@sema-agent/server 4.3.0 → 5.0.0

package/dist/plugins/roster-store-sql.js

@@ -1,6 +1,4 @@
 import { normalizeAgentName } from "@sema-agent/core";
-/** 兼容名保留(测试/历史引用),现=core 导出直引(私拷已删)。 */
-export const normalizeAgentNameLocal = normalizeAgentName;
 export const ROSTER_TABLE = "agent_roster";
 /** 行 → RosterEntry(缺席键省略,core 形逐字;session_scoped 数值/布尔双方言归一)。
  *  core 1.365 BREAKING:owner/scope 升类型必填——两方言 CREATE 直接建成 NOT NULL(当年的「清死行 +
@@ -114,7 +112,7 @@ export async function ensurePgRosterSchema(q) {
 /** upsert 参数序(两方言共用;core 1.365 起 owner/scope 类型必填——键列直取,与 core upsertKey 同键)。 */
 function upsertParams(entry, now) {
     return [
-        normalizeAgentNameLocal(entry.name),
+        normalizeAgentName(entry.name),
         entry.owner,
         entry.scope,
         entry.name,
@@ -148,7 +146,7 @@ export class TiDBRosterStore {
          session_scoped = VALUES(session_scoped), root_session_id = VALUES(root_session_id), model = VALUES(model), created_at_ms = VALUES(created_at_ms), recorded_at_ms = VALUES(recorded_at_ms)`, p.map((v) => (typeof v === "boolean" ? (v ? 1 : 0) : v)));
     }
     async resolve(name, access) {
-        const key = normalizeAgentNameLocal(name);
+        const key = normalizeAgentName(name);
         if (key === "")
             return undefined;
         const [rows] = (await this.pool.query(`SELECT ${COLS} FROM ${ROSTER_TABLE} WHERE ${RESOLVE_WHERE_TIDB} ORDER BY created_at_ms DESC, recorded_at_ms DESC, agent_id DESC LIMIT 1`, [key, access.scope ?? null, access.owner ?? null, access.sessionId ?? null, access.sessionId ?? null]));
@@ -185,7 +183,7 @@ export class PgRosterStore {
          recorded_at_ms = EXCLUDED.recorded_at_ms`, upsertParams(entry, this.clock()));
     }
     async resolve(name, access) {
-        const key = normalizeAgentNameLocal(name);
+        const key = normalizeAgentName(name);
         if (key === "")
             return undefined;
         const { rows } = await this.q(`SELECT ${COLS} FROM ${ROSTER_TABLE} WHERE ${RESOLVE_WHERE_PG} ORDER BY created_at_ms DESC, recorded_at_ms DESC, agent_id DESC LIMIT 1`, [key, access.scope ?? null, access.owner ?? null, access.sessionId ?? null, access.sessionId ?? null]);

package/dist/plugins/store-backend.d.ts

@@ -3,27 +3,19 @@ import type { Pool as PgPool } from "pg";
 import type { SessionStore, SessionPolicyStore, FileSnapshotStore, WorkflowJournalStore, ToolResultStore } from "@sema-agent/core";
 import { type FileSnapshotBounds } from "@sema-agent/core";
 import { type OutcomeSink } from "./file-outcome-sink.js";
-import { type InboxWarn } from "./tidb-workflow-run-store.js";
+import { type InboxWarn } from "./workflow-run-store-sql.js";
 import { FileRunStore } from "./file-run-store.js";
 import { LocalCheckpointStore } from "./local-checkpoint-store.js";
 import { FileResumeAnchorStore } from "./file-resume-anchor-store.js";
 import { type ApprovalExemptionStore } from "./approval-exemption-store.js";
 import { type SendFileLedger } from "./send-file-ledger.js";
-import { TiDBResumeAnchorStore } from "./tidb-resume-anchor-store.js";
-import { PgResumeAnchorStore } from "./pg-resume-anchor-store.js";
+import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
 import type { ServiceConfig } from "../config-types.js";
-import { TiDBRunStore } from "./tidb-run-store.js";
-import { PgRunStore } from "./pg-run-store.js";
-import { TiDBCheckpointStore } from "./tidb-checkpoint-store.js";
-import { PgCheckpointStore } from "./pg-checkpoint-store.js";
-import { TiDBApprovalStore } from "./tidb-approval-store.js";
-import { PgApprovalStore } from "./pg-approval-store.js";
-import { TiDBImageIndex } from "./tidb-image-index.js";
-import { PgImageIndex } from "./pg-image-index.js";
-import { TiDBImageBake } from "./tidb-image-bake.js";
-import { PgImageBake } from "./pg-image-bake.js";
-import { TiDBBreakerState } from "./tidb-breaker-state.js";
-import { PgBreakerState } from "./pg-breaker-state.js";
+import { TiDBRunStore, PgRunStore } from "./run-store-sql.js";
+import { TiDBCheckpointStore, PgCheckpointStore } from "./checkpoint-store-sql.js";
+import { TiDBImageIndex, PgImageIndex } from "./image-index-sql.js";
+import { TiDBImageBake, PgImageBake } from "./image-bake-store-sql.js";
+import { TiDBBreakerState, PgBreakerState } from "./breaker-state-sql.js";
 import { TiDBCostQuota } from "./tidb-cost-quota.js";
 import { PgCostQuota } from "./pg-cost-quota.js";
 import { TiDBRateLimiter } from "./tidb-rate-limiter.js";
@@ -79,7 +71,6 @@ export type ServiceWorkflowJournalStore = WorkflowJournalStore & {
      *  TaskResult-bearing table (the per-run deleteByRun has no run-store reap hook). Local InMemory omits it. */
     reapExpired?(now: number, maxAgeMs: number): Promise<number>;
 };
-export type ApprovalStore = TiDBApprovalStore | PgApprovalStore;
 export type ImageIndex = TiDBImageIndex | PgImageIndex;
 export type ImageBake = TiDBImageBake | PgImageBake;
 /** The FULL checkpoint store (core CheckpointStore + the service operator-queue/ctx methods listPending/
@@ -155,7 +146,6 @@ export interface StoreBackend {
     checkpoint?(logger?: {
         info?(msg: string, meta?: unknown): void;
     }): CheckpointStoreFull;
-    approval?(): ApprovalStore;
     toolResult?(): ToolResultStoreFull;
     imageIndex?(): ImageIndex;
     imageBake?(): ImageBake;

package/dist/plugins/store-backend.js

@@ -4,48 +4,34 @@
  * subsystem. main.ts wires through this instead of `new TiDB*(pool)` so `DB_BACKEND=pg` boots the whole service on
  * PG with zero call-site churn. The twins are interchangeable behaviourally (one shared real-DB integration suite
  * keeps them in lock-step); the unions below exist only because TS private fields make the concrete classes
- * nominally distinct (run/approval/imageIndex/imageBake have no core interface — the rest implement one).
+ * nominally distinct (run/imageIndex/imageBake have no core interface — the rest implement one).
  */
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { FileStorageBackend, FileSessionRepo, DEFAULT_SNAPSHOT_BOUNDS } from "@sema-agent/core";
-import { FileWorkflowJournalStore } from "./file-workflow-journal-store.js";
-import { TiDBOutcomeLedger } from "./tidb-outcome-ledger.js";
-import { PgOutcomeLedger } from "./pg-outcome-ledger.js";
+import { FileWorkflowJournalStore } from "@sema-agent/core";
+import { TiDBOutcomeLedger, PgOutcomeLedger } from "./outcome-ledger-sql.js";
 import { FileOutcomeSink } from "./file-outcome-sink.js";
-import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore } from "./tidb-workflow-run-store.js";
-import { PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore } from "./pg-workflow-run-store.js";
+import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore, PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore } from "./workflow-run-store-sql.js";
 import { FileRunStore } from "./file-run-store.js";
 import { LocalSessionStore } from "./local-session-store.js";
 import { LocalCheckpointStore } from "./local-checkpoint-store.js";
 import { FileResumeAnchorStore } from "./file-resume-anchor-store.js";
 import { TiDBApprovalExemptionStore, PgApprovalExemptionStore, FileApprovalExemptionStore } from "./approval-exemption-store.js";
 import { TiDBSendFileLedger, PgSendFileLedger, FileSendFileLedger } from "./send-file-ledger.js";
-import { TiDBResumeAnchorStore } from "./tidb-resume-anchor-store.js";
-import { PgResumeAnchorStore } from "./pg-resume-anchor-store.js";
-import { TiDBSessionPolicyStore } from "./tidb-session-policy-store.js";
-import { PgSessionPolicyStore } from "./pg-session-policy-store.js";
-import { TiDBWorkflowJournalStore } from "./tidb-workflow-journal-store.js";
-import { PgWorkflowJournalStore } from "./pg-workflow-journal-store.js";
-import { TiDBFileSnapshotStore } from "./tidb-file-snapshot-store.js";
-import { PgFileSnapshotStore } from "./pg-file-snapshot-store.js";
+import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
+import { TiDBSessionPolicyStore, PgSessionPolicyStore } from "./session-policy-store-sql.js";
+import { TiDBWorkflowJournalStore, PgWorkflowJournalStore } from "./workflow-journal-store-sql.js";
+import { TiDBFileSnapshotStore, PgFileSnapshotStore } from "./file-snapshot-store-sql.js";
 import { MinioBlobBackend, SqlBlobBackend } from "./blob-backend.js";
 import { createTidbPool, ensureSchema as ensureTidbSchema } from "./tidb-pool.js";
 import { createPgPool, ensurePgSchema, pgPoolOptions } from "./pg-pool.js";
-import { TiDBRunStore } from "./tidb-run-store.js";
-import { PgRunStore } from "./pg-run-store.js";
-import { TiDBCheckpointStore } from "./tidb-checkpoint-store.js";
-import { PgCheckpointStore } from "./pg-checkpoint-store.js";
-import { TiDBApprovalStore } from "./tidb-approval-store.js";
-import { PgApprovalStore } from "./pg-approval-store.js";
-import { TiDBToolResultStore } from "./tidb-tool-result-store.js";
-import { PgToolResultStore } from "./pg-tool-result-store.js";
-import { TiDBImageIndex } from "./tidb-image-index.js";
-import { PgImageIndex } from "./pg-image-index.js";
-import { TiDBImageBake } from "./tidb-image-bake.js";
-import { PgImageBake } from "./pg-image-bake.js";
-import { TiDBBreakerState } from "./tidb-breaker-state.js";
-import { PgBreakerState } from "./pg-breaker-state.js";
+import { TiDBRunStore, PgRunStore } from "./run-store-sql.js";
+import { TiDBCheckpointStore, PgCheckpointStore } from "./checkpoint-store-sql.js";
+import { TiDBToolResultStore, PgToolResultStore } from "./tool-result-store-sql.js";
+import { TiDBImageIndex, PgImageIndex } from "./image-index-sql.js";
+import { TiDBImageBake, PgImageBake } from "./image-bake-store-sql.js";
+import { TiDBBreakerState, PgBreakerState } from "./breaker-state-sql.js";
 import { TiDBCostQuota } from "./tidb-cost-quota.js";
 import { PgCostQuota } from "./pg-cost-quota.js";
 import { TiDBRateLimiter } from "./tidb-rate-limiter.js";
@@ -117,7 +103,6 @@ class TiDBBackend {
     completionInbox(onWarn) { return new TiDBWorkflowCompletionInbox(this.pool, onWarn); } // P1: cross-replica push half
     notifyJournal() { return new TiDBWorkflowNotifyJournalStore(this.pool); } // 1.108: cross-replica at-least-once notify
     checkpoint(logger) { return new TiDBCheckpointStore(this.pool, logger); }
-    approval() { return new TiDBApprovalStore(this.pool); }
     toolResult() { return new TiDBToolResultStore(this.pool); }
     imageIndex() { return new TiDBImageIndex(this.pool); }
     imageBake() { return new TiDBImageBake(this.pool); }
@@ -151,7 +136,6 @@ class PgBackend {
     completionInbox(onWarn) { return new PgWorkflowCompletionInbox(this.pool, onWarn); } // P1: cross-replica push half
     notifyJournal() { return new PgWorkflowNotifyJournalStore(this.pool); } // 1.108: cross-replica at-least-once notify
     checkpoint(logger) { return new PgCheckpointStore(this.pool, logger); }
-    approval() { return new PgApprovalStore(this.pool); }
     toolResult() { return new PgToolResultStore(this.pool); }
     imageIndex() { return new PgImageIndex(this.pool); }
     imageBake() { return new PgImageBake(this.pool); }

package/dist/plugins/tidb-pool.js

@@ -198,32 +198,8 @@ export const SCHEMA_STATEMENTS = [
      PRIMARY KEY (session_id),
      KEY idx_task (task_id)
    )`,
-    // Human-in-the-loop approval gate (F4). A pending row is durable so an operator's decision can
-    // arrive on any instance; the instance running the task polls this row to release its wait.
-    `CREATE TABLE IF NOT EXISTS approval (
-     id          VARCHAR(64)  NOT NULL,
-     task_id     VARCHAR(64)  NULL,
-     session_id  VARCHAR(64)  NULL,
-     owner       VARCHAR(190) NULL,
-     -- scope — single-DB fleet scope guard (defense-in-depth): the run's tenant identity (owner-sourced), so the
-     -- approval READ paths (getStatus / get / listPending / decide) can null-safe-filter on it. A NULL scope row
-     -- (an untenanted run — and, on the pre-folding schema, any PRE-MIGRATION row) is matched by a NULL scope arg
-     -- via MySQL <=> / PG IS NOT DISTINCT FROM — see tidb-approval-store.ts / pg-approval-store.ts.
-     -- expireStale deliberately stays GLOBAL (fleet maintenance, not a tenant read).
-     scope       VARCHAR(190) NULL,
-     tool_name   VARCHAR(190) NOT NULL,
-     args        JSON         NULL,
-     status      VARCHAR(16)  NOT NULL,
-     reason      TEXT         NULL,
-     decided_by  VARCHAR(190) NULL,
-     created_at  DATETIME(3)  NOT NULL,
-     decided_at  DATETIME(3)  NULL,
-     PRIMARY KEY (id),
-     KEY idx_owner_status (owner, status),
-     -- idx_scope_status: the scope-filtered READ paths (listPending WHERE scope <=> ?) would full-scan without it.
-     KEY idx_scope_status (scope, status),
-     KEY idx_status (status)
-   )`,
+    // ([2354]/[2356] A-5,5.0.0:F4 轮询车道的 `approval` 表 DDL 已随车道退役——存量库里的旧表留置不动,
+    //  代码零读写;durable 门只用下面的 checkpoint 表。)
     // Durable-checkpoint (core 1.67 / design/45): a policy `ask` persisted as a suspended task so an operator
     // can `resume` it from any replica. `checkpoint` = core's blob + CAS status; `outcome` persisted on resolve
     // (R20 #1). Timestamps are epoch-ms BIGINT (the core Checkpoint uses ms numbers, not DATETIME).
@@ -396,7 +372,7 @@ export const SCHEMA_STATEMENTS = [
     // = JSON.stringify(TaskResult). The (run_id, ordinal) PK makes append IDEMPOTENT (ON DUPLICATE KEY = OVERWRITE /
     // last-write-wins) so a resumed run re-appending its replayed prefix verbatim leaves no dup — the byte-match of
     // core's InMemoryWorkflowJournalStore (byOrdinal.set). LOAD-BEARING (a resume replays it), unlike the best-effort
-    // task_event observation log. GC'd by the run reaper (deleteByRun). See tidb-workflow-journal-store.ts.
+    // task_event observation log. GC'd by the run reaper (deleteByRun). See workflow-journal-store-sql.ts.
     `CREATE TABLE IF NOT EXISTS workflow_journal (
      run_id     VARCHAR(191) NOT NULL,
      ordinal    INT          NOT NULL,
@@ -621,7 +597,7 @@ export const SCHEMA_STATEMENTS = [
     // Admission sentinel: ONE always-present row per builder pool, `SELECT … FOR UPDATE`-locked to SERIALIZE the
     // createBakeIfIdle busy-check+insert. A bare conditional INSERT…SELECT WHERE NOT EXISTS does NOT serialize two
     // concurrent admissions under TiDB's REPEATABLE READ (nor PG's READ COMMITTED), so without this lock two keyless
-    // POSTs can both admit a non-dryRun bake. Dialect-uniform with the PG twin (pg-image-bake.ts).
+    // POSTs can both admit a non-dryRun bake. Dialect-uniform with the PG twin (image-bake-store-sql.ts).
     `CREATE TABLE IF NOT EXISTS image_bake_admit (
      pool VARCHAR(32) NOT NULL,
      PRIMARY KEY (pool)

package/dist/plugins/workflow-journal-store-sql.d.ts

@@ -8,7 +8,7 @@
  * {@link import("@sema-agent/core").InMemoryWorkflowJournalStore} (single-replica, lost on crash); this is the
  * byte-match durable twin so a workflow survives a replica crash and RESUMES (replay the longest unchanged
  * PREFIX of recorded `ctx.agent` results, run only the first changed/new call + everything after it live). The
- * journal is LOAD-BEARING (unlike the best-effort {@link import("./tidb-run-store.js")} observation layer):
+ * journal is LOAD-BEARING (unlike the best-effort {@link import("./run-store-sql.js")} observation layer):
  * append/load failures MUST throw — a silently-dropped entry would silently re-run already-done work.
  *
  * Schema = `workflow_journal (run_id, ordinal) PK` (DDL in tidb-pool.ts / pg-pool.ts ensureSchema). `ordinal`

package/dist/plugins/workflow-journal-store-sql.js

@@ -1,5 +1,5 @@
 import { callKeyOrdinal } from "@sema-agent/core";
-import { oversizeJournalResult } from "./workflow-journal-limits.js";
+import { oversizeJournalResult } from "@sema-agent/core";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 const DEFAULT_RESUME_CLAIM_TTL_MS = 60 * 60 * 1000;
 export class SqlWorkflowJournalStore {

package/dist/principal-jwt.js

@@ -1,7 +1,7 @@
 /**
  * design/80 D-G: principal crypto-binding (the direct-door IDENTITY gate) + the combined direct-door proof
- * verifier. Split out of `security.ts` (design/158 A13, internal-lossless — the facade re-exports every symbol
- * below unchanged; `verifyDirectDoorProof` imports {@link verifyApprovalHmac} from `./approval-hmac.js` for the
+ * verifier. Split out of `security.ts` (design/158 A13; consumers import from HERE — [2354] cleared the security.ts compat re-exports;
+ * `verifyDirectDoorProof` imports {@link verifyApprovalHmac} from `./approval-hmac.js` for the
  * integrity half of the combined proof; `security.ts`'s own `verifiedPrincipal` imports {@link verifyPrincipalJwt}
  * from here for the direct-door identity branch).
  *

package/dist/prompts-domain-validate.d.ts

@@ -41,9 +41,10 @@ export interface PromptsDomainFaces {
 }
 /**
  * prompts 域候选门 v2(validateCenterPrompts 的双轴升级;整拒语义不变=任一在场轴坏形 ⇒ 整个 prompts
- * 面拒绝采用,LKG/内置继续服务)。两形都认:
- *  - legacy 平铺(无 schemaVersion 键)= declaration 轴单轴(存量 center 停发平铺前的兼容窗);
- *  - `{schemaVersion:1, declarations?, catalog?}`(registry-core `EffectivePromptsWire`)= 至少一轴。
+ * 面拒绝采用,LKG/内置继续服务)。唯一认可形=`{schemaVersion:1, declarations?, catalog?}`
+ * (registry-core `EffectivePromptsWire`)至少一轴。[2373]B-9(5.0.0):legacy 平铺兼容窗到期删——
+ * 0.13.0 起 EffectivePromptsWire 首字段是 `schemaVersion: z.ZodLiteral<1>`,与 server 共用 ^0.13.0 的
+ * 合规 center 不可能再发平铺;非合规体=响亮拒绝(整拒落 LKG/内置),不再静默吸收。
  * catalog 轴的语义权威=core `verifyPromptArtifact`(形/digest 逐位复算/ARTIFACT_LIMITS/compatibleCore
  * range 全在 core 一处——[1242]③ a 解,上限单真源永不漂)。
  */

package/dist/prompts-domain-validate.js

@@ -3,7 +3,7 @@
  * lens2 §G:`config-lkg.ts → capabilities/center-prompts.ts` 是全仓唯一一条显式分层反向边,config 层
  * 值 import capabilities 层)。本模块只依赖 node 内置 + `@sema-agent/core`,不依赖 capabilities/
  * config 任何东西,config-lkg(LKG 读侧复判)与 capabilities(候选门)同引即无反向边。
- * center-prompts.ts 原位置 re-export 保兼容,语义/文案零改动——逐字搬运。
+ * 消费者直引本模块([2354] 兼容面全清:center-prompts.ts 的原位兼容 re-export 已删);语义/文案零改动——逐字搬运。
  *
  * ─── 以下为原 center-prompts.ts 的判形半场,注释原样保留 ───
  *
@@ -107,9 +107,10 @@ export const CORE_ENGINE_VERSION = (() => {
 })();
 /**
  * prompts 域候选门 v2(validateCenterPrompts 的双轴升级;整拒语义不变=任一在场轴坏形 ⇒ 整个 prompts
- * 面拒绝采用,LKG/内置继续服务)。两形都认:
- *  - legacy 平铺(无 schemaVersion 键)= declaration 轴单轴(存量 center 停发平铺前的兼容窗);
- *  - `{schemaVersion:1, declarations?, catalog?}`(registry-core `EffectivePromptsWire`)= 至少一轴。
+ * 面拒绝采用,LKG/内置继续服务)。唯一认可形=`{schemaVersion:1, declarations?, catalog?}`
+ * (registry-core `EffectivePromptsWire`)至少一轴。[2373]B-9(5.0.0):legacy 平铺兼容窗到期删——
+ * 0.13.0 起 EffectivePromptsWire 首字段是 `schemaVersion: z.ZodLiteral<1>`,与 server 共用 ^0.13.0 的
+ * 合规 center 不可能再发平铺;非合规体=响亮拒绝(整拒落 LKG/内置),不再静默吸收。
  * catalog 轴的语义权威=core `verifyPromptArtifact`(形/digest 逐位复算/ARTIFACT_LIMITS/compatibleCore
  * range 全在 core 一处——[1242]③ a 解,上限单真源永不漂)。
  */
@@ -118,10 +119,8 @@ export function validatePromptsDomain(raw) {
         return { ok: false, error: "prompts is not an object" };
     const w = raw;
     if (w.schemaVersion === undefined) {
-        const legacy = validateCenterPrompts(raw);
-        if (!legacy.ok)
-            return legacy;
-        return { ok: true, value: { declarations: legacy.value, identity: `${legacy.value.contentDigest}+-`, axes: ["declarations"] } };
+        // [2373]B-9:平铺形拒绝(兼容窗 5.0.0 到期)。文案带指引=下游冒烟立刻可自修,不是哑谜。
+        return { ok: false, error: "prompts payload has no schemaVersion — the legacy flat shape was retired in 5.0.0; wrap as {schemaVersion:1, declarations:{...}} (registry-core EffectivePromptsWire)" };
     }
     if (w.schemaVersion !== 1)
         return { ok: false, error: `unsupported prompts schemaVersion ${String(w.schemaVersion)}` };

package/dist/router/route-orchestration.js

@@ -19,7 +19,7 @@
  * router's chosen arm per trap; the objective hidden-test oracle confirms danger→SUP prevents + competent→single
  * is not-worse) BEFORE it is wired into the live task path — never ship an unvalidated router.
  */
-import { canonicalToolName } from "@sema-agent/core";
+import {} from "@sema-agent/core";
 /**
  * The routing decision (pure). Order matters: explicit caller choice first, then (a) danger, then (b) structural,
  * else the single default. `team` is NEVER produced here — it only ever appears via {@link RoutingSignals.explicitMode}.
@@ -105,7 +105,7 @@ export function isIsolatedExecEnv(provider, runtimeClass) {
  *  a notebook ungated (the exact "write tool bypasses the SUP gate" hole the review-HIGH closed for Edit/Write).
  *  Curated, NOT derived from HAND_TOOL_EFFECTS: that taxonomy is replay-safety (Write="idempotent"; Bash="write" but
  *  shell-gated), not "is an fs mutation". CANONICAL names only (core 1.202 retired MultiEdit into an Edit alias —
- *  `canonicalToolName` in the check below folds a replayed legacy "MultiEdit" call onto "Edit", so batch edits stay
+ *  (5.0.0:折叠面退役——重放的旧名调用由 core roster 层响亮 miss,不再折到 "Edit";raw 直比)
  *  gated without a stale alias entry here). */
 const WRITE_HAND_TOOLS = new Set(["Edit", "Write", "NotebookEdit"]);
 /**
@@ -119,7 +119,7 @@ const WRITE_HAND_TOOLS = new Set(["Edit", "Write", "NotebookEdit"]);
 export function supPostureOverrides() {
     const ask = (toolName) => ({ action: "ask", message: `${toolName} gated by supervisor routing (capability-danger task)`, decisionReason: "rule" });
     const writeGate = {
-        check: (req) => (WRITE_HAND_TOOLS.has(canonicalToolName(req.toolName)) ? ask(req.toolName) : { action: "allow" }),
+        check: (req) => (WRITE_HAND_TOOLS.has(req.toolName) ? ask(req.toolName) : { action: "allow" }),
     };
     return { shellGate: "always", toolPolicy: writeGate };
 }

package/dist/run-local.js

@@ -30,7 +30,8 @@ import { Runner, uuidv7, parseModelMention, FileStorageBackend, NodeLspManager,
 import { createBrain } from "./brain.js";
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
-import { validatePromptsDomain, applyCatalogToSource, CORE_ENGINE_VERSION } from "./capabilities/center-prompts.js";
+import { applyCatalogToSource } from "./capabilities/center-prompts.js";
+import { validatePromptsDomain, CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
 import { loadConfig, logConfigDiagnostics, numEnv } from "./config.js";
 import { createConfigProvider } from "./config-provider.js";
 import { applyEffective, resolveMcpServers, mcpForScenario } from "./config-center/facade.js";
@@ -40,7 +41,8 @@ import { loadSkills } from "./capabilities/skills.js";
 import { GiteaClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
 import { buildScenarios, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
-import { HttpError, memoryEngineBackendFor, memorySpecForRequest } from "./security.js";
+import { HttpError } from "./security.js";
+import { memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
 import { buildPricing } from "./budget.js";
 import { createKeyResolver } from "./key-resolver.js";
@@ -395,7 +397,6 @@ export async function runLocal(argv, deps = {}) {
     const webSearch = webSearchCfg ? createWebSearchBackend(webSearchCfg) : undefined;
     const scenarioDeps = {
         runner, subRunner, model: "default", skills, repoClient, metrics, logger,
-        oaApiBaseUrl: config.oaApiBaseUrl, oaServiceToken: config.oaServiceToken, oaIssue: config.oaIssue,
         ...(webSearch ? { webSearch } : {}),
         brandIdentity: true, // run-local is always a local/TOC deployment → brand the default scenario as Sema.
     };
@@ -411,7 +412,7 @@ export async function runLocal(argv, deps = {}) {
     const requested = args.scenario ?? config.defaultScenario;
     const scenarioName = scenarios[requested] ? requested : "default";
     // A scenario may THROW HttpError synchronously when a prerequisite is unmet (e.g. `scan` needs
-    // GIT_API_BASEURL + a repo; `oa` needs OA_* + an authenticated principal — neither of which a one-shot CLI
+    // GIT_API_BASEURL + a repo — which a one-shot CLI may not
     // supplies). The server catches this in resolveSpec/prepareSpec and returns a clean 4xx; here we mirror that
     // with the doctor-style UX (message to stderr + exit 2) instead of letting it bubble to the fatal exit-1 path.
     let cap;

package/dist/runs.js

@@ -65,10 +65,12 @@ export async function backgroundAgentOutput(registry, handle, access, agentStore
  *  onServedTerminal (ack the completion as served) and suppress the workflow completion push. Refusals
  *  return the registry's own not_found shape, indistinguishable from an unknown handle (the route 404s it). */
 const TASK_HANDLE_KINDS = new Set(["background_bash", "monitor", "background_agent"]);
-/** 1.250 复审 F1(HIGH):durable 回落的**形判门**——`getAccessibleTask` 是精确键(不 trim、不查 legacy
- *  别名),而 core `pollTask/stopTask` 是通用解析面(先 trim、`resolveInternal` 含 legacyToTaskId、
- *  stopTask 还有 byName 臂)。裸 `!row` 回落会让垫充空白句柄(" "+wfId)/legacy shellId/agent 名字从
- *  回落缝穿进 live 分支——kind 门要防的 onServedTerminal/游标消费/按名 stop 全部复活(复审实测复现)。
+/** 1.250 复审 F1(HIGH):durable 回落的**形判门**——`getAccessibleTask` 是精确键(不 trim、不查
+ *  别名),而 core `pollTask/stopTask` 是通用解析面(先 trim;[2380] RB-479-A②:`legacyToTaskId`
+ *  shellId 索引已随 5.0.0 整族删,b* task_id 是唯一 registry 地址——本门防的「legacy shellId 穿缝」
+ *  一臂如今在 core 层就响亮 not_found;stopTask 仍有 byName 臂)。裸 `!row` 回落会让垫充空白句柄
+ *  (" "+wfId)/agent 名字从回落缝穿进 live 分支——kind 门要防的 onServedTerminal/游标消费/按名 stop
+ *  全部复活(复审实测复现)。
  *  只有 **a\* 精确形**才回落:`DURABLE_AGENT_HANDLE_RE` = core 公共导出(core 1.369,[1518] ask 即答
  *  ——两边判词同源,镜像私拷已删)。残余(documented):恰为 a\* 形的 agent **名字**
  *  在无 durable 行时仍会进 core stopTask 的 byName 臂——同 access 元组内、名字域与句柄域同形的病态窄面,
@@ -526,8 +528,8 @@ promptManifests) {
             // the top stream NEVER carries it), so this sink is the ONLY path a tick reaches the top-run consumers. 1.78
             // (review HIGH): fan it out to the DURABLE event log too (via the shared whitelist+redact builder, fire-and-
             // forget — `++seq` is a sync increment so sink-vs-loop appends get unique seqs), not just the fleet bus —
-            // previously no fleet bus wired ⇒ ticks dropped entirely, and the stream-switch task_progress case below is
-            // forward-compat only (dead against core ≤1.208). core swallow-guards a throwing sink.
+            // previously no fleet bus wired ⇒ ticks dropped entirely, and the stream-switch task_progress case below was
+            // forward-compat then — [2373]B-4:floor ^4.0.0 下它是热路径(腐注方向已翻转,勿按旧注当死支)。core swallow-guards a throwing sink.
             const fwdInternals = {
                 onForwardEvent: (e) => {
                     fleetPublisher?.onForwardEvent(e);

package/dist/runtime-caps-resolver.d.ts

@@ -68,8 +68,9 @@ export interface EntitlementsResolverOpts {
  *
  *  `autoMode`(core 1.276.0 `RuntimeCaps.autoMode`):auto-mode 分类器 per-principal
  *  开闸线,极性同 allowObservers(`=== true` 显式 opt-in,默认 OFF;真执行还要 deployment 装配
- *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。registry-core 类型未收编
- *  → unknown 宽读透传(allowObservers 0.10.2 期同款先例);center 发键即活。 */
+ *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。[2373]B-6a:registry-core
+ *  0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps(types.d.ts:1786)——宽读逃逸期结束,现为类型直读
+ *  (allowObservers 同款收编先例)。 */
 export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | undefined): RuntimeCaps | undefined;
 /** A MISCONFIG diagnostic (review MEDIUM): a worker-scoped `wpt_<self>` pull token REQUIRES `?worker=<self>` to
  *  resolve per-principal caps — so a `wpt_` token with NO `SEMA_REGISTRY_WORKER` set will 403

package/dist/runtime-caps-resolver.js

@@ -20,13 +20,13 @@ const defaultLogger = createLogger();
  *
  *  `autoMode`(core 1.276.0 `RuntimeCaps.autoMode`):auto-mode 分类器 per-principal
  *  开闸线,极性同 allowObservers(`=== true` 显式 opt-in,默认 OFF;真执行还要 deployment 装配
- *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。registry-core 类型未收编
- *  → unknown 宽读透传(allowObservers 0.10.2 期同款先例);center 发键即活。 */
+ *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。[2373]B-6a:registry-core
+ *  0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps(types.d.ts:1786)——宽读逃逸期结束,现为类型直读
+ *  (allowObservers 同款收编先例)。 */
 export function toCoreRuntimeCaps(ent) {
     if (!ent)
         return undefined;
-    // 宽读(additive wide-read):registry-core 0.10.3 类型未含 autoMode,center 下发先行时走 unknown 读。
-    const autoMode = ent.autoMode;
+    const autoMode = ent.autoMode; // [2373]B-6a:0.13.0 类型直读(宽读逃逸已收编)
     const badCap = (v) => v !== undefined && typeof v !== "boolean";
     if (badCap(ent.allowWorkflows) || badCap(ent.forceDurableGate) || badCap(ent.allowFork) || badCap(ent.allowObservers) || badCap(autoMode)) {
         throw new Error("runtimeCaps from center carries a non-boolean cap (contract breach — fail closed)");

package/dist/runtime-governance.d.ts

@@ -29,13 +29,10 @@ export type CommandRule = {
     command: string;
     decision: "allow" | "ask" | "deny";
 };
-/** True when `name` names a DELEGATION tool — the subagent tool (CC-187 canonical `"Agent"`, core 1.202
- *  `DEFAULT_SUBAGENT_TOOL_NAME`; legacy alias `"Task"`). CANONICAL-space compare (`canonicalToolName`) so both
- *  spellings match — the pre-1.202 raw `!== "Task"` compare in the read-only strip (main.ts) silently stopped
- *  matching when core renamed the tool (fail-open: a plan-mode / hands-read-only parent could delegate to a
- *  WRITABLE-hands child, because core does not propagate handsReadOnly to a delegated child).
- *  core 1.257 (design/136 BREAKING): the standalone `Fork` tool is retired — a fork is now
- *  `Agent(subagent_type:"fork")`, i.e. an Agent call, already matched by DEFAULT_SUBAGENT_TOOL_NAME. */
+/** True when `name` names a DELEGATION tool — the subagent tool(CC-187 canonical `"Agent"`,core
+ *  `DEFAULT_SUBAGENT_TOOL_NAME`)。5.0.0 RB-476:折叠面退役,RAW 比对 core 单源常量——旧名("Task")
+ *  在 core roster 层响亮 miss,不再需要归一;单源常量本身就防了当年 1.202 改名时裸字符串失配的
+ *  fail-open(那个教训的解=引用常量,不是折叠)。 */
 export declare function isDelegationToolName(name: string): boolean;
 /** The hands-read-only DELEGATION STRIP (the main.ts governed-spec site, extracted here so the actual filter —
  *  not just the name predicate — is pinned by tests): core does not propagate `handsReadOnly` to a delegated

package/dist/runtime-governance.js

@@ -23,17 +23,13 @@
  * path-prefixed commands all bypass the argv[0] match (they route to `ask`, fail-closed, but are not blocked by
  * name). Real isolation is the `executionEnv` sandbox. Same caveat core documents on `createCoarseCommandNamePolicy`.
  */
-import { canonicalToolName, combinePolicies, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
-/** True when `name` names a DELEGATION tool — the subagent tool (CC-187 canonical `"Agent"`, core 1.202
- *  `DEFAULT_SUBAGENT_TOOL_NAME`; legacy alias `"Task"`). CANONICAL-space compare (`canonicalToolName`) so both
- *  spellings match — the pre-1.202 raw `!== "Task"` compare in the read-only strip (main.ts) silently stopped
- *  matching when core renamed the tool (fail-open: a plan-mode / hands-read-only parent could delegate to a
- *  WRITABLE-hands child, because core does not propagate handsReadOnly to a delegated child).
- *  core 1.257 (design/136 BREAKING): the standalone `Fork` tool is retired — a fork is now
- *  `Agent(subagent_type:"fork")`, i.e. an Agent call, already matched by DEFAULT_SUBAGENT_TOOL_NAME. */
+import { combinePolicies, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
+/** True when `name` names a DELEGATION tool — the subagent tool(CC-187 canonical `"Agent"`,core
+ *  `DEFAULT_SUBAGENT_TOOL_NAME`)。5.0.0 RB-476:折叠面退役,RAW 比对 core 单源常量——旧名("Task")
+ *  在 core roster 层响亮 miss,不再需要归一;单源常量本身就防了当年 1.202 改名时裸字符串失配的
+ *  fail-open(那个教训的解=引用常量,不是折叠)。 */
 export function isDelegationToolName(name) {
-    const c = canonicalToolName(name);
-    return c === DEFAULT_SUBAGENT_TOOL_NAME;
+    return name === DEFAULT_SUBAGENT_TOOL_NAME;
 }
 /** The hands-read-only DELEGATION STRIP (the main.ts governed-spec site, extracted here so the actual filter —
  *  not just the name predicate — is pinned by tests): core does not propagate `handsReadOnly` to a delegated
@@ -77,10 +73,9 @@ function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
     const ask = (message) => ({ action: "ask", message, decisionReason: "rule" });
     return {
         check(req) {
-            // Out of scope for non-shell tools: this gate only speaks about shell command names. Canonical-space
-            // lookup ("Bash" has no alias today — identity; uniform with every other service policy face, so a
-            // future core alias or a pre-rename durable replay can't slip the gate).
-            if (!shellTools.has(canonicalToolName(req.toolName)))
+            // Out of scope for non-shell tools: this gate only speaks about shell command names. RAW(5.0.0):
+            // live 名恒 canonical,pre-rename 重放由 core 响亮拒——折叠臂退役。
+            if (!shellTools.has(req.toolName))
                 return { action: "allow" };
             const command = req.args?.command;
             if (typeof command !== "string")
@@ -100,9 +95,9 @@ function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
  *  (letters/digits and `. _ - +`, covering `python3.11`/`docker-compose`/`g++`) and reject the rest FAIL-LOUD at
  *  config-apply. 🔴 Kept ALIGNED with the `@sema-agent/registry-core` contract-layer regex (center fixed the
  *  glob→exact contract bug in 0.1.26 + publish-validates with this SAME pattern) so the contract gate and this
- *  defense-in-depth gate agree. The dep is
- *  `^0.1.26` (additive-compatible), so an additive contract bump stays aligned; a contract regex CHANGE would
- *  need this updated in lockstep (the two layers are coupled by design, not by a frozen byte-equality guarantee). */
+ *  defense-in-depth gate agree. [2373]B-11:旧注靠「dep=^0.1.26 additive 窗」论证对齐,地板抬到 ^0.13.0 后
+ *  该论证失效——现由机器钉逐字节对表(test/runtime-governance.test.ts 读安装包正则比对),lockstep 不再
+ *  是注释请求。2026-08-02 亲核 0.13.0 dist/types.js:703:两正则逐字节相同。 */
 const VALID_COMMAND_NAME = /^[A-Za-z0-9._+-]+$/;
 /** The three legal per-command decisions (mirrors the registry `runtime.commandPolicy[].decision` enum). */
 const VALID_DECISIONS = new Set(["allow", "ask", "deny"]);

package/dist/sealed-key.d.ts

@@ -76,7 +76,7 @@ export declare function ensureSealedKeyStore(dir: string, logger?: Logger): Prom
  *
  * HONESTY over fake automation: that endpoint is ADMIN-gated, and a fleet worker only holds
  * SERVICE_PULL_TOKEN — so automatic registration works ONLY when the operator deliberately provides
- * an admin token (SEMA_REGISTRY_ADMIN_TOKEN / REGISTRY_ADMIN_TOKEN in this service's env). Without
+ * an admin token (SEMA_REGISTRY_ADMIN_TOKEN in this service's env; the REGISTRY_ADMIN_TOKEN alias was tombstoned in 5.0.0). Without
  * one we do the next-best REAL thing: print the FULL public key + id at boot (a public key is not a
  * secret) with the exact registration instructions, and warn that the web "paste key" face stays
  * dark for this host until an admin registers it. Never throws (fire-and-forget from boot).

package/dist/sealed-key.js

@@ -150,7 +150,7 @@ export async function ensureSealedKeyStore(dir, logger) {
  *
  * HONESTY over fake automation: that endpoint is ADMIN-gated, and a fleet worker only holds
  * SERVICE_PULL_TOKEN — so automatic registration works ONLY when the operator deliberately provides
- * an admin token (SEMA_REGISTRY_ADMIN_TOKEN / REGISTRY_ADMIN_TOKEN in this service's env). Without
+ * an admin token (SEMA_REGISTRY_ADMIN_TOKEN in this service's env; the REGISTRY_ADMIN_TOKEN alias was tombstoned in 5.0.0). Without
  * one we do the next-best REAL thing: print the FULL public key + id at boot (a public key is not a
  * secret) with the exact registration instructions, and warn that the web "paste key" face stays
  * dark for this host until an admin registers it. Never throws (fire-and-forget from boot).

package/dist/security.d.ts

@@ -3,8 +3,6 @@ import { type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
 import type { TaskRequestBody } from "./http/wire-types.js";
 import type { StagingHandle } from "./session-sync-kernel.js";
-export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
-export type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 /** One row of the session-list projection (CC /resume picker) — the durable session abstraction's enumeration
  *  output (§0.5). Mirrors {@link RunStore}'s shipped `SessionSummary` shape so the wire response is unchanged. */
 export interface SessionListItem {
@@ -215,7 +213,4 @@ export declare function ssoVerifiedPrincipal(req: IncomingMessage): string | und
 export declare function setSsoScope(req: IncomingMessage, scope: string): void;
 export declare function ssoVerifiedScope(req: IncomingMessage): string | undefined;
 export declare function verifiedPrincipal(req: IncomingMessage, config: ServiceConfig): string | undefined;
-export { memoryScopeFor, memoryEngineRemoteLanePosture, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
-export { approvalHmacMessage, MAX_APPROVAL_REASON_CHARS, verifyApprovalHmac } from "./approval-hmac.js";
-export { verifyPrincipalJwt, approvalBnd, verifyDirectDoorProof } from "./principal-jwt.js";
 //# sourceMappingURL=security.d.ts.map

package/dist/security.js

@@ -3,9 +3,8 @@ import { PROJECT_ID_REGEX } from "@sema-agent/registry-core";
 // design/158 A4: the env→key-set decoders (parseApprovalHmacKeys / parsePrincipalJwks + their row types) moved to
 // the leaf ./auth-keys.js so config.ts's env-load no longer value-imports this whole auth module (lens2 §F). The
 // verifiers that consume the parsed key-sets now live in ./approval-hmac.js / ./principal-jwt.js (design/158 A13);
-// the four names are RE-EXPORTED for compat.
-export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
-import { memoryScopeFor } from "./memory-scope.js"; // design/158 N17: see re-export block below (moved to ./memory-scope.js)
+// import all four names from ./auth-keys.js directly ([2354] 兼容面全清 — the compat re-export here is gone).
+import { memoryScopeFor } from "./memory-scope.js"; // design/158 N17: moved to ./memory-scope.js (this file's createAuthorizer still calls it)
 // design/158 A13: the approval-envelope HMAC (integrity) group and the principal-JWT/direct-door (identity)
 // group moved VERBATIM to ./approval-hmac.js and ./principal-jwt.js respectively — this file's own
 // `verifiedPrincipal` still calls verifyPrincipalJwt for the direct-door branch (value import below); every
@@ -333,15 +332,12 @@ export function verifiedPrincipal(req, config) {
 }
 // design/158 N17: memoryScopeFor / memoryEngineRemoteLanePosture / memoryEngineBackendFor / memorySpecForRequest
 // moved VERBATIM to the leaf ./memory-scope.js (security.ts's name says auth; these four resolve memory-plane
-// config, unrelated). Re-exported here so existing importers (main.ts, config.ts, http/server.ts, run-local.ts,
-// index.ts, tests) keep working untouched — this file's own createAuthorizer below still calls memoryScopeFor.
-export { memoryScopeFor, memoryEngineRemoteLanePosture, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
-// design/158 A13: approval-envelope HMAC (integrity, {@link verifyApprovalHmac}/{@link approvalHmacMessage}/
-// MAX_APPROVAL_REASON_CHARS) and principal-JWT/direct-door proof (identity, {@link verifyPrincipalJwt}/
+// config, unrelated). Import them from ./memory-scope.js directly ([2354] 兼容面全清 — the compat re-export here
+// is gone); this file's own createAuthorizer below still calls memoryScopeFor.
+// design/158 A13: approval-envelope HMAC (integrity, verifyApprovalHmac/approvalHmacMessage/
+// MAX_APPROVAL_REASON_CHARS) and principal-JWT/direct-door proof (identity, verifyPrincipalJwt/
 // approvalBnd/verifyDirectDoorProof) moved VERBATIM to ./approval-hmac.js and ./principal-jwt.js — this file
 // keeps only the authenticator/principal-shape/SSO-mount group (createAuthorizer, verifiedPrincipal,
-// assertPrincipalShape, principalFrom, setSsoPrincipal/setSsoScope) plus this re-export so existing
-// importers of the moved names keep working unchanged.
-export { approvalHmacMessage, MAX_APPROVAL_REASON_CHARS, verifyApprovalHmac } from "./approval-hmac.js";
-export { verifyPrincipalJwt, approvalBnd, verifyDirectDoorProof } from "./principal-jwt.js";
+// assertPrincipalShape, principalFrom, setSsoPrincipal/setSsoScope). Import the moved names from their
+// new homes directly ([2354] 兼容面全清 — the compat re-exports here are gone).
 //# sourceMappingURL=security.js.map

package/dist/session-sync.d.ts

@@ -30,8 +30,6 @@ export interface FileSnapshotImportFace {
  *  seam is absent (an older/in-memory dev store). Callers gate on the RETURN VALUE, not a separate `typeof` check,
  *  so there is exactly one place that knows the shape of the probe. */
 export declare function fileSnapshotImportFace(fs: unknown): FileSnapshotImportFace | undefined;
-export { stagingIdFor, STAGING_ID_MARKER, realIdOfStaging, classifySyncRelationship, classifySyncRelationshipByIds, SyncConflictError } from "./session-sync-kernel.js";
-export type { StagingHandle, ImportStagingStore, SyncRelation } from "./session-sync-kernel.js";
 /**
  * The portable state of ONE session, ready to replay into another backend. Blobs are deliberately NOT inlined
  * (§5: a turn's working-tree blobs can be tens of MiB → OOM/413 if buffered); each snapshot carries only its