@sema-agent/server 4.3.0 → 5.0.1

package/dist/plugins/pg-pool.js

@@ -28,14 +28,13 @@ import pg from "pg";
 // Each PG store owns its own (disjoint) tables' DDL via a standalone idempotent ensureSchema; the central apply
 // composes them so production wires ONE ensurePgSchema (the PG twin of tidb-pool's single ensureSchema).
 import { ensureSchema as ensureSessionSchema } from "./pg-session-storage.js";
-import { ensureSchema as ensureToolResultSchema } from "./pg-tool-result-store.js";
+import { ensureSchema as ensureToolResultSchema } from "./tool-result-store-sql.js";
 import { ensureSchema as ensureCostQuotaSchema } from "./pg-cost-quota.js";
 import { ensureSchema as ensureRateLimitSchema } from "./pg-rate-limiter.js";
-import { ensureSchema as ensureBreakerStateSchema } from "./pg-breaker-state.js";
-import { ensureSchema as ensureApprovalSchema } from "./pg-approval-store.js";
-import { ensureSchema as ensureOutcomeLedgerSchema } from "./pg-outcome-ledger.js";
-import { ensureSchema as ensureImageIndexSchema } from "./pg-image-index.js";
-import { ensureSchema as ensureImageBakeSchema } from "./pg-image-bake.js";
+import { ensureSchema as ensureBreakerStateSchema } from "./breaker-state-sql.js";
+import { ensurePgOutcomeLedgerSchema as ensureOutcomeLedgerSchema } from "./outcome-ledger-sql.js";
+import { ensureSchema as ensureImageIndexSchema } from "./image-index-sql.js";
+import { ensurePgImageBakeSchema as ensureImageBakeSchema } from "./image-bake-store-sql.js";
 export const PG_SCHEMA_STATEMENTS = [
     `CREATE TABLE IF NOT EXISTS task_run (
      task_id     VARCHAR(64)  NOT NULL,
@@ -145,7 +144,7 @@ export const PG_SCHEMA_STATEMENTS = [
     `CREATE INDEX IF NOT EXISTS idx_sendfile_link_scope ON sendfile_link (scope, id)`,
     // E6 durable SessionPolicyStore (the PG twin of the TiDB session_policy table; policy_key = sha256(JSON.stringify(
     // [sessionId, principal ?? null])) = a fixed 64-char hash PK; rules JSONB; CAS-versioned tighten-only — see
-    // tidb-pool.ts / tidb-session-policy-store.ts).
+    // tidb-pool.ts / session-policy-store-sql.ts).
     `CREATE TABLE IF NOT EXISTS session_policy (
      policy_key CHAR(64)       NOT NULL,
      session_id VARCHAR(64)    NOT NULL,
@@ -186,7 +185,7 @@ export const PG_SCHEMA_STATEMENTS = [
     // SVC-2 (core CORE-7) durable WorkflowJournalStore — the PG twin of the TiDB workflow_journal table (cross-replica
     // resume journal; (run_id, ordinal) PK = idempotent OVERWRITE upsert; `result` = JSON.stringify(TaskResult)). `result`
     // is TEXT, NOT JSONB — the byte-match contract is "string in, string out" (the store JSON.parses on load); JSONB would
-    // make `pg` auto-parse the row back to an object and break the twin's String()→JSON.parse path. See pg-workflow-journal-store.ts.
+    // make `pg` auto-parse the row back to an object and break the twin's String()→JSON.parse path. See workflow-journal-store-sql.ts.
     `CREATE TABLE IF NOT EXISTS workflow_journal (
      run_id     VARCHAR(191) NOT NULL,
      ordinal    INT          NOT NULL,
@@ -210,7 +209,7 @@ export const PG_SCHEMA_STATEMENTS = [
      claimed_at    BIGINT       NOT NULL,
      PRIMARY KEY (source_run_id, scope)
    )`,
-    // P1 (fleet failover): WorkflowRunStore + completion-inbox PG twins (design doc in tidb-workflow-run-store.ts).
+    // P1 (fleet failover): WorkflowRunStore + completion-inbox PG twins (design doc in workflow-run-store-sql.ts).
     // `run` is TEXT not jsonb (node-pg auto-parse would break the shared String()→JSON.parse path).
     `CREATE TABLE IF NOT EXISTS workflow_run (
      id         VARCHAR(191) NOT NULL,
@@ -332,7 +331,6 @@ export async function ensurePgSchema(pool) {
         await ensureCostQuotaSchema(client);
         await ensureRateLimitSchema(client);
         await ensureBreakerStateSchema(client);
-        await ensureApprovalSchema(client);
         await ensureOutcomeLedgerSchema(client);
         await ensureImageIndexSchema(client);
         await ensureImageBakeSchema(client);

package/dist/plugins/pg-rate-limiter.d.ts

@@ -8,8 +8,7 @@
  *
  * design/158 A12 C1b: the `PgWriteBehindCounter` this file used to define inline now lives in
  * write-behind-counter.ts as the PG binding of ONE dialect-parameterized counter (the mysql2 twin is
- * `WriteBehindCounter`); the SQL-dialect deltas are documented and branched there. It is re-exported here
- * so the historical import path keeps working.
+ * `WriteBehindCounter`); the SQL-dialect deltas are documented and branched there.
  *
  * Schema: this store's `rate_limit` table is DISJOINT from the other PG stores' tables, so a
  * self-contained {@link PG_RATE_LIMITER_SCHEMA} + {@link ensureSchema} is safe (no shadowing).
@@ -17,8 +16,6 @@
 import type { Pool, PoolClient } from "pg";
 import type { RateDecision, RateGate } from "../observability/rate-limit.js";
 import { type CounterDegradeHook } from "./write-behind-counter.js";
-export { PgWriteBehindCounter } from "./write-behind-counter.js";
-export type { CounterTable } from "./write-behind-counter.js";
 export declare class PgRateLimiter implements RateGate {
     private readonly limit;
     private readonly counter;

package/dist/plugins/pg-rate-limiter.js

@@ -1,5 +1,4 @@
 import { PgWriteBehindCounter } from "./write-behind-counter.js";
-export { PgWriteBehindCounter } from "./write-behind-counter.js";
 /** The counter's table binding for the per-key request rate limit (mirror of the TiDB twin's binding). */
 const RATE_LIMIT_TABLE = { table: "rate_limit", keyCol: "limit_key", valCol: "n" };
 export class PgRateLimiter {

package/dist/plugins/roster-store-sql.d.ts

@@ -21,11 +21,9 @@
  * 是「core 变语义必须先过迁移裁量」的告警钉)。
  */
 import type { Pool } from "mysql2/promise";
-import { normalizeAgentName, type RosterStore, type RosterEntry } from "@sema-agent/core";
+import { type RosterStore, type RosterEntry } from "@sema-agent/core";
 type RosterAccess = Parameters<RosterStore["resolve"]>[1];
 import type { PgQueryFn } from "./pg-query.js";
-/** 兼容名保留(测试/历史引用),现=core 导出直引(私拷已删)。 */
-export declare const normalizeAgentNameLocal: typeof normalizeAgentName;
 export declare const ROSTER_TABLE = "agent_roster";
 export declare function ensureTiDBRosterSchema(pool: Pool): Promise<void>;
 export declare function ensurePgRosterSchema(q: PgQueryFn): Promise<void>;

package/dist/plugins/roster-store-sql.js

@@ -1,6 +1,4 @@
 import { normalizeAgentName } from "@sema-agent/core";
-/** 兼容名保留(测试/历史引用),现=core 导出直引(私拷已删)。 */
-export const normalizeAgentNameLocal = normalizeAgentName;
 export const ROSTER_TABLE = "agent_roster";
 /** 行 → RosterEntry(缺席键省略,core 形逐字;session_scoped 数值/布尔双方言归一)。
  *  core 1.365 BREAKING:owner/scope 升类型必填——两方言 CREATE 直接建成 NOT NULL(当年的「清死行 +
@@ -114,7 +112,7 @@ export async function ensurePgRosterSchema(q) {
 /** upsert 参数序(两方言共用;core 1.365 起 owner/scope 类型必填——键列直取,与 core upsertKey 同键)。 */
 function upsertParams(entry, now) {
     return [
-        normalizeAgentNameLocal(entry.name),
+        normalizeAgentName(entry.name),
         entry.owner,
         entry.scope,
         entry.name,
@@ -148,7 +146,7 @@ export class TiDBRosterStore {
          session_scoped = VALUES(session_scoped), root_session_id = VALUES(root_session_id), model = VALUES(model), created_at_ms = VALUES(created_at_ms), recorded_at_ms = VALUES(recorded_at_ms)`, p.map((v) => (typeof v === "boolean" ? (v ? 1 : 0) : v)));
     }
     async resolve(name, access) {
-        const key = normalizeAgentNameLocal(name);
+        const key = normalizeAgentName(name);
         if (key === "")
             return undefined;
         const [rows] = (await this.pool.query(`SELECT ${COLS} FROM ${ROSTER_TABLE} WHERE ${RESOLVE_WHERE_TIDB} ORDER BY created_at_ms DESC, recorded_at_ms DESC, agent_id DESC LIMIT 1`, [key, access.scope ?? null, access.owner ?? null, access.sessionId ?? null, access.sessionId ?? null]));
@@ -185,7 +183,7 @@ export class PgRosterStore {
          recorded_at_ms = EXCLUDED.recorded_at_ms`, upsertParams(entry, this.clock()));
     }
     async resolve(name, access) {
-        const key = normalizeAgentNameLocal(name);
+        const key = normalizeAgentName(name);
         if (key === "")
             return undefined;
         const { rows } = await this.q(`SELECT ${COLS} FROM ${ROSTER_TABLE} WHERE ${RESOLVE_WHERE_PG} ORDER BY created_at_ms DESC, recorded_at_ms DESC, agent_id DESC LIMIT 1`, [key, access.scope ?? null, access.owner ?? null, access.sessionId ?? null, access.sessionId ?? null]);

package/dist/plugins/store-backend.d.ts

@@ -3,27 +3,19 @@ import type { Pool as PgPool } from "pg";
 import type { SessionStore, SessionPolicyStore, FileSnapshotStore, WorkflowJournalStore, ToolResultStore } from "@sema-agent/core";
 import { type FileSnapshotBounds } from "@sema-agent/core";
 import { type OutcomeSink } from "./file-outcome-sink.js";
-import { type InboxWarn } from "./tidb-workflow-run-store.js";
+import { type InboxWarn } from "./workflow-run-store-sql.js";
 import { FileRunStore } from "./file-run-store.js";
 import { LocalCheckpointStore } from "./local-checkpoint-store.js";
 import { FileResumeAnchorStore } from "./file-resume-anchor-store.js";
 import { type ApprovalExemptionStore } from "./approval-exemption-store.js";
 import { type SendFileLedger } from "./send-file-ledger.js";
-import { TiDBResumeAnchorStore } from "./tidb-resume-anchor-store.js";
-import { PgResumeAnchorStore } from "./pg-resume-anchor-store.js";
+import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
 import type { ServiceConfig } from "../config-types.js";
-import { TiDBRunStore } from "./tidb-run-store.js";
-import { PgRunStore } from "./pg-run-store.js";
-import { TiDBCheckpointStore } from "./tidb-checkpoint-store.js";
-import { PgCheckpointStore } from "./pg-checkpoint-store.js";
-import { TiDBApprovalStore } from "./tidb-approval-store.js";
-import { PgApprovalStore } from "./pg-approval-store.js";
-import { TiDBImageIndex } from "./tidb-image-index.js";
-import { PgImageIndex } from "./pg-image-index.js";
-import { TiDBImageBake } from "./tidb-image-bake.js";
-import { PgImageBake } from "./pg-image-bake.js";
-import { TiDBBreakerState } from "./tidb-breaker-state.js";
-import { PgBreakerState } from "./pg-breaker-state.js";
+import { TiDBRunStore, PgRunStore } from "./run-store-sql.js";
+import { TiDBCheckpointStore, PgCheckpointStore } from "./checkpoint-store-sql.js";
+import { TiDBImageIndex, PgImageIndex } from "./image-index-sql.js";
+import { TiDBImageBake, PgImageBake } from "./image-bake-store-sql.js";
+import { TiDBBreakerState, PgBreakerState } from "./breaker-state-sql.js";
 import { TiDBCostQuota } from "./tidb-cost-quota.js";
 import { PgCostQuota } from "./pg-cost-quota.js";
 import { TiDBRateLimiter } from "./tidb-rate-limiter.js";
@@ -79,7 +71,6 @@ export type ServiceWorkflowJournalStore = WorkflowJournalStore & {
      *  TaskResult-bearing table (the per-run deleteByRun has no run-store reap hook). Local InMemory omits it. */
     reapExpired?(now: number, maxAgeMs: number): Promise<number>;
 };
-export type ApprovalStore = TiDBApprovalStore | PgApprovalStore;
 export type ImageIndex = TiDBImageIndex | PgImageIndex;
 export type ImageBake = TiDBImageBake | PgImageBake;
 /** The FULL checkpoint store (core CheckpointStore + the service operator-queue/ctx methods listPending/
@@ -155,7 +146,6 @@ export interface StoreBackend {
     checkpoint?(logger?: {
         info?(msg: string, meta?: unknown): void;
     }): CheckpointStoreFull;
-    approval?(): ApprovalStore;
     toolResult?(): ToolResultStoreFull;
     imageIndex?(): ImageIndex;
     imageBake?(): ImageBake;

package/dist/plugins/store-backend.js

@@ -4,48 +4,34 @@
  * subsystem. main.ts wires through this instead of `new TiDB*(pool)` so `DB_BACKEND=pg` boots the whole service on
  * PG with zero call-site churn. The twins are interchangeable behaviourally (one shared real-DB integration suite
  * keeps them in lock-step); the unions below exist only because TS private fields make the concrete classes
- * nominally distinct (run/approval/imageIndex/imageBake have no core interface — the rest implement one).
+ * nominally distinct (run/imageIndex/imageBake have no core interface — the rest implement one).
  */
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { FileStorageBackend, FileSessionRepo, DEFAULT_SNAPSHOT_BOUNDS } from "@sema-agent/core";
-import { FileWorkflowJournalStore } from "./file-workflow-journal-store.js";
-import { TiDBOutcomeLedger } from "./tidb-outcome-ledger.js";
-import { PgOutcomeLedger } from "./pg-outcome-ledger.js";
+import { FileWorkflowJournalStore } from "@sema-agent/core";
+import { TiDBOutcomeLedger, PgOutcomeLedger } from "./outcome-ledger-sql.js";
 import { FileOutcomeSink } from "./file-outcome-sink.js";
-import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore } from "./tidb-workflow-run-store.js";
-import { PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore } from "./pg-workflow-run-store.js";
+import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore, PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore } from "./workflow-run-store-sql.js";
 import { FileRunStore } from "./file-run-store.js";
 import { LocalSessionStore } from "./local-session-store.js";
 import { LocalCheckpointStore } from "./local-checkpoint-store.js";
 import { FileResumeAnchorStore } from "./file-resume-anchor-store.js";
 import { TiDBApprovalExemptionStore, PgApprovalExemptionStore, FileApprovalExemptionStore } from "./approval-exemption-store.js";
 import { TiDBSendFileLedger, PgSendFileLedger, FileSendFileLedger } from "./send-file-ledger.js";
-import { TiDBResumeAnchorStore } from "./tidb-resume-anchor-store.js";
-import { PgResumeAnchorStore } from "./pg-resume-anchor-store.js";
-import { TiDBSessionPolicyStore } from "./tidb-session-policy-store.js";
-import { PgSessionPolicyStore } from "./pg-session-policy-store.js";
-import { TiDBWorkflowJournalStore } from "./tidb-workflow-journal-store.js";
-import { PgWorkflowJournalStore } from "./pg-workflow-journal-store.js";
-import { TiDBFileSnapshotStore } from "./tidb-file-snapshot-store.js";
-import { PgFileSnapshotStore } from "./pg-file-snapshot-store.js";
+import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
+import { TiDBSessionPolicyStore, PgSessionPolicyStore } from "./session-policy-store-sql.js";
+import { TiDBWorkflowJournalStore, PgWorkflowJournalStore } from "./workflow-journal-store-sql.js";
+import { TiDBFileSnapshotStore, PgFileSnapshotStore } from "./file-snapshot-store-sql.js";
 import { MinioBlobBackend, SqlBlobBackend } from "./blob-backend.js";
 import { createTidbPool, ensureSchema as ensureTidbSchema } from "./tidb-pool.js";
 import { createPgPool, ensurePgSchema, pgPoolOptions } from "./pg-pool.js";
-import { TiDBRunStore } from "./tidb-run-store.js";
-import { PgRunStore } from "./pg-run-store.js";
-import { TiDBCheckpointStore } from "./tidb-checkpoint-store.js";
-import { PgCheckpointStore } from "./pg-checkpoint-store.js";
-import { TiDBApprovalStore } from "./tidb-approval-store.js";
-import { PgApprovalStore } from "./pg-approval-store.js";
-import { TiDBToolResultStore } from "./tidb-tool-result-store.js";
-import { PgToolResultStore } from "./pg-tool-result-store.js";
-import { TiDBImageIndex } from "./tidb-image-index.js";
-import { PgImageIndex } from "./pg-image-index.js";
-import { TiDBImageBake } from "./tidb-image-bake.js";
-import { PgImageBake } from "./pg-image-bake.js";
-import { TiDBBreakerState } from "./tidb-breaker-state.js";
-import { PgBreakerState } from "./pg-breaker-state.js";
+import { TiDBRunStore, PgRunStore } from "./run-store-sql.js";
+import { TiDBCheckpointStore, PgCheckpointStore } from "./checkpoint-store-sql.js";
+import { TiDBToolResultStore, PgToolResultStore } from "./tool-result-store-sql.js";
+import { TiDBImageIndex, PgImageIndex } from "./image-index-sql.js";
+import { TiDBImageBake, PgImageBake } from "./image-bake-store-sql.js";
+import { TiDBBreakerState, PgBreakerState } from "./breaker-state-sql.js";
 import { TiDBCostQuota } from "./tidb-cost-quota.js";
 import { PgCostQuota } from "./pg-cost-quota.js";
 import { TiDBRateLimiter } from "./tidb-rate-limiter.js";
@@ -117,7 +103,6 @@ class TiDBBackend {
     completionInbox(onWarn) { return new TiDBWorkflowCompletionInbox(this.pool, onWarn); } // P1: cross-replica push half
     notifyJournal() { return new TiDBWorkflowNotifyJournalStore(this.pool); } // 1.108: cross-replica at-least-once notify
     checkpoint(logger) { return new TiDBCheckpointStore(this.pool, logger); }
-    approval() { return new TiDBApprovalStore(this.pool); }
     toolResult() { return new TiDBToolResultStore(this.pool); }
     imageIndex() { return new TiDBImageIndex(this.pool); }
     imageBake() { return new TiDBImageBake(this.pool); }
@@ -151,7 +136,6 @@ class PgBackend {
     completionInbox(onWarn) { return new PgWorkflowCompletionInbox(this.pool, onWarn); } // P1: cross-replica push half
     notifyJournal() { return new PgWorkflowNotifyJournalStore(this.pool); } // 1.108: cross-replica at-least-once notify
     checkpoint(logger) { return new PgCheckpointStore(this.pool, logger); }
-    approval() { return new PgApprovalStore(this.pool); }
     toolResult() { return new PgToolResultStore(this.pool); }
     imageIndex() { return new PgImageIndex(this.pool); }
     imageBake() { return new PgImageBake(this.pool); }

package/dist/plugins/tidb-pool.js

@@ -36,8 +36,8 @@ export function tidbPoolOptions(tidb) {
 }
 export function createTidbPool(config) {
     if (!config.tidb) {
-        throw new Error("TiDB config missing. Set TIDB_HOST / TIDB_USER / TIDB_DATABASE (and TIDB_PASSWORD/PORT) " +
-            "when SESSION_BACKEND=tidb.");
+        throw new Error("TiDB config missing. Set MYSQL_HOST / MYSQL_USER / MYSQL_DATABASE (and MYSQL_PASSWORD/PORT) " +
+            "when SESSION_BACKEND=mysql.");
     }
     return mysql.createPool(tidbPoolOptions(config.tidb));
 }
@@ -198,32 +198,8 @@ export const SCHEMA_STATEMENTS = [
      PRIMARY KEY (session_id),
      KEY idx_task (task_id)
    )`,
-    // Human-in-the-loop approval gate (F4). A pending row is durable so an operator's decision can
-    // arrive on any instance; the instance running the task polls this row to release its wait.
-    `CREATE TABLE IF NOT EXISTS approval (
-     id          VARCHAR(64)  NOT NULL,
-     task_id     VARCHAR(64)  NULL,
-     session_id  VARCHAR(64)  NULL,
-     owner       VARCHAR(190) NULL,
-     -- scope — single-DB fleet scope guard (defense-in-depth): the run's tenant identity (owner-sourced), so the
-     -- approval READ paths (getStatus / get / listPending / decide) can null-safe-filter on it. A NULL scope row
-     -- (an untenanted run — and, on the pre-folding schema, any PRE-MIGRATION row) is matched by a NULL scope arg
-     -- via MySQL <=> / PG IS NOT DISTINCT FROM — see tidb-approval-store.ts / pg-approval-store.ts.
-     -- expireStale deliberately stays GLOBAL (fleet maintenance, not a tenant read).
-     scope       VARCHAR(190) NULL,
-     tool_name   VARCHAR(190) NOT NULL,
-     args        JSON         NULL,
-     status      VARCHAR(16)  NOT NULL,
-     reason      TEXT         NULL,
-     decided_by  VARCHAR(190) NULL,
-     created_at  DATETIME(3)  NOT NULL,
-     decided_at  DATETIME(3)  NULL,
-     PRIMARY KEY (id),
-     KEY idx_owner_status (owner, status),
-     -- idx_scope_status: the scope-filtered READ paths (listPending WHERE scope <=> ?) would full-scan without it.
-     KEY idx_scope_status (scope, status),
-     KEY idx_status (status)
-   )`,
+    // ([2354]/[2356] A-5,5.0.0:F4 轮询车道的 `approval` 表 DDL 已随车道退役——存量库里的旧表留置不动,
+    //  代码零读写;durable 门只用下面的 checkpoint 表。)
     // Durable-checkpoint (core 1.67 / design/45): a policy `ask` persisted as a suspended task so an operator
     // can `resume` it from any replica. `checkpoint` = core's blob + CAS status; `outcome` persisted on resolve
     // (R20 #1). Timestamps are epoch-ms BIGINT (the core Checkpoint uses ms numbers, not DATETIME).
@@ -396,7 +372,7 @@ export const SCHEMA_STATEMENTS = [
     // = JSON.stringify(TaskResult). The (run_id, ordinal) PK makes append IDEMPOTENT (ON DUPLICATE KEY = OVERWRITE /
     // last-write-wins) so a resumed run re-appending its replayed prefix verbatim leaves no dup — the byte-match of
     // core's InMemoryWorkflowJournalStore (byOrdinal.set). LOAD-BEARING (a resume replays it), unlike the best-effort
-    // task_event observation log. GC'd by the run reaper (deleteByRun). See tidb-workflow-journal-store.ts.
+    // task_event observation log. GC'd by the run reaper (deleteByRun). See workflow-journal-store-sql.ts.
     `CREATE TABLE IF NOT EXISTS workflow_journal (
      run_id     VARCHAR(191) NOT NULL,
      ordinal    INT          NOT NULL,
@@ -621,7 +597,7 @@ export const SCHEMA_STATEMENTS = [
     // Admission sentinel: ONE always-present row per builder pool, `SELECT … FOR UPDATE`-locked to SERIALIZE the
     // createBakeIfIdle busy-check+insert. A bare conditional INSERT…SELECT WHERE NOT EXISTS does NOT serialize two
     // concurrent admissions under TiDB's REPEATABLE READ (nor PG's READ COMMITTED), so without this lock two keyless
-    // POSTs can both admit a non-dryRun bake. Dialect-uniform with the PG twin (pg-image-bake.ts).
+    // POSTs can both admit a non-dryRun bake. Dialect-uniform with the PG twin (image-bake-store-sql.ts).
     `CREATE TABLE IF NOT EXISTS image_bake_admit (
      pool VARCHAR(32) NOT NULL,
      PRIMARY KEY (pool)

package/dist/plugins/workflow-journal-store-sql.d.ts

@@ -8,7 +8,7 @@
  * {@link import("@sema-agent/core").InMemoryWorkflowJournalStore} (single-replica, lost on crash); this is the
  * byte-match durable twin so a workflow survives a replica crash and RESUMES (replay the longest unchanged
  * PREFIX of recorded `ctx.agent` results, run only the first changed/new call + everything after it live). The
- * journal is LOAD-BEARING (unlike the best-effort {@link import("./tidb-run-store.js")} observation layer):
+ * journal is LOAD-BEARING (unlike the best-effort {@link import("./run-store-sql.js")} observation layer):
  * append/load failures MUST throw — a silently-dropped entry would silently re-run already-done work.
  *
  * Schema = `workflow_journal (run_id, ordinal) PK` (DDL in tidb-pool.ts / pg-pool.ts ensureSchema). `ordinal`

package/dist/plugins/workflow-journal-store-sql.js

@@ -1,5 +1,5 @@
 import { callKeyOrdinal } from "@sema-agent/core";
-import { oversizeJournalResult } from "./workflow-journal-limits.js";
+import { oversizeJournalResult } from "@sema-agent/core";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 const DEFAULT_RESUME_CLAIM_TTL_MS = 60 * 60 * 1000;
 export class SqlWorkflowJournalStore {

package/dist/principal-jwt.js

@@ -1,7 +1,7 @@
 /**
  * design/80 D-G: principal crypto-binding (the direct-door IDENTITY gate) + the combined direct-door proof
- * verifier. Split out of `security.ts` (design/158 A13, internal-lossless — the facade re-exports every symbol
- * below unchanged; `verifyDirectDoorProof` imports {@link verifyApprovalHmac} from `./approval-hmac.js` for the
+ * verifier. Split out of `security.ts` (design/158 A13; consumers import from HERE — [2354] cleared the security.ts compat re-exports;
+ * `verifyDirectDoorProof` imports {@link verifyApprovalHmac} from `./approval-hmac.js` for the
  * integrity half of the combined proof; `security.ts`'s own `verifiedPrincipal` imports {@link verifyPrincipalJwt}
  * from here for the direct-door identity branch).
  *

package/dist/prompts-domain-validate.d.ts

@@ -41,9 +41,10 @@ export interface PromptsDomainFaces {
 }
 /**
  * prompts 域候选门 v2(validateCenterPrompts 的双轴升级;整拒语义不变=任一在场轴坏形 ⇒ 整个 prompts
- * 面拒绝采用,LKG/内置继续服务)。两形都认:
- *  - legacy 平铺(无 schemaVersion 键)= declaration 轴单轴(存量 center 停发平铺前的兼容窗);
- *  - `{schemaVersion:1, declarations?, catalog?}`(registry-core `EffectivePromptsWire`)= 至少一轴。
+ * 面拒绝采用,LKG/内置继续服务)。唯一认可形=`{schemaVersion:1, declarations?, catalog?}`
+ * (registry-core `EffectivePromptsWire`)至少一轴。[2373]B-9(5.0.0):legacy 平铺兼容窗到期删——
+ * 0.13.0 起 EffectivePromptsWire 首字段是 `schemaVersion: z.ZodLiteral<1>`,与 server 共用 ^0.13.0 的
+ * 合规 center 不可能再发平铺;非合规体=响亮拒绝(整拒落 LKG/内置),不再静默吸收。
  * catalog 轴的语义权威=core `verifyPromptArtifact`(形/digest 逐位复算/ARTIFACT_LIMITS/compatibleCore
  * range 全在 core 一处——[1242]③ a 解,上限单真源永不漂)。
  */

package/dist/prompts-domain-validate.js

@@ -3,7 +3,7 @@
  * lens2 §G:`config-lkg.ts → capabilities/center-prompts.ts` 是全仓唯一一条显式分层反向边,config 层
  * 值 import capabilities 层)。本模块只依赖 node 内置 + `@sema-agent/core`,不依赖 capabilities/
  * config 任何东西,config-lkg(LKG 读侧复判)与 capabilities(候选门)同引即无反向边。
- * center-prompts.ts 原位置 re-export 保兼容,语义/文案零改动——逐字搬运。
+ * 消费者直引本模块([2354] 兼容面全清:center-prompts.ts 的原位兼容 re-export 已删);语义/文案零改动——逐字搬运。
  *
  * ─── 以下为原 center-prompts.ts 的判形半场,注释原样保留 ───
  *
@@ -107,9 +107,10 @@ export const CORE_ENGINE_VERSION = (() => {
 })();
 /**
  * prompts 域候选门 v2(validateCenterPrompts 的双轴升级;整拒语义不变=任一在场轴坏形 ⇒ 整个 prompts
- * 面拒绝采用,LKG/内置继续服务)。两形都认:
- *  - legacy 平铺(无 schemaVersion 键)= declaration 轴单轴(存量 center 停发平铺前的兼容窗);
- *  - `{schemaVersion:1, declarations?, catalog?}`(registry-core `EffectivePromptsWire`)= 至少一轴。
+ * 面拒绝采用,LKG/内置继续服务)。唯一认可形=`{schemaVersion:1, declarations?, catalog?}`
+ * (registry-core `EffectivePromptsWire`)至少一轴。[2373]B-9(5.0.0):legacy 平铺兼容窗到期删——
+ * 0.13.0 起 EffectivePromptsWire 首字段是 `schemaVersion: z.ZodLiteral<1>`,与 server 共用 ^0.13.0 的
+ * 合规 center 不可能再发平铺;非合规体=响亮拒绝(整拒落 LKG/内置),不再静默吸收。
  * catalog 轴的语义权威=core `verifyPromptArtifact`(形/digest 逐位复算/ARTIFACT_LIMITS/compatibleCore
  * range 全在 core 一处——[1242]③ a 解,上限单真源永不漂)。
  */
@@ -118,10 +119,8 @@ export function validatePromptsDomain(raw) {
         return { ok: false, error: "prompts is not an object" };
     const w = raw;
     if (w.schemaVersion === undefined) {
-        const legacy = validateCenterPrompts(raw);
-        if (!legacy.ok)
-            return legacy;
-        return { ok: true, value: { declarations: legacy.value, identity: `${legacy.value.contentDigest}+-`, axes: ["declarations"] } };
+        // [2373]B-9:平铺形拒绝(兼容窗 5.0.0 到期)。文案带指引=下游冒烟立刻可自修,不是哑谜。
+        return { ok: false, error: "prompts payload has no schemaVersion — the legacy flat shape was retired in 5.0.0; wrap as {schemaVersion:1, declarations:{...}} (registry-core EffectivePromptsWire)" };
     }
     if (w.schemaVersion !== 1)
         return { ok: false, error: `unsupported prompts schemaVersion ${String(w.schemaVersion)}` };

package/dist/router/route-orchestration.js

@@ -19,7 +19,7 @@
  * router's chosen arm per trap; the objective hidden-test oracle confirms danger→SUP prevents + competent→single
  * is not-worse) BEFORE it is wired into the live task path — never ship an unvalidated router.
  */
-import { canonicalToolName } from "@sema-agent/core";
+import {} from "@sema-agent/core";
 /**
  * The routing decision (pure). Order matters: explicit caller choice first, then (a) danger, then (b) structural,
  * else the single default. `team` is NEVER produced here — it only ever appears via {@link RoutingSignals.explicitMode}.
@@ -105,7 +105,7 @@ export function isIsolatedExecEnv(provider, runtimeClass) {
  *  a notebook ungated (the exact "write tool bypasses the SUP gate" hole the review-HIGH closed for Edit/Write).
  *  Curated, NOT derived from HAND_TOOL_EFFECTS: that taxonomy is replay-safety (Write="idempotent"; Bash="write" but
  *  shell-gated), not "is an fs mutation". CANONICAL names only (core 1.202 retired MultiEdit into an Edit alias —
- *  `canonicalToolName` in the check below folds a replayed legacy "MultiEdit" call onto "Edit", so batch edits stay
+ *  (5.0.0:折叠面退役——重放的旧名调用由 core roster 层响亮 miss,不再折到 "Edit";raw 直比)
  *  gated without a stale alias entry here). */
 const WRITE_HAND_TOOLS = new Set(["Edit", "Write", "NotebookEdit"]);
 /**
@@ -119,7 +119,7 @@ const WRITE_HAND_TOOLS = new Set(["Edit", "Write", "NotebookEdit"]);
 export function supPostureOverrides() {
     const ask = (toolName) => ({ action: "ask", message: `${toolName} gated by supervisor routing (capability-danger task)`, decisionReason: "rule" });
     const writeGate = {
-        check: (req) => (WRITE_HAND_TOOLS.has(canonicalToolName(req.toolName)) ? ask(req.toolName) : { action: "allow" }),
+        check: (req) => (WRITE_HAND_TOOLS.has(req.toolName) ? ask(req.toolName) : { action: "allow" }),
     };
     return { shellGate: "always", toolPolicy: writeGate };
 }

package/dist/run-local.js

@@ -30,7 +30,8 @@ import { Runner, uuidv7, parseModelMention, FileStorageBackend, NodeLspManager,
 import { createBrain } from "./brain.js";
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
-import { validatePromptsDomain, applyCatalogToSource, CORE_ENGINE_VERSION } from "./capabilities/center-prompts.js";
+import { applyCatalogToSource } from "./capabilities/center-prompts.js";
+import { validatePromptsDomain, CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
 import { loadConfig, logConfigDiagnostics, numEnv } from "./config.js";
 import { createConfigProvider } from "./config-provider.js";
 import { applyEffective, resolveMcpServers, mcpForScenario } from "./config-center/facade.js";
@@ -40,7 +41,8 @@ import { loadSkills } from "./capabilities/skills.js";
 import { GiteaClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
 import { buildScenarios, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
-import { HttpError, memoryEngineBackendFor, memorySpecForRequest } from "./security.js";
+import { HttpError } from "./security.js";
+import { memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
 import { buildPricing } from "./budget.js";
 import { createKeyResolver } from "./key-resolver.js";
@@ -172,12 +174,14 @@ export async function runLocal(argv, deps = {}) {
         process.env.CONFIG_PROVIDER = "local";
     // FORCE the durable backends OFF: a one-shot, single-machine CLI has nothing durable to persist
     // and deliberately does NOT assemble the server-only StoreBackend. A shared .env that carries
-    // SESSION_BACKEND=tidb would otherwise make loadConfig() (needsTidb → TIDB_HOST) or createSessionStore()
-    // throw a cryptic error before the run even starts. Unlike CONFIG_PROVIDER/REMOTE_EXEC (where an explicit
-    // operator choice can be HONORED), a DB session store cannot work here at all, so we FORCE — never honor —
-    // this knob to in-memory so the CLI just works regardless of the shared config. Long-term memory needs no
-    // forcing: the design/138 memory ENGINE is file-based and default-ON here (single-user; MEMORY_ENGINE=off
-    // and MEMORY_ENGINE_DIR pass through loadConfig as-is).
+    // SESSION_BACKEND set to anything but the enum's "memory"/"mysql"/"auto" would otherwise boot-reject
+    // outright (SESSION_BACKEND is an enum env, validated at load — an old value like the retired public
+    // name "tidb" is rejected, not silently coerced), and even a legit "mysql" value would pull in a
+    // server-only SQL session store this one-shot CLI has no business assembling. Unlike CONFIG_PROVIDER/
+    // REMOTE_EXEC (where an explicit operator choice can be HONORED), a DB session store cannot work here
+    // at all, so we FORCE — never honor — this knob to in-memory so the CLI just works regardless of the
+    // shared config. Long-term memory needs no forcing: the design/138 memory ENGINE is file-based and
+    // default-ON here (single-user; MEMORY_ENGINE=off and MEMORY_ENGINE_DIR pass through loadConfig as-is).
     process.env.SESSION_BACKEND = "memory";
     // 🔴 REQUIRE_PRINCIPAL is the same shared-config footgun class: run-local IS the single
     // user at their own terminal — there is no untrusted caller to gate — but a server .env carrying
@@ -395,7 +399,6 @@ export async function runLocal(argv, deps = {}) {
     const webSearch = webSearchCfg ? createWebSearchBackend(webSearchCfg) : undefined;
     const scenarioDeps = {
         runner, subRunner, model: "default", skills, repoClient, metrics, logger,
-        oaApiBaseUrl: config.oaApiBaseUrl, oaServiceToken: config.oaServiceToken, oaIssue: config.oaIssue,
         ...(webSearch ? { webSearch } : {}),
         brandIdentity: true, // run-local is always a local/TOC deployment → brand the default scenario as Sema.
     };
@@ -411,7 +414,7 @@ export async function runLocal(argv, deps = {}) {
     const requested = args.scenario ?? config.defaultScenario;
     const scenarioName = scenarios[requested] ? requested : "default";
     // A scenario may THROW HttpError synchronously when a prerequisite is unmet (e.g. `scan` needs
-    // GIT_API_BASEURL + a repo; `oa` needs OA_* + an authenticated principal — neither of which a one-shot CLI
+    // GIT_API_BASEURL + a repo — which a one-shot CLI may not
     // supplies). The server catches this in resolveSpec/prepareSpec and returns a clean 4xx; here we mirror that
     // with the doctor-style UX (message to stderr + exit 2) instead of letting it bubble to the fatal exit-1 path.
     let cap;

package/dist/runs.js

@@ -65,10 +65,12 @@ export async function backgroundAgentOutput(registry, handle, access, agentStore
  *  onServedTerminal (ack the completion as served) and suppress the workflow completion push. Refusals
  *  return the registry's own not_found shape, indistinguishable from an unknown handle (the route 404s it). */
 const TASK_HANDLE_KINDS = new Set(["background_bash", "monitor", "background_agent"]);
-/** 1.250 复审 F1(HIGH):durable 回落的**形判门**——`getAccessibleTask` 是精确键(不 trim、不查 legacy
- *  别名),而 core `pollTask/stopTask` 是通用解析面(先 trim、`resolveInternal` 含 legacyToTaskId、
- *  stopTask 还有 byName 臂)。裸 `!row` 回落会让垫充空白句柄(" "+wfId)/legacy shellId/agent 名字从
- *  回落缝穿进 live 分支——kind 门要防的 onServedTerminal/游标消费/按名 stop 全部复活(复审实测复现)。
+/** 1.250 复审 F1(HIGH):durable 回落的**形判门**——`getAccessibleTask` 是精确键(不 trim、不查
+ *  别名),而 core `pollTask/stopTask` 是通用解析面(先 trim;[2380] RB-479-A②:`legacyToTaskId`
+ *  shellId 索引已随 5.0.0 整族删,b* task_id 是唯一 registry 地址——本门防的「legacy shellId 穿缝」
+ *  一臂如今在 core 层就响亮 not_found;stopTask 仍有 byName 臂)。裸 `!row` 回落会让垫充空白句柄
+ *  (" "+wfId)/agent 名字从回落缝穿进 live 分支——kind 门要防的 onServedTerminal/游标消费/按名 stop
+ *  全部复活(复审实测复现)。
  *  只有 **a\* 精确形**才回落:`DURABLE_AGENT_HANDLE_RE` = core 公共导出(core 1.369,[1518] ask 即答
  *  ——两边判词同源,镜像私拷已删)。残余(documented):恰为 a\* 形的 agent **名字**
  *  在无 durable 行时仍会进 core stopTask 的 byName 臂——同 access 元组内、名字域与句柄域同形的病态窄面,
@@ -526,8 +528,8 @@ promptManifests) {
             // the top stream NEVER carries it), so this sink is the ONLY path a tick reaches the top-run consumers. 1.78
             // (review HIGH): fan it out to the DURABLE event log too (via the shared whitelist+redact builder, fire-and-
             // forget — `++seq` is a sync increment so sink-vs-loop appends get unique seqs), not just the fleet bus —
-            // previously no fleet bus wired ⇒ ticks dropped entirely, and the stream-switch task_progress case below is
-            // forward-compat only (dead against core ≤1.208). core swallow-guards a throwing sink.
+            // previously no fleet bus wired ⇒ ticks dropped entirely, and the stream-switch task_progress case below was
+            // forward-compat then — [2373]B-4:floor ^4.0.0 下它是热路径(腐注方向已翻转,勿按旧注当死支)。core swallow-guards a throwing sink.
             const fwdInternals = {
                 onForwardEvent: (e) => {
                     fleetPublisher?.onForwardEvent(e);

package/dist/runtime-caps-resolver.d.ts

@@ -68,8 +68,9 @@ export interface EntitlementsResolverOpts {
  *
  *  `autoMode`(core 1.276.0 `RuntimeCaps.autoMode`):auto-mode 分类器 per-principal
  *  开闸线,极性同 allowObservers(`=== true` 显式 opt-in,默认 OFF;真执行还要 deployment 装配
- *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。registry-core 类型未收编
- *  → unknown 宽读透传(allowObservers 0.10.2 期同款先例);center 发键即活。 */
+ *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。[2373]B-6a:registry-core
+ *  0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps(types.d.ts:1786)——宽读逃逸期结束,现为类型直读
+ *  (allowObservers 同款收编先例)。 */
 export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | undefined): RuntimeCaps | undefined;
 /** A MISCONFIG diagnostic (review MEDIUM): a worker-scoped `wpt_<self>` pull token REQUIRES `?worker=<self>` to
  *  resolve per-principal caps — so a `wpt_` token with NO `SEMA_REGISTRY_WORKER` set will 403

package/dist/runtime-caps-resolver.js

@@ -20,13 +20,13 @@ const defaultLogger = createLogger();
  *
  *  `autoMode`(core 1.276.0 `RuntimeCaps.autoMode`):auto-mode 分类器 per-principal
  *  开闸线,极性同 allowObservers(`=== true` 显式 opt-in,默认 OFF;真执行还要 deployment 装配
- *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。registry-core 类型未收编
- *  → unknown 宽读透传(allowObservers 0.10.2 期同款先例);center 发键即活。 */
+ *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。[2373]B-6a:registry-core
+ *  0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps(types.d.ts:1786)——宽读逃逸期结束,现为类型直读
+ *  (allowObservers 同款收编先例)。 */
 export function toCoreRuntimeCaps(ent) {
     if (!ent)
         return undefined;
-    // 宽读(additive wide-read):registry-core 0.10.3 类型未含 autoMode,center 下发先行时走 unknown 读。
-    const autoMode = ent.autoMode;
+    const autoMode = ent.autoMode; // [2373]B-6a:0.13.0 类型直读(宽读逃逸已收编)
     const badCap = (v) => v !== undefined && typeof v !== "boolean";
     if (badCap(ent.allowWorkflows) || badCap(ent.forceDurableGate) || badCap(ent.allowFork) || badCap(ent.allowObservers) || badCap(autoMode)) {
         throw new Error("runtimeCaps from center carries a non-boolean cap (contract breach — fail closed)");

package/dist/runtime-governance.d.ts

@@ -29,13 +29,10 @@ export type CommandRule = {
     command: string;
     decision: "allow" | "ask" | "deny";
 };
-/** True when `name` names a DELEGATION tool — the subagent tool (CC-187 canonical `"Agent"`, core 1.202
- *  `DEFAULT_SUBAGENT_TOOL_NAME`; legacy alias `"Task"`). CANONICAL-space compare (`canonicalToolName`) so both
- *  spellings match — the pre-1.202 raw `!== "Task"` compare in the read-only strip (main.ts) silently stopped
- *  matching when core renamed the tool (fail-open: a plan-mode / hands-read-only parent could delegate to a
- *  WRITABLE-hands child, because core does not propagate handsReadOnly to a delegated child).
- *  core 1.257 (design/136 BREAKING): the standalone `Fork` tool is retired — a fork is now
- *  `Agent(subagent_type:"fork")`, i.e. an Agent call, already matched by DEFAULT_SUBAGENT_TOOL_NAME. */
+/** True when `name` names a DELEGATION tool — the subagent tool(CC-187 canonical `"Agent"`,core
+ *  `DEFAULT_SUBAGENT_TOOL_NAME`)。5.0.0 RB-476:折叠面退役,RAW 比对 core 单源常量——旧名("Task")
+ *  在 core roster 层响亮 miss,不再需要归一;单源常量本身就防了当年 1.202 改名时裸字符串失配的
+ *  fail-open(那个教训的解=引用常量,不是折叠)。 */
 export declare function isDelegationToolName(name: string): boolean;
 /** The hands-read-only DELEGATION STRIP (the main.ts governed-spec site, extracted here so the actual filter —
  *  not just the name predicate — is pinned by tests): core does not propagate `handsReadOnly` to a delegated