import { PgTaskAttachmentStore, TiDBTaskAttachmentStore, ensurePgTaskAttachmentSchema, ensureTiDBTaskAttachmentSchema } from "../plugins/task-attachment-store.js";
 import { createSessionStore } from "../plugins/session-store.js";
 import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "../plugins/store-backend.js";
-import { memoryEngineBackendFor, memoryEngineRemoteLanePosture } from "../security.js";
+import { memoryEngineBackendFor, memoryEngineRemoteLanePosture } from "../memory-scope.js";
 export async function openStores(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     // One shared SQL store backend for L1 + L2 (TiDB/MySQL or PostgreSQL per DB_BACKEND). Owned here.

package/dist/brain.js

@@ -183,7 +183,9 @@ export function createBrain(config, deps = {}) {
                     fetchImpl,
                     ...timeouts,
                 });
-            brain = createDegradingBrain({ primary: brain, fallback, fallbackModel, downgradeOn: config.degrade.downgradeOn });
+            // core 5.1.0([2390]②):chain-of-one 链形;downgradeOn 缺席时 core 默认含 server_error(默认门
+            // 变宽)——MODEL_DEGRADE_ON 是运维收窄旋钮,词表验门在 config.ts parseDegradeOn。
+            brain = createDegradingBrain({ primary: brain, fallbacks: [{ brain: fallback, model: fallbackModel }], downgradeOn: config.degrade.downgradeOn });
         }
     }
     return brain;

package/dist/capabilities/center-prompts.d.ts

@@ -22,9 +22,8 @@
 import { type PromptProvider, type PublishedPromptArtifactEnvelope } from "@sema-agent/core";
 import { type EffectiveCenterPrompts, type PromptsDomainFaces } from "../prompts-domain-validate.js";
 /** 判形半场(validateCenterPrompts/validatePromptsDomain/CORE_ENGINE_VERSION 及两 interface)已下沉到
- *  中立叶子 `src/prompts-domain-validate.ts`(design/158 S6,lens2 §G:消 config-lkg → capabilities 的
- *  唯一分层反向边)。此处 re-export 保兼容——既有消费者(main/run-local/测试)零改动。 */
-export { validateCenterPrompts, validatePromptsDomain, CORE_ENGINE_VERSION, type EffectiveCenterPrompts, type PromptsDomainFaces } from "../prompts-domain-validate.js";
+ *  中立叶子 `src/prompts-domain-validate.ts`(design/158 S6);消费者直引真源([2354] 兼容面全清,
+ *  此处兼容 re-export 已删)。 */
 /** [985]b / [1285] — §9.4 by-digest 补拉组合店:local miss ⇒ fetchRaw(digest) 从 center 拉 envelope ⇒
  *  core verifyPromptArtifact 全管线 + **回验「拿到的=要的」digest 逐位**(center 答非所问=丢弃)⇒
  *  best-effort 回写 inner(下次直命中)。任何失败=undefined(诚实缺席,fail-loud 归 core 的

package/dist/capabilities/center-prompts.js

@@ -23,9 +23,8 @@ import { verifyPromptArtifact } from "@sema-agent/core";
 import { CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 /** 判形半场(validateCenterPrompts/validatePromptsDomain/CORE_ENGINE_VERSION 及两 interface)已下沉到
- *  中立叶子 `src/prompts-domain-validate.ts`(design/158 S6,lens2 §G:消 config-lkg → capabilities 的
- *  唯一分层反向边)。此处 re-export 保兼容——既有消费者(main/run-local/测试)零改动。 */
-export { validateCenterPrompts, validatePromptsDomain, CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
+ *  中立叶子 `src/prompts-domain-validate.ts`(design/158 S6);消费者直引真源([2354] 兼容面全清,
+ *  此处兼容 re-export 已删)。 */
 /** [985]b / [1285] — §9.4 by-digest 补拉组合店:local miss ⇒ fetchRaw(digest) 从 center 拉 envelope ⇒
  *  core verifyPromptArtifact 全管线 + **回验「拿到的=要的」digest 逐位**(center 答非所问=丢弃)⇒
  *  best-effort 回写 inner(下次直命中)。任何失败=undefined(诚实缺席,fail-loud 归 core 的

package/dist/capabilities/sandbox-file-send.d.ts

@@ -35,7 +35,6 @@
  */
 import type { ExecutionEnv, ExecutionEnvFactory } from "@sema-agent/core";
 import type { IssuedFileLink, PreparedDirectUpload } from "../plugins/send-user-file.js";
-import { shellQuote as shq } from "../plugins/remote-shell.js";
 /** Leak backstop (codex review HIGH): core skips destroy on suspend/review paths and a crash may skip it
  *  entirely — the suspendVM wrap covers the common case, this bound covers the rest. Far above any real
  *  per-replica concurrency. 修6: at the cap the registry REFUSES the new registration instead of FIFO-evicting
@@ -92,7 +91,6 @@ export declare class TaskEnvRegistry {
  *    adb/local-docker remain a follow-on).
  */
 export declare function sandboxSendLaneEnabled(provider: string | undefined, requirePrincipal: boolean): boolean;
-export { shq };
 /** Strip the capability URL (and any SigV4 signature) from text before it reaches an error/log — including
  *  the percent-encoded forms an adapter may echo (the k8s exec transport carries the command in a request
  *  URI, so an error can quote the URL re-encoded; codex review MED). */

package/dist/capabilities/sandbox-file-send.js

@@ -139,11 +139,8 @@ export function sandboxSendLaneEnabled(provider, requirePrincipal) {
         return requirePrincipal !== true;
     return false;
 }
-// design/158 R10: the quoting logic itself now lives solely in remote-shell.ts's shellQuote (this module's
-// former standalone copy was byte-identical; its JSDoc note was folded into that owner). `shq` stays a
-// re-exported alias — not a plain call-through rename — because two test files import `shq` by name from
-// this module.
-export { shq };
+// [2354] clay 令兼容面全清:R10 曾留的 `export { shq }` 兼容转口已删——quoting 唯一真源=
+// remote-shell.ts 的 shellQuote(原先仅有的两个消费者是测试文件,已改从真源导入)。
 /** Strip the capability URL (and any SigV4 signature) from text before it reaches an error/log — including
  *  the percent-encoded forms an adapter may echo (the k8s exec transport carries the command in a request
  *  URI, so an error can quote the URL re-encoded; codex review MED). */

package/dist/capabilities/scenarios.d.ts

@@ -46,16 +46,7 @@ export interface ScenarioDeps {
     metrics?: Metrics;
     logger?: Logger;
     /** OA backend coordinates for the `oa` scenario (read /api/v1, write /api/assets). */
-    oaApiBaseUrl?: string;
-    oaServiceToken?: string;
     /** 可选：`oa` 场景注入"开 Gitea issue"工具(OA AI 请求#5)；repo/token/labels 固定，模型只填 title/body。 */
-    oaIssue?: {
-        baseUrl: string;
-        owner: string;
-        repo: string;
-        token: string;
-        defaultLabels?: number[];
-    };
     /**
      * When true, the `default` scenario carries the Sema product identity (see {@link semaIdentityProvider}).
      * Set by the local/TOC deployment (CONFIG_PROVIDER=local / run-local) so the local engine answers "who