@sema-agent/server 4.3.0 → 5.0.1

package/README.md

@@ -173,7 +173,7 @@ One row per endpoint family (not exhaustive):
 | `POST /v1/runs` · `GET /v1/runs/:id` | Asynchronous runs: immediate `202`, background execution, poll for status/result |
 | `GET /v1/runs/:id/events` | Replayable SSE (`Last-Event-ID` resume); any replica can serve any run |
 | `POST /v1/runs/:id/cancel` / `steer` / `compact` · `/v1/runs/:id/subagents/:target/steer` / `resume` | Run control verbs: cooperative cancel, mid-run steering, context compaction, sub-agent steering/resume |
-| `/v1/approvals` (list · get · decide · stream) | Human-in-the-loop approval center backed by durable checkpoints; decisions from any replica |
+| `/v1/approvals` (list · decide · stream) | Human-in-the-loop approval center backed by durable checkpoints; decisions from any replica |
 | `/v1/sessions` (list · get · fork · init · settings · wake) | Session listing/search, audit inspection, fork, startup bundle |
 | `/v1/workflows` (list · get · stream · agents/:label/steer) | Deterministic workflow orchestration runs with live streams and per-agent steering |
 | `GET /v1/usage` · `GET /v1/policy` | Cumulative spend (when quotas are configured) and effective policy read surface |

package/README.zh-CN.md

@@ -164,7 +164,7 @@ curl -s localhost:8090/v1/tasks -H "Authorization: Bearer <SERVICE_AUTH_TOKEN>"
 | `POST /v1/runs` · `GET /v1/runs/:id` | 异步 run:立即 `202`,后台续跑,轮询状态/结果 |
 | `GET /v1/runs/:id/events` | 可重放 SSE(`Last-Event-ID` 续订);任意副本可服务任意 run |
 | `POST /v1/runs/:id/cancel` / `steer` / `compact` · `/v1/runs/:id/subagents/:target/steer` / `resume` | run 控制动词:协作式取消、运行中转向、上下文压缩、子智能体转向/恢复 |
-| `/v1/approvals`(list · get · decide · stream) | 人工审批中心,底座是持久化检查点;任意副本都能批复 |
+| `/v1/approvals`(list · decide · stream) | 人工审批中心,底座是持久化检查点;任意副本都能批复 |
 | `/v1/sessions`(list · get · fork · init · settings · wake) | 会话列表/检索、审计回溯、fork、启动包 |
 | `/v1/workflows`(list · get · stream · agents/:label/steer) | 确定性 workflow 编排 run,带实时流与逐 agent 转向 |
 | `GET /v1/usage` · `GET /v1/policy` | 累计花费(配置配额时)与生效策略只读面 |

package/USAGE.md

@@ -44,11 +44,11 @@ docker compose up --build --scale service=4     # 4 个无状态 worker，nginx
 # ① 同协议冗余:主网关挂(连不上/上游开始前就失败)→ 按序切到备网关(同一 model id)
 MODEL_GATEWAY_BASEURL=http://gw-a:8000/v1  MODEL_GATEWAY_FALLBACK_URLS=http://gw-b:8000/v1,http://gw-c:8000/v1
 # ② 云 Anthropic 路由:provider="anthropic" 的模型走云 /v1/messages(带 prompt 缓存断点),其余走本地网关
-ANTHROPIC_API_KEY=sk-ant-…   # 可选:ANTHROPIC_BASEURL / ANTHROPIC_VERSION / ANTHROPIC_CACHE_BREAKPOINTS=true
+ANTHROPIC_API_KEY=sk-ant-…   # 可选:ANTHROPIC_BASE_URL / ANTHROPIC_VERSION / ANTHROPIC_CACHE_BREAKPOINTS=true
 ```
 - 两个变量都不设 = 和以前**逐字节一致**(单网关)。
 - **failover ≠ Anthropic↔vLLM**:failover 给所有 brain 发**同一个 model**(同协议同 id 的冗余);云↔本地是**按 `model.provider` 路由**的选择,不是故障转移(两者 model id/参数不同,不能透明互切)。设 `MODEL_PROVIDER=anthropic` + `MODEL_ID=claude-…` 让整个服务走 Anthropic。
-- **缺省推断**:`MODEL_PROVIDER` **未设**、但显式配了 Anthropic 协议 base URL(`ANTHROPIC_BASE_URL` 或 `ANTHROPIC_BASEURL`)**和**对应凭证(`ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN`)时,缺省自动判 `anthropic` 并打一行启动 warn(`model_provider_inferred`)——纯净机直连 Anthropic 兼容上游不再需要显式第七个键。显式 `MODEL_PROVIDER` 恒赢;只给 base URL 或只给凭证不推断;两者皆无 = `gateway`,与以前逐字节一致。
+- **缺省推断**:`MODEL_PROVIDER` **未设**、但显式配了 Anthropic 协议 base URL(`ANTHROPIC_BASE_URL`)**和**对应凭证(`ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN`)时,缺省自动判 `anthropic` 并打一行启动 warn(`model_provider_inferred`)——纯净机直连 Anthropic 兼容上游不再需要显式第七个键。显式 `MODEL_PROVIDER` 恒赢;只给 base URL 或只给凭证不推断;两者皆无 = `gateway`,与以前逐字节一致。
 - 启动日志的 `brain` 字段会回显当前组合(`failover` / `anthropicRoute` / `anthropicCacheBreakpoints`)。详见 `design/15`。
 
 **可选 — 韧性栈:分级超时 + 断路器(core 1.38，叠在 failover 之下)**
@@ -66,7 +66,7 @@ ANTHROPIC_MAX_RETRIES=10             # 云 Anthropic 腿
 - **全部默认关**(超时=0、断路器=false)→ 不设就和以前**逐字节一致**。
 - 断路器**只在配了 `MODEL_GATEWAY_FALLBACK_URLS`(≥2 路)时才有意义**——它的价值是"开路即快速失败 → failover 立刻切备";单网关下它是 no-op(启动日志 `circuitBreakerNoop` 会提示)。只 `network/server/rate_limit` 计入连败,`auth`/`invalid_request` 不计(坏 key 熔断整网关无意义)。备用网关(最后一路)不套断路器。
 - **重试上限**(2026-07-31):两个键**不设就不传给引擎** —— 引擎默认当家。以前这里是 server 侧硬编码 `2`(openai 腿甚至零配置出口),而**显式传参压过引擎默认**,于是引擎抬默认对 server 部署毫无效果;第三方限流 provider 下"重试两次就放弃"正是由此而来。现在:不设=继承引擎默认(抬默认那天自动跟上),设了=按设的走。钉在 `test/brain.test.ts` 的「网关腿重试次数」两条上。
-- 断路器状态:配了 `SESSION_BACKEND=tidb` 时自动用**跨副本共享态**(TiDB `circuit_breaker` 表,写穿+刷新最终一致),否则进程内 Map。启动日志 `breakerState` 字段回显 `shared(tidb)`/`in-process`/`off`。详见 `design/27`。
+- 断路器状态:配了 `SESSION_BACKEND=mysql` 时自动用**跨副本共享态**(SQL `circuit_breaker` 表,写穿+刷新最终一致),否则进程内 Map。启动日志 `breakerState` 字段回显 `shared(mysql)`/`in-process`/`off`。详见 `design/27`。
 
 **可选 — WebSearch 后端(core 只留注入口,不自带任何 provider)**
 ```bash
@@ -97,7 +97,10 @@ MAX_PRINCIPAL_COST_USD=5.00   COST_QUOTA_WINDOW_SEC=86400   # 0/不设 = 不限;
 MODEL_DEGRADE_TO=deepseek-v4-flash
 MODEL_DEGRADE_AT_COST_FRACTION=0.7    # ① 近预算(1.40):累计成本到 0.7×maxCostUsd 切(需任务有 cost ceiling)
 MODEL_DEGRADE_REACTIVE=true           # ② 反应式(1.39):主模型 rate_limit/breaker-open 时切(brain 级,最外层)
-MODEL_DEGRADE_ON=rate_limit,breaker_open   # 可选,反应式触发器子集;默认两者都开
+MODEL_DEGRADE_ON=rate_limit,breaker_open   # 可选,反应式触发器子集;词表=breaker_open|rate_limit|budget|server_error|last_resort
+# ⚠️ core 5.1.0 起,不设 MODEL_DEGRADE_ON 时引擎默认全集**含 server_error 与 last_resort**
+#    (主模型 5xx、以及兜底的一般 http 错误类也切便宜模型)。
+#    不想要这两类触发就显式设回 rate_limit,breaker_open。拼错词 boot 拒启(不静默忽略)。
 ```
 - 反应式降级 brain 包在**最外层**(core council #8);fallback brain 用自己的凭据(decorator 清掉主模型的 per-call key 防泄漏给别的 provider)。**坑**:`MODEL_DEGRADE_TO` 最好别和被限流的是同一网关/账号,否则反应式切过去照样撞同一个 rate_limit。
 - **定价怎么设**:`model.cost` 来自 `MODEL_COST_INPUT/OUTPUT/CACHE_READ/CACHE_WRITE`(**USD per 1M tokens**,默认 0 = `costUsd` 读 0)。云模型(如 review-gw 的 deepseek-v4-pro)必须设,否则 spend 恒为 $0;本地自托管(qwen)留 0 即对(无 per-token 外部花费)。字段名是 `costUsd`,**非美元计价的网关要先折算**(如 DeepSeek 官方 CNY ÷ 汇率)。配置控制面管的模型走 `CenterModel.cost`(中心存价、不存 secret)。
@@ -106,8 +109,8 @@ MODEL_DEGRADE_ON=rate_limit,breaker_open   # 可选,反应式触发器子集;默
 - **`METRICS_TOKEN`**(可选,只读):设了它,`GET /metrics`+`/metrics/summary` 接受**它或** `SERVICE_AUTH_TOKEN`。**全 fleet 设同一个值** → 管理端(sema-web,规划名 sema-admin)用**一个** token 拉所有 worker 的指标,**无需持有各 worker 的全权 `SERVICE_AUTH_TOKEN`**(不破坏 secret 边界)。即使泄露也只暴露指标(只读)。
 - **`GET /metrics/summary`**(token-gated,同 `/metrics`):`/metrics` 的**精炼 JSON**——`{model, runsActive, tasks{status}, tokensTotal, costUsd, costUsdByModel, taskDurationAvgSec, brainFirstTokenAvgMs, brainCallAvgMs, cacheHitRateAvg, rateLimited, costQuotaRejected, budgetExceeded, degraded, cascade, verifications, councilRuns, toolErrors}`。给**轻量 fleet 看板**用(管理端 sema-web 的 fleet 页按 worker 拉、渲染卡片、按轮询算速率;**不用 Prometheus/Grafana**)。counter 是累计值、histogram 报均值。
 - 预算闸是 core 强制的:`maxCostUsd` pre-call 估算(`budget.precall`,没花钱就拒)+ 流中途取消 + turn 边界(`budget.exceeded`);`maxTokens` 超 → `budget.exceeded`。**review 网关**建议设 `MAX_TASK_COST_USD` 防单任务烧掉共享云 key。
-- **per-principal 累计配额**:用 `AsyncLocalStorage` 把 principal 透传到 cost tracer,所以**council/team 子任务的花费也算到发起人头上**。**配了 `SESSION_BACKEND=tidb` 时自动跨副本共享**(`cost_quota` 表,写后聚合的**原子自增** `micro=micro+delta`,对齐固定窗,最终一致——多副本花费 SUM 到一起、不丢增量);否则 in-memory per-replica 滚动窗(单副本兜底)。启动日志 `costQuota` 字段回显 `shared(tidb)`/`in-process`/`off`。跨副本是最终一致(flush 间隔内峰值可能略超,由**硬 per-task `maxCostUsd` 兜底**)。
-- **`RATE_LIMIT_RPM` 请求限流同样自动跨副本**(`SESSION_BACKEND=tidb` 时,`rate_limit` 表,与配额共用 `WriteBehindCounter`;启动日志 `rateLimit` 回显)。注意:写后聚合 = **软限流**(边界上短暂略超 OK,适合公平/热调用方防护);要**硬合规上限**得另走 CAS/原子计数,不靠写后聚合——和断路器跨副本同款权衡。
+- **per-principal 累计配额**:用 `AsyncLocalStorage` 把 principal 透传到 cost tracer,所以**council/team 子任务的花费也算到发起人头上**。**配了 `SESSION_BACKEND=mysql` 时自动跨副本共享**(`cost_quota` 表,写后聚合的**原子自增** `micro=micro+delta`,对齐固定窗,最终一致——多副本花费 SUM 到一起、不丢增量);否则 in-memory per-replica 滚动窗(单副本兜底)。启动日志 `costQuota` 字段回显 `shared(mysql)`/`in-process`/`off`。跨副本是最终一致(flush 间隔内峰值可能略超,由**硬 per-task `maxCostUsd` 兜底**)。
+- **`RATE_LIMIT_RPM` 请求限流同样自动跨副本**(`SESSION_BACKEND=mysql` 时,`rate_limit` 表,与配额共用 `WriteBehindCounter`;启动日志 `rateLimit` 回显)。注意:写后聚合 = **软限流**(边界上短暂略超 OK,适合公平/热调用方防护);要**硬合规上限**得另走 CAS/原子计数,不靠写后聚合——和断路器跨副本同款权衡。
 
 **可选 — 生成调参透传 + 退化打捞（core 1.59/1.60）**
 ```bash
@@ -170,14 +173,11 @@ MODEL_CASCADE_LADDER=deepseek-flash,deepseek-pro   # 目录里的模型名,cheap
 
 **监听绑址(1.306+,[1934])—— 桌面/单机形请注意**
 - `BIND_HOST` = 监听地址;显式设置**恒生效**(要在无鉴权下对外暴露,显式写 `BIND_HOST=0.0.0.0` 即可)。
-- `HOST` 是兼容别名,但**不完全等价**(3.15.0 起):它常被 shell 继承(zsh 默认把 `HOST` 设成机器名),
-  所以当下面那条自动收窄的条件成立时,**收窄压过 `HOST`** —— 否则一个用户从没设过的 shell 变量就能
-  把无鉴权写面静默扩到 LAN。被压过时 boot 日志打 `bind_host_from_HOST_env_overridden`,点名被忽略的
-  值与两条逃生口(显式 `BIND_HOST`,或给写面配 token)。收窄条件不成立时 `HOST` 与从前完全一样。
+- `HOST` 不再被读取(曾经的兼容别名已撤——zsh 默认把 `HOST` 设成机器名的暗通道风险已消除):
+  绑址唯一口 = `BIND_HOST`,设或不设都与 `HOST` 环境变量的值无关。
 - **缺省自动收窄**:当写面无鉴权时(`ALLOW_UNAUTHED_WRITES=true` 且**完全没有**
   `SERVICE_AUTH_TOKEN`/TOKENS 名录)⇒ 自动绑 `127.0.0.1`,boot 日志点名原因。理由:该形常配
-  `REMOTE_EXEC=host`(用户真机、非沙箱),绑全接口=同网段任何人可无鉴权提交任务并执行(1.305 及以前
-  `HOST` env **零消费**、恒绑所有接口——沉默陷阱,已修)。
+  `REMOTE_EXEC=host`(用户真机、非沙箱),绑全接口=同网段任何人可无鉴权提交任务并执行。
 - 配了凭证的部署(云形/k8s/compose)缺省**不变**(全接口),既有部署零影响。
 
 **workspace 浏览面(1.299+,#3)—— 任务产出的浏览/预览/打包下载**
@@ -211,7 +211,7 @@ SEND_USER_FILE_SANDBOX_PUT_ENDPOINT=…         # 可选:沙箱直传 PUT 的端
 
 **可选 — 接配置控制面(中心化模型/角色/团队配置)**
 ```bash
-# 新名(orchestrator 现注入);旧名 CONFIG_CENTER_* 仍兼容(dual-read,新名优先、旧名回退)
+# 新名(orchestrator 现注入);旧名 CONFIG_CENTER_* 在场即 boot 拒启,只认 SEMA_REGISTRY_*
 SEMA_REGISTRY_URL=http://<config-center-host>:3100   # 启动拉 GET /api/config/effective(Bearer+ETag),覆盖 env 兜底
 SEMA_REGISTRY_TOKEN=<SERVICE_PULL_TOKEN 的值>   # 取自配置控制面主机 .env;只读拉取令牌
 SEMA_REGISTRY_DRY_RUN=true                     # 安全灰度:只 LOG 中心配置 vs env 推导的差异,不 apply
@@ -373,8 +373,8 @@ curl -N http://<host>:8090/v1/tasks/stream -H 'content-type: application/json' \
 | 端点 | 用途 |
 |---|---|
 | `GET /v1/sessions/<id>` | 审计回溯:当前上下文 + 摘要(owner 校验) |
-| `GET /v1/approvals?owner=user:42` | 高危写审批:**operator** 看待办队列(可按 owner 过滤);非 operator 只看自己的 |
-| `POST /v1/approvals/<id>` `{"decision":"approve"|"deny","reason":"…"}` | 批/否(CAS,重复决议 409);**仅 operator**(非 operator → 403) |
+| `GET /v1/approvals?owner=user:42` | 高危写审批(durable,需 `DURABLE_APPROVAL=true`):**operator** 看待办队列(可按 owner 过滤);非 operator 只看自己的 |
+| `POST /v1/approvals/<sessionId>/decide` `{"decision":"approve"|"deny","reason":"…"}` | 批/否并恢复挂起任务(CAS,重复决议 409);**仅 operator**(非 operator → 403)。5.0.0 起旧轮询腿 `POST /v1/approvals/<id>` 已退役 |
 | `GET /health` | 健康(无需鉴权) |
 | `GET /metrics` | Prometheus 指标(有 token 时需带) |
 
@@ -412,7 +412,7 @@ curl -N http://<host>:8090/v1/tasks/stream -H 'content-type: application/json' \
 | HTTP `403` / `404`(session/run) | 不是该 principal 的资源 | 用正确身份 |
 | HTTP `409`(`/v1/runs`) | 同 session 已有活跃 run | 等它完成 / 用返回的 `activeTaskId` |
 | HTTP `429` | 限流 | 看 `Retry-After` 退避 |
-| HTTP `501`(`/v1/runs`) | 内存模式不支持异步 | 配 TiDB(`SESSION_BACKEND=tidb`) |
+| HTTP `501`(`/v1/runs`) | 内存模式不支持异步 | 配 MySQL 协议存储(`SESSION_BACKEND=mysql`) |
 
 **机器码**:每个 4xx/5xx 响应体都带一个 `errorCode`(与人类文案 `error` 并列),这是**唯一**该拿来做
 程序分支的字段——**别锚 `error` 文案**。前缀族固定:`auth.` / `request.` / `not_found.` / `conflict.` /

package/dist/approval-hmac.js

@@ -1,6 +1,6 @@
 /**
  * design/80 D-G: approval-envelope HMAC (INTEGRITY, not identity). Split out of `security.ts` (design/158
- * A13, internal-lossless — the facade re-exports every symbol below unchanged; verifyDirectDoorProof in
+ * A13; consumers import from HERE — [2354] cleared the security.ts compat re-exports; verifyDirectDoorProof in
  * ./principal-jwt.ts imports {@link verifyApprovalHmac} from here for the combined proof).
  *
  * ✅ WIRED into the resolve path (was "🔴 SCAFFOLD — NOT YET WIRED" — that claim went STALE; a 2026-07-25 doc-rot

package/dist/approval.d.ts

@@ -1,14 +1,9 @@
 /**
- * OA human-in-the-loop approval gate (F4) — a `ToolPolicy` that holds a gated tool call until an
- * operator approves/denies, with the pending state in TiDB so the decision can arrive on any instance.
- *
- * Built on core's `createApprovalPolicy` (which routes requireApproval/deny and races the wait against
- * the task's AbortSignal). Our `approve` records a pending row and polls it for a decision; it also
- * honors the signal directly (marks the request expired and releases) so a never-answered approval is
- * dropped at the task deadline instead of holding the worker — design/06 F4 self-protection.
+ * Human-in-the-loop approval gate (F4) — durable-only since 5.0.0 ([2354]/[2356] A-5:OA 轮询车道
+ * (createOaApprovalPolicy + ApprovalStore pending 行轮询)整体退役;唯一门形 = durable checkpoint
+ * suspend/resume,见 createDurableAskPolicy 与 /v1/approvals 的 checkpointStore 腿)。
  */
 import { type ToolPolicy } from "@sema-agent/core";
-import type { ApprovalStore } from "./plugins/store-backend.js";
 /**
  * 运维**是否表达了门意图** —— boot 的单用户 allow-all 基线只在"零门意图"时才允许铺开,
  * 所以这个谓词漏一格 = 那一格的意图被 allow-all 静默吞掉。
@@ -29,11 +24,24 @@ export declare function hasOperatorGateIntent(config: {
     approvalNeverAuto: readonly string[];
     durableApproval: boolean;
 }): boolean;
+/**
+ * 门意图不可服务=boot 拒启(全窗复审 D3-F1,HIGH;与 env 墓碑族同谱系)。
+ * v4.3.0 的轮询门形(APPROVAL_REQUIRE + DB backend + DURABLE_APPROVAL 未设)在 5.0.0 只剩 core 每任务
+ * warn——**原先拦、现在放**(方向反转)。「留 undefined 让 core warn」对新配置是曝露误配,对升级存量是
+ * 门静默消失,后者必须响亮。放这文件与 hasOperatorGateIntent/inv#2 同源(意图判据再漂要同时改两段)。
+ */
+export declare function assertGateIntentServiceable(config: {
+    approvalRequire: readonly string[];
+    approvalDeny: readonly string[];
+    approvalNeverAuto: readonly string[];
+    durableApproval: boolean;
+}, checkpointStorePresent: boolean): void;
 /**
  * Durable approval policy (core 1.67 / design/45): returns three-state **`ask`** for gated tools instead of
  * polling. With `TaskSpec.durableApproval` set + a `checkpointStore` on the Runner, core turns that `ask` into
  * a **suspend** (persists a checkpoint, ends `status:"suspended"`) — no held connection, resumable on any
- * replica. (Contrast {@link createOaApprovalPolicy}, which holds the call open by polling a TiDB row.)
+ * replica. (The former poll-lane
+ * twin, createOaApprovalPolicy, was retired in 5.0.0 — durable is the only gate.)
  */
 export interface DurableAskOptions {
     requireApproval: string[];
@@ -48,32 +56,4 @@ export interface DurableAskOptions {
     onExempted?: (canonicalToolName: string, rawToolName: string) => void;
 }
 export declare function createDurableAskPolicy(opts: DurableAskOptions): ToolPolicy;
-export interface OaApprovalOptions {
-    store: ApprovalStore;
-    /** Tool names that require an operator decision before they run. */
-    requireApproval: string[];
-    /** Safety tools that must ALWAYS reach a human — checked BEFORE the exemption probe (workflow audit
-     *  2026-07-13: the OA leg consumed exemptions without the neverAuto guard, so a grant made in durable mode
-     *  could silently auto-approve a NEVER_AUTO tool after an ops switch back to the poll gate). */
-    neverAuto?: string[];
-    /** Session exemption probe — same contract as createDurableAskPolicy.exempt (fail-closed). */
-    exempt?: (sessionId: string, canonicalToolName: string) => Promise<boolean>;
-    /** Audit hook for an exemption short-circuit. */
-    onExempted?: (sessionId: string, canonicalToolName: string) => void;
-    /** Per-run context captured for the approval row (operator UI shows session/tool/args). */
-    context: () => {
-        taskId?: string | null;
-        sessionId?: string | null;
-        owner?: string | null;
-    };
-    /** Always-denied tools. */
-    deny?: string[];
-    /** Poll interval for the decision. Default 1500ms. */
-    pollMs?: number;
-}
-export declare function createOaApprovalPolicy(opts: OaApprovalOptions): ToolPolicy;
-/** Poll the approval row until decided, or release (deny) when the task aborts. Exported for unit tests.
- *  `scope` is the run's tenant identity (owner-sourced) — carried on every read/decide so a run only ever
- *  observes/aborts its OWN pending row (single-DB fleet read guard; defense-in-depth). */
-export declare function waitForDecision(store: ApprovalStore, id: string, scope: string | null, signal: AbortSignal | undefined, pollMs: number): Promise<boolean>;
 //# sourceMappingURL=approval.d.ts.map

package/dist/approval.js

@@ -1,15 +1,9 @@
 /**
- * OA human-in-the-loop approval gate (F4) — a `ToolPolicy` that holds a gated tool call until an
- * operator approves/denies, with the pending state in TiDB so the decision can arrive on any instance.
- *
- * Built on core's `createApprovalPolicy` (which routes requireApproval/deny and races the wait against
- * the task's AbortSignal). Our `approve` records a pending row and polls it for a decision; it also
- * honors the signal directly (marks the request expired and releases) so a never-answered approval is
- * dropped at the task deadline instead of holding the worker — design/06 F4 self-protection.
+ * Human-in-the-loop approval gate (F4) — durable-only since 5.0.0 ([2354]/[2356] A-5:OA 轮询车道
+ * (createOaApprovalPolicy + ApprovalStore pending 行轮询)整体退役;唯一门形 = durable checkpoint
+ * suspend/resume,见 createDurableAskPolicy 与 /v1/approvals 的 checkpointStore 腿)。
  */
-import { createApprovalPolicy, canonicalToolName, uuidv7 } from "@sema-agent/core";
-import { createLogger } from "./observability/logger.js";
-const logger = createLogger();
+import {} from "@sema-agent/core";
 /**
  * 运维**是否表达了门意图** —— boot 的单用户 allow-all 基线只在"零门意图"时才允许铺开,
  * 所以这个谓词漏一格 = 那一格的意图被 allow-all 静默吞掉。
@@ -30,15 +24,28 @@ export function hasOperatorGateIntent(config) {
         config.approvalNeverAuto.length > 0 || // ← 漏了这格,见上面的由来
         config.durableApproval);
 }
+/**
+ * 门意图不可服务=boot 拒启(全窗复审 D3-F1,HIGH;与 env 墓碑族同谱系)。
+ * v4.3.0 的轮询门形(APPROVAL_REQUIRE + DB backend + DURABLE_APPROVAL 未设)在 5.0.0 只剩 core 每任务
+ * warn——**原先拦、现在放**(方向反转)。「留 undefined 让 core warn」对新配置是曝露误配,对升级存量是
+ * 门静默消失,后者必须响亮。放这文件与 hasOperatorGateIntent/inv#2 同源(意图判据再漂要同时改两段)。
+ */
+export function assertGateIntentServiceable(config, checkpointStorePresent) {
+    if (!hasOperatorGateIntent(config) || checkpointStorePresent)
+        return;
+    if (!config.durableApproval) {
+        throw new Error("APPROVAL_REQUIRE/APPROVAL_DENY/APPROVAL_NEVER_AUTO are set but the durable gate is off — since 5.0.0 the poll lane is retired and durable is the ONLY gate. Set DURABLE_APPROVAL=true (with a DB/file backend that has a checkpoint face), or remove the APPROVAL_* lists to run ungated on purpose.");
+    }
+    throw new Error("DURABLE_APPROVAL=true but no checkpoint store is available — the configured DB backend has no checkpoint face (or no backend is configured). Wire a MySQL-protocol/PostgreSQL/file backend, or unset DURABLE_APPROVAL.");
+}
 export function createDurableAskPolicy(opts) {
-    // 🔒 CANONICAL-space matching (mirrors core 1.202 `createAllowDenyPolicy` + the design/116 S8 discipline):
-    // configured names AND the live request name both normalize via `canonicalToolName`, so an operator rule written
-    // against a legacy alias ("Task"/"KillShell"/"MultiEdit") keeps gating after a core CC-parity rename, and a
-    // durable-resume replay carrying a pre-rename `req.toolName` can't slip a rule written in the new names. A raw
-    // compare here is the same silent fail-open class the 1.202 rename exposed in main.ts's read-only strip.
-    const require = new Set(opts.requireApproval.map(canonicalToolName));
-    const deny = new Set((opts.deny ?? []).map(canonicalToolName));
-    const neverAuto = new Set((opts.neverAuto ?? []).map(canonicalToolName));
+    // 🔒 RAW-name matching(core 5.0.0 RB-476:canonicalToolName 折叠面整体退役)。安全前提没有变松,
+    // 只是换了执行者:live 请求名恒为 CC canonical(旧名在 core roster 层响亮 miss,永远到不了本 policy);
+    // 配置侧写了退役名 = core prepare 硬失败 `config.legacy_tool_name`(+ 本仓 config 装配墓碑先一步拒启)。
+    // 旧的双侧归一防的「旧名滑过新名规则」在 5.0.0 下无成立路径——折叠臂留着才是静默兼容层。
+    const require = new Set(opts.requireApproval);
+    const deny = new Set(opts.deny ?? []);
+    const neverAuto = new Set(opts.neverAuto ?? []);
     const budget = Math.max(0, Math.floor(opts.autoBudget ?? 0));
     // design/80 D-E (upgrade-budget): a per-run-leg counter of NORMAL gated calls auto-approved so far. The policy
     // is rebuilt per resolveSpec call (= per submit AND per resume — server.ts), so this closure is per-leg —
@@ -47,7 +54,7 @@ export function createDurableAskPolicy(opts) {
     let autoApproved = 0;
     return {
         check: (req) => {
-            const toolName = canonicalToolName(req.toolName); // canonical-space lookup; messages keep the raw name for the operator
+            const toolName = req.toolName; // RAW(5.0.0):live 名恒 canonical,折叠面已随 core RB-476 退役
             if (deny.has(toolName))
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             // inv#2: a never-auto (irreversible / safety) tool ALWAYS asks a human — UNCONDITIONALLY, even if it was not
@@ -120,97 +127,4 @@ export function createDurableAskPolicy(opts) {
         return { action: "ask", message: `approval required to run "${req.toolName}"` };
     }
 }
-export function createOaApprovalPolicy(opts) {
-    const pollMs = opts.pollMs ?? 1500;
-    const neverAuto = new Set((opts.neverAuto ?? []).map(canonicalToolName));
-    return createApprovalPolicy({
-        requireApproval: opts.requireApproval,
-        deny: opts.deny,
-        approve: async (req, signal) => {
-            const ctx = opts.context();
-            // Session exemption — core already routed deny (deny wins before approve is ever called);
-            // a remembered (sessionId, toolName) auto-approves without a pending row. Fail-closed on a store error.
-            // neverAuto ALWAYS wins the exemption (same ordering lock as the durable policy — the OA leg previously
-            // lacked this guard, workflow audit 2026-07-13).
-            if (opts.exempt && ctx.sessionId) {
-                const toolName = canonicalToolName(req.toolName);
-                if (toolName !== "AskUserQuestion" && !neverAuto.has(toolName)) {
-                    let exempted = false;
-                    try {
-                        exempted = (await opts.exempt(ctx.sessionId, toolName)) === true; // strict boolean, same as the durable twin
-                    }
-                    catch {
-                        exempted = false;
-                    }
-                    if (exempted) {
-                        opts.onExempted?.(ctx.sessionId, toolName);
-                        return true;
-                    }
-                }
-            }
-            const id = uuidv7();
-            // scope = the run's tenant identity, owner-sourced (single-DB fleet read guard; defense-in-depth). The
-            // poll/abort paths below carry the SAME scope so this run only ever reads/aborts its own pending row.
-            const scope = ctx.owner ?? null;
-            await opts.store.createPending(id, scope, { ...ctx, toolName: req.toolName, args: req.args });
-            return waitForDecision(opts.store, id, scope, signal, pollMs);
-        },
-    });
-}
-/** Consecutive poll errors tolerated before giving up (a persistent outage still fail-closes to deny). */
-const MAX_POLL_ERRORS = 5;
-/** Poll the approval row until decided, or release (deny) when the task aborts. Exported for unit tests.
- *  `scope` is the run's tenant identity (owner-sourced) — carried on every read/decide so a run only ever
- *  observes/aborts its OWN pending row (single-DB fleet read guard; defense-in-depth). */
-export async function waitForDecision(store, id, scope, signal, pollMs) {
-    let consecutiveErrors = 0;
-    for (;;) {
-        if (signal?.aborted) {
-            // C1(failloud):最小对症=失败留痕,不必重试——这是最后一次尝试把行标 expired,任务本身已经在
-            // abort 路径上收尾,重试没有下一个时机。裸吞会让一次真实的店写故障(TiDB blip)在观测面上
-            // 与"成功标了 expired"毫无区别;补 error 留痕,行为(deny)不变。
-            await store.decide(id, scope, "expired", "task aborted before decision", null).catch((e) => {
-                logger.error("approval_expire_write_failed", { id, scope, err: e instanceof Error ? e.message : String(e) });
-            });
-            return false;
-        }
-        let s;
-        try {
-            s = await store.getStatus(id, scope);
-            consecutiveErrors = 0;
-        }
-        catch (e) {
-            // A single transient TiDB blip must NOT throw out of the poll loop — core fail-closes a thrown
-            // approval policy to DENY, so one hiccup would deny an already-approved high-risk call after the
-            // operator clicked approve. Tolerate a few consecutive errors (keep polling); only give up (re-throw →
-            // deny) on a persistent outage.
-            if (++consecutiveErrors >= MAX_POLL_ERRORS)
-                throw e;
-            await sleepAbortable(pollMs, signal);
-            continue;
-        }
-        if (s?.status === "approved")
-            return true;
-        if (s?.status === "denied" || s?.status === "expired")
-            return false;
-        await sleepAbortable(pollMs, signal);
-    }
-}
-function sleepAbortable(ms, signal) {
-    return new Promise((resolve) => {
-        if (signal?.aborted) {
-            resolve();
-            return;
-        }
-        const onAbort = () => {
-            clearTimeout(timer);
-            resolve();
-        };
-        const timer = setTimeout(() => {
-            signal?.removeEventListener("abort", onAbort);
-            resolve();
-        }, ms);
-        signal?.addEventListener("abort", onAbort, { once: true });
-    });
-}
 //# sourceMappingURL=approval.js.map

package/dist/auth-bridge.d.ts

@@ -2,7 +2,6 @@ import { type AuthBridgeErrorCode, type VerifiedIdentity } from "@sema-agent/reg
 import type { Logger } from "./observability/logger.js";
 import type { Metrics } from "./observability/metrics.js";
 export type { VerifiedIdentity } from "@sema-agent/registry-core/api/auth-bridge";
-export { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
 export interface RegistryJwtVerifierOptions {
     /** R4 — 期望 iss(registry 的 SSO_ISSUER;默认=SEMA_REGISTRY_URL,双侧去尾斜杠比较)。 */
     issuer: string;

package/dist/auth-bridge.js

@@ -11,7 +11,6 @@
  */
 import { createPublicKey, verify as cryptoVerify } from "node:crypto";
 import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, REGISTRY_JWKS_PATH, RegistryJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, } from "@sema-agent/registry-core/api/auth-bridge";
-export { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
 const DEFAULT_JWKS_TTL_SEC = 15 * 60;
 /** JWKS 响应体字节上限(一个配错或超大响应的端点不应让 worker 无界缓冲;正常 JWKS 千字节级)。 */
 const MAX_JWKS_BYTES = 256 * 1024;

package/dist/auth-keys.d.ts

@@ -5,7 +5,7 @@
  * IDENTITY). config.ts consumes ONLY these two functions + their row types at env-load time, and importing them from
  * security.ts made the base config layer value-depend on the whole 55KiB auth module (lens2 §F). This file is a pure
  * leaf (JSON.parse + shape filters, zero repo imports); the VERIFIERS that consume the parsed key-sets
- * (verifyApprovalHmac / verifyPrincipalJwt) stay in security.ts, which re-exports these four names for compat.
+ * (verifyApprovalHmac / verifyPrincipalJwt) stay in ./approval-hmac.ts and ./principal-jwt.ts; consumers import these four names from HERE ([2354] 兼容面全清).
  */
 /** One key in the rotating HMAC key-set. `kid` lets the verifier pick the signing key (or fall back to trying the
  *  whole set); `status` lets sema-registry rotate without breaking in-flight approvals: `active` = sign + verify,

package/dist/auth-keys.js

@@ -5,7 +5,7 @@
  * IDENTITY). config.ts consumes ONLY these two functions + their row types at env-load time, and importing them from
  * security.ts made the base config layer value-depend on the whole 55KiB auth module (lens2 §F). This file is a pure
  * leaf (JSON.parse + shape filters, zero repo imports); the VERIFIERS that consume the parsed key-sets
- * (verifyApprovalHmac / verifyPrincipalJwt) stay in security.ts, which re-exports these four names for compat.
+ * (verifyApprovalHmac / verifyPrincipalJwt) stay in ./approval-hmac.ts and ./principal-jwt.ts; consumers import these four names from HERE ([2354] 兼容面全清).
  */
 /** Parse APPROVAL_HMAC_KEYS — a sema-registry-managed, rotating key-SET, as a JSON array of {kid,key,status}.
  *  Empty / unset / unparseable ⇒ `[]` ⇒ HMAC verification is OFF (D-G inactive; back-compat, BFF-only door). */

package/dist/bench/s1/run-firm.js

@@ -278,7 +278,7 @@ function dryRunMockFactory() {
             sessionId: `dry-${String(seed)}`,
             status: "completed",
             result: "DONE",
-            stats: { turns: 3, tokens: 1200, costMicroUsd: 50_000, costUsd: 0.05, nested: { tokens: 0, turns: 0, tasks: 0, costMicroUsd: 0 }, ...stats },
+            stats: { turns: 3, tokens: 1200, costMicroUsd: 50_000, nested: { tokens: 0, turns: 0, tasks: 0, costMicroUsd: 0 }, ...stats },
             verification: { verdict: green ? "PASS" : "FAIL", rounds: 1, findings: [] },
         };
         const deps = {

package/dist/boot/config-center.d.ts

@@ -1,6 +1,6 @@
 import { CenterPromptSource } from "@sema-agent/core";
 import { buildPricing } from "../budget.js";
-import { type PromptsDomainFaces } from "../capabilities/center-prompts.js";
+import { type PromptsDomainFaces } from "../prompts-domain-validate.js";
 import { type Scenario, type ScenarioDeps, type ScenarioDetail } from "../capabilities/scenarios.js";
 import type { LoadedSkill } from "../capabilities/skills.js";
 import { type ServiceConfig } from "../config.js";

package/dist/boot/config-center.js

@@ -38,7 +38,8 @@ import { skillContentHash } from "@sema-agent/registry-core";
 import { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "@sema-agent/core";
 import { buildPricing } from "../budget.js";
 import { applyCenterPlugins } from "../capabilities/center-plugins.js";
-import { validatePromptsDomain, applyCatalogToSource, CORE_ENGINE_VERSION, withPromptArtifactBackfill } from "../capabilities/center-prompts.js";
+import { applyCatalogToSource, withPromptArtifactBackfill } from "../capabilities/center-prompts.js";
+import { validatePromptsDomain, CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
 import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
 import { configLkgEnabled } from "../config.js";
 import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg } from "../config-lkg.js";
@@ -87,7 +88,7 @@ export async function createConfigCenterRuntime(ctx) {
     let pendingRestart;
     // DUAL-MODE-DESIGN §4: the config SOURCE is a backend-selectable seam — remote (config-center HTTP, the fleet
     // default) | local (.env + config.d via @sema-agent/registry-core FileConfigStore, the single-machine/TOC source).
-    // The provider exists when SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL) is set OR CONFIG_PROVIDER=local is explicit; neither = pure-env
+    // The provider exists when SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is set OR CONFIG_PROVIDER=local is explicit; neither = pure-env
     // (byte-identical to before). The remote provider DELEGATES verbatim to fetchEffective, so the fleet path is
     // unchanged; applyEffective consumes either source's EffectiveConfig identically (one resolver → no drift).
     const cc = config.configCenter;
@@ -104,7 +105,7 @@ export async function createConfigCenterRuntime(ctx) {
         sealedKeys = await ensureSealedKeyStore(join(config.localDataRoot ?? localRoot, "sealed-key"), logger);
         void reportExecutionPublicKey({
             baseUrl: cc?.baseUrl,
-            adminToken: process.env.SEMA_REGISTRY_ADMIN_TOKEN || process.env.REGISTRY_ADMIN_TOKEN,
+            adminToken: process.env.SEMA_REGISTRY_ADMIN_TOKEN, // [2373]B-1:REGISTRY_ADMIN_TOKEN 双读已墓碑(在场即拒启)
             key: sealedKeys.latest,
             ...(cc?.worker ? { notes: `worker ${cc.worker}` } : {}),
             logger,

package/dist/boot/reapers.d.ts

@@ -20,7 +20,7 @@ import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import type { WorkflowNotifyGate, WorkflowNotifyJournalStore } from "../orchestration/workflow-notify-journal.js";
 import type { TaskAttachmentStore } from "../plugins/task-attachment-store.js";
-import type { ApprovalStore, CheckpointStoreFull, CostQuotaStore, ImageBake, RateLimiterStore, ServiceWorkflowJournalStore, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
+import type { CheckpointStoreFull, CostQuotaStore, ImageBake, RateLimiterStore, ServiceWorkflowJournalStore, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
 export interface ReapersCtx {
     config: ServiceConfig;
     logger: Logger;
@@ -30,7 +30,6 @@ export interface ReapersCtx {
     subRunner: Runner;
     runStore: ReturnType<StoreBackend["run"]> | undefined;
     checkpointStore: CheckpointStoreFull | undefined;
-    approvalStore: ApprovalStore | undefined;
     rateLimiter: RateLimiter | RateLimiterStore | undefined;
     costQuota: CostQuota | CostQuotaStore | undefined;
     toolResultStore: ToolResultStoreFull | undefined;

package/dist/boot/reapers.js

@@ -17,7 +17,7 @@ import { sweepStaleScratchpads } from "../env-facts.js";
 import { CostQuota } from "../observability/cost-quota.js";
 /** 起后台维护 tick,返回定时器 handle(收尾段 clearInterval 用)。 */
 export function startReapers(ctx) {
-    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, approvalStore, rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, getRunDenySweep, } = ctx;
+    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, getRunDenySweep, } = ctx;
     // S7 (SILENT-FALLBACK P0-d): the sweeps' return counts were discarded — an instance death that batch-fails
     // N orphans was indistinguishable from organic failures. Count + log ONLY when a sweep flipped rows (>0),
     // so healthy ticks stay silent. Tolerant of void-returning stores (typeof guard).
@@ -137,11 +137,10 @@ export function startReapers(ctx) {
             // continues with the denial), vs the abort reapExpired gives the other kinds. Bounded per tick.
             void getRunDenySweep()?.(Date.now()).catch(() => undefined); // A10 搬运改写:晚绑取值(原 `runDenySweep?.`)
         }
-        // The finer, OPT-IN per-approval TTL sweeps (APPROVAL_TIMEOUT_SEC): the F4 poll-gate store + the
-        // time-based suspended-run reaper. Stay gated — reapSuspended with a 0 TTL would nuke ALL suspended rows
-        // (cutoff = now). The absolute backstop above is the safety floor; this is the operator-chosen deadline.
+        // The finer, OPT-IN time-based suspended-run reaper (APPROVAL_TIMEOUT_SEC). Stays gated — reapSuspended
+        // with a 0 TTL would nuke ALL suspended rows (cutoff = now). The absolute backstop above is the safety
+        // floor; this is the operator-chosen deadline. ([2354] A-5:F4 轮询店的 expireStale 腿随车道退役。)
         if (config.approvalTimeoutSec > 0) {
-            void approvalStore?.expireStale(config.approvalTimeoutSec * 1000).catch(() => undefined);
             void runStore?.reapSuspended(config.approvalTimeoutSec * 1000).then(reapCount("runs_reaped_total", { kind: "suspended" })).catch(() => undefined);
         }
         // GC checkpoint_ctx rows whose checkpoint is gone (bound to the checkpoint lifecycle).

package/dist/boot/resolve-spec.d.ts

@@ -1,5 +1,5 @@
 import { type MemoryBackend, type RunnerDeps } from "@sema-agent/core";
-import { type PromptsDomainFaces } from "../capabilities/center-prompts.js";
+import type { PromptsDomainFaces } from "../prompts-domain-validate.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { selectScenario } from "../capabilities/scenarios.js";
@@ -56,8 +56,6 @@ export interface ResolveSpecCtx {
     } | undefined;
     durableEnabled: boolean;
     approvalExemptionStore: ReturnType<StoreBackend["approvalExemption"]> | undefined;
-    approvalEnabled: boolean | undefined;
-    approvalStore: ReturnType<NonNullable<StoreBackend["approval"]>> | undefined;
     singleUserAutoAcceptBaseline: boolean;
     checkpointStore: ReturnType<NonNullable<StoreBackend["checkpoint"]>> | undefined;
     deploymentHooks: NonNullable<RunnerDeps["hooks"]>;