@sema-agent/server 6.7.0 → 7.0.0

package/dist/http/routes/tasks.js

@@ -1,7 +1,7 @@
 import { runWithVerification, runCascade, uuidv7 } from "@sema-agent/core";
 import { markChildrenStoppedByUserOnAbort, resumeAtHttpStatus, stripCheckpointToken, HEARTBEAT_MS } from "../../runs.js";
 import { withPrincipal } from "../../observability/principal-context.js";
-import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals } from "../../fleet/fleet-bus.js";
+import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../../fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "../../fleet/subagent-tail-bus.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
 import { createLedgerSink } from "../../trace/ledger-sink.js";
@@ -448,7 +448,9 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                         defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
                                     }
                                     // id-domain alias: flip by payload.sessionId (= the tick's uuid domain), fallback task_id.
-                                    const hadRow = fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false;
+                                    // [2687-cli] 幽灵行案:只对 agent 族终态打(isFleetAgentTerminalNotification 单源判别,
+                                    // 病灶链见其 doc 注);bash/monitor 的通知帧/park 面照走。孪生:runs.ts bg 腿、http/server.ts resume 腿。
+                                    const hadRow = isFleetAgentTerminalNotification(n) ? (fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false) : false;
                                     // 🔴 对抗评审 2026-07-11(HIGH,「下一 turn 0 帧」最强根因):the teardown WINDOW — after the
                                     // client disconnects (the user killed the turn → ac.abort → core reaps the bg child → THIS
                                     // notification fires) but BEFORE the outer finally flips `syncLegLive=false` (several awaits sit
@@ -1075,7 +1077,13 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 if (resumeAtStatus) {
                     if (durableTaskId && deps.runStore)
                         await deps.runStore.setTerminal(durableTaskId, "failed", stripCheckpointToken(result), result.errorMessage ?? null);
-                    return { status: resumeAtStatus, body: { errorCode: result.errorCode, error: result.errorMessage ?? "resume-at failed" } };
+                    // #148 件4: the transient org-memory refusal carries core's retry hint — forward it as
+                    // retryAfterSec (seconds, ceil; family shape = usage.window_exhausted). ONLY on the transient
+                    // code: a wait hint on a terminal 4xx would be a directional lie.
+                    const retryAfterSec = result.errorCode === "memory.admission_required" && result.retryAfterMs !== undefined
+                        ? Math.max(1, Math.ceil(result.retryAfterMs / 1000))
+                        : undefined;
+                    return { status: resumeAtStatus, body: { errorCode: result.errorCode, error: result.errorMessage ?? "resume-at failed", ...(retryAfterSec !== undefined ? { retryAfterSec } : {}) } };
                 }
                 // Durable suspend on the sync path: PARK it as an async run + return a pollable taskId, NEVER the
                 // capability token. The submitter switches to GET /v1/runs/:id. Cost is recorded

package/dist/http/server.js

@@ -16,7 +16,7 @@ import { runInBackground, evictIfConflict, stripCheckpointToken, TurnAnchorCaptu
 import { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
 import {} from "../orchestration/workflow-agent-steer.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
-import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals } from "../fleet/fleet-bus.js";
+import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "../fleet/subagent-tail-bus.js";
 import {} from "../observability/rate-limit.js";
 import { withPrincipal } from "../observability/principal-context.js";
@@ -1372,9 +1372,10 @@ export function createHttpServer(rawDeps) {
         if (deps.config.remoteExec)
             for (const name of HAND_TOOL_NAMES)
                 availableTools.add(name);
-        // AskUserQuestion (durable ask, TC-5.4) is ALSO not in spec.tools — core mounts it from `onQuestion`, which
-        // the durable path always sets (QUESTION_AWAITS_RESUME on suspend, the answer closure on resume). Without
-        // this it 422s on resume exactly like a hand tool would. Gated on checkpointStore = durable mode is active.
+        // AskUserQuestion (durable ask, TC-5.4) is ALSO not in spec.tools — core mounts it from `onQuestion`
+        // (#152: the QUESTION_AWAITS_RESUME sentinel when no live coordinator is wired, else RunnerDeps.onQuestion's
+        // coordinator serves the seat). Without this it 422s on resume exactly like a hand tool would. Gated on
+        // checkpointStore = durable mode is active.
         if (deps.checkpointStore)
             availableTools.add("AskUserQuestion");
         // Workflow (codex round-2 on [1245]/[1248]②): `run_workflow` is ALSO mounted at the runner, never in
@@ -1775,7 +1776,9 @@ export function createHttpServer(rawDeps) {
                                 defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
                             }
                             // id-domain alias: flip by payload.sessionId (= the tick's uuid domain), fallback task_id.
-                            const hadRow = fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false;
+                            // [2687-cli] 幽灵行案:只对 agent 族终态打(isFleetAgentTerminalNotification 单源判别,
+                            // 病灶链见其 doc 注);bash/monitor 的通知帧/park 面照走。孪生:runs.ts bg 腿、routes/tasks.ts sync 腿。
+                            const hadRow = isFleetAgentTerminalNotification(n) ? (fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false) : false;
                             const parked = !resumeLegLive && Boolean(deps.workflowCompletionInbox && sessionId);
                             // diagnosability (rationale in runs.ts twin).
                             deps.logger?.info?.("task_notification_observed", { route: "resume", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: resumeLegLive, parkedDurable: parked });

package/dist/leader/wire.d.ts

@@ -1,6 +1,6 @@
 import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
-import { type LeaderResult } from "./leader.js";
+import { type LeaderDeps, type LeaderResult } from "./leader.js";
 import type { LeaderRequestBody } from "./endpoint.js";
 export interface LeaderWireConfig {
     /** Static-env compat mode (E2B only): the leader provisions/owns each env. Required when `envFactory` unset. */
@@ -162,6 +162,16 @@ export declare function leaderLoopConfig(cfg: {
     repairRounds?: number;
     conflictRounds?: number;
 }, env?: NodeJS.ProcessEnv): LeaderLoopConfig;
+export declare const LEADER_PUSH_NETWORK_TIMEOUT_MS = 120000;
+export declare const LEADER_PUSH_LOCAL_TIMEOUT_MS = 30000;
+/** Coordinator(control plane,持有推送凭据)的 git push 闭包——从 `createLeaderRunner` 抽出为独立工厂,
+ *  仅依赖 durableRemote/targetRef/git 身份(不依赖 wire 内其余状态),因此可以脱离完整的
+ *  plan→provision→fan-out→merge 管线单测(那条管线需要真 brain + E2B/k8s env)。行为与抽出前逐字相同,
+ *  唯一新增是六条 execFileSync 各自的 `timeout`。 */
+export declare function createCoordinatorPush(durableRemote: string, targetRef: string | undefined, ident: {
+    name: string;
+    email: string;
+}): LeaderDeps["push"];
 export declare function createLeaderRunner(cfg: LeaderWireConfig): (body: LeaderRequestBody) => Promise<LeaderResult>;
 export {};
 //# sourceMappingURL=wire.d.ts.map

package/dist/leader/wire.js

@@ -177,6 +177,68 @@ export function leaderLoopConfig(cfg, env = process.env) {
         ...(env.LEADER_BUDGET_USD ? { replanBudgetUsd: parseNumOrFailNonNegative("LEADER_BUDGET_USD", env.LEADER_BUDGET_USD) } : {}),
     };
 }
+// 鲁棒性批5 A4(2026-08-05):Coordinator 的六条 execFileSync(clone/config×2/am/ls-remote/push×2)此前零超时。
+// `execFileSync` 是**同步**调用——它挂起的是整个 Node 事件循环,不只是这一次 leader 跑;`durableRemote`
+// 是运维配的、可能半开/不可达的远端(DNS 黑洞、TCP SYN 丢、对端 git-upload-pack 卡死),一旦挂住,这一个
+// 副本上**所有并发请求**一起冻结,直到操作系统层 TCP 超时(可能几十分钟)才会松绑。
+// 上界两档:clone/push/ls-remote 是网络往返(仓可能较大,给 120s);config/am 是纯本地操作(不该合法挂起,
+// 但损坏的 object store / 文件锁可能卡住 `git am`),给 30s——同 fleet-client.ts `FLEET_CLIENT_FETCH_TIMEOUT_MS`
+// 判据的普适形(操作分类决定上界,不是一刀切）。
+export const LEADER_PUSH_NETWORK_TIMEOUT_MS = 120_000;
+export const LEADER_PUSH_LOCAL_TIMEOUT_MS = 30_000;
+/** Coordinator(control plane,持有推送凭据)的 git push 闭包——从 `createLeaderRunner` 抽出为独立工厂,
+ *  仅依赖 durableRemote/targetRef/git 身份(不依赖 wire 内其余状态),因此可以脱离完整的
+ *  plan→provision→fan-out→merge 管线单测(那条管线需要真 brain + E2B/k8s env)。行为与抽出前逐字相同,
+ *  唯一新增是六条 execFileSync 各自的 `timeout`。 */
+export function createCoordinatorPush(durableRemote, targetRef, ident) {
+    return async (integratedPatch, baseSha) => {
+        // Coordinator (control plane, creds): clone durable remote, apply integrated series, force-with-lease push.
+        // 🔴 requires `git` on the service host PATH (deploy req).
+        const dir = mkdtempSync(join(tmpdir(), "leader-coord-"));
+        // Force C locale so the `raced` regex below matches git's (English) push-rejection messages regardless of
+        // the host locale — otherwise a translated message → regex miss → a real race mislabeled non-retryable (council #5).
+        const gitEnv = { ...process.env, LC_ALL: "C" };
+        try {
+            execFileSync("git", ["clone", "-q", durableRemote, dir], { env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+            execFileSync("git", ["-C", dir, "config", "user.name", ident.name], { timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
+            execFileSync("git", ["-C", dir, "config", "user.email", ident.email], { timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
+            writeFileSync(join(dir, ".leader.patch"), integratedPatch);
+            execFileSync("git", ["-C", dir, "am", "--3way", ".leader.patch"], { env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
+            rmSync(join(dir, ".leader.patch"));
+            const ref = targetRef ?? "refs/heads/main";
+            // CAS against the TARGET ref's ACTUAL current tip (not baseSha). The old `=ref:baseSha` lease assumed
+            // the target ref already pointed at baseSha — but a FRESH ref (or one at any other commit) is never at
+            // baseSha, so the lease rejected EVERY such push and mislabeled it "raced" (found live: auto1 reached
+            // push after a clean 6-worker fan-out + green gradle, and failed only here). ls-remote gives the ref's
+            // current oid (empty = it doesn't exist yet) → lease against THAT, which still detects a real concurrent
+            // merge race (the ref moved since we read it) but lets a normal create/update through.
+            // Does the target ref already exist? (exact full-ref match; --refs drops peeled annotated-tag lines.)
+            const ls = execFileSync("git", ["-C", dir, "ls-remote", "--refs", "origin", ref], { encoding: "utf8", env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+            const exists = ls.split("\n").some((l) => l.split("\t")[1] === ref);
+            if (exists) {
+                // Existing ref → keep the original CAS against baseSha (detects a concurrent merge that moved the ref
+                // off the base this run started from — council#2). NOT against a just-read end-of-run tip: that would
+                // let leader B force-push over leader A's concurrent merge (Codex review #1). A ref that exists but
+                // isn't at baseSha → refuse (use a fresh per-run targetRef to avoid that — the proving-ground does).
+                execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:${baseSha}`, "origin", `HEAD:${ref}`], { env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+            }
+            else {
+                // Absent → create with a "must not exist" lease (empty expected oid): a concurrent create races safely
+                // (rejected as stale info) instead of silently fast-forwarding. The original `:baseSha` lease wrongly
+                // rejected a fresh ref (it's never at baseSha) — that was auto1's only failure after a green build.
+                execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:`, "origin", `HEAD:${ref}`], { env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+            }
+            return { ok: true, ref };
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            return { ok: false, raced: /stale info|force-with-lease|\[rejected\]|non-fast-forward/.test(msg), error: msg };
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    };
+}
 export function createLeaderRunner(cfg) {
     const W = cfg.workspace ?? "/home/user";
     const repo = `${W}/repo`;
@@ -563,53 +625,7 @@ export function createLeaderRunner(cfg) {
             }
             return { env: asIntegrationEnv(env), destroy: () => env.destroy().then(() => { }), ...(mkRepair(env, repo, body.oracleFiles ?? []) ? { repair: mkRepair(env, repo, body.oracleFiles ?? []) } : {}), ...(mkConflictResolver(env, repo, body.oracleFiles ?? []) ? { conflictResolver: mkConflictResolver(env, repo, body.oracleFiles ?? []) } : {}) };
         };
-        const push = async (integratedPatch, baseSha) => {
-            // Coordinator (control plane, creds): clone durable remote, apply integrated series, force-with-lease push.
-            // 🔴 requires `git` on the service host PATH (deploy req).
-            const dir = mkdtempSync(join(tmpdir(), "leader-coord-"));
-            // Force C locale so the `raced` regex below matches git's (English) push-rejection messages regardless of
-            // the host locale — otherwise a translated message → regex miss → a real race mislabeled non-retryable (council #5).
-            const gitEnv = { ...process.env, LC_ALL: "C" };
-            try {
-                execFileSync("git", ["clone", "-q", body.durableRemote, dir], { env: gitEnv });
-                execFileSync("git", ["-C", dir, "config", "user.name", ident.name]);
-                execFileSync("git", ["-C", dir, "config", "user.email", ident.email]);
-                writeFileSync(join(dir, ".leader.patch"), integratedPatch);
-                execFileSync("git", ["-C", dir, "am", "--3way", ".leader.patch"], { env: gitEnv });
-                rmSync(join(dir, ".leader.patch"));
-                const ref = body.targetRef ?? "refs/heads/main";
-                // CAS against the TARGET ref's ACTUAL current tip (not baseSha). The old `=ref:baseSha` lease assumed
-                // the target ref already pointed at baseSha — but a FRESH ref (or one at any other commit) is never at
-                // baseSha, so the lease rejected EVERY such push and mislabeled it "raced" (found live: auto1 reached
-                // push after a clean 6-worker fan-out + green gradle, and failed only here). ls-remote gives the ref's
-                // current oid (empty = it doesn't exist yet) → lease against THAT, which still detects a real concurrent
-                // merge race (the ref moved since we read it) but lets a normal create/update through.
-                // Does the target ref already exist? (exact full-ref match; --refs drops peeled annotated-tag lines.)
-                const ls = execFileSync("git", ["-C", dir, "ls-remote", "--refs", "origin", ref], { encoding: "utf8", env: gitEnv });
-                const exists = ls.split("\n").some((l) => l.split("\t")[1] === ref);
-                if (exists) {
-                    // Existing ref → keep the original CAS against baseSha (detects a concurrent merge that moved the ref
-                    // off the base this run started from — council#2). NOT against a just-read end-of-run tip: that would
-                    // let leader B force-push over leader A's concurrent merge (Codex review #1). A ref that exists but
-                    // isn't at baseSha → refuse (use a fresh per-run targetRef to avoid that — the proving-ground does).
-                    execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:${baseSha}`, "origin", `HEAD:${ref}`], { env: gitEnv });
-                }
-                else {
-                    // Absent → create with a "must not exist" lease (empty expected oid): a concurrent create races safely
-                    // (rejected as stale info) instead of silently fast-forwarding. The original `:baseSha` lease wrongly
-                    // rejected a fresh ref (it's never at baseSha) — that was auto1's only failure after a green build.
-                    execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:`, "origin", `HEAD:${ref}`], { env: gitEnv });
-                }
-                return { ok: true, ref };
-            }
-            catch (e) {
-                const msg = e instanceof Error ? e.message : String(e);
-                return { ok: false, raced: /stale info|force-with-lease|\[rejected\]|non-fast-forward/.test(msg), error: msg };
-            }
-            finally {
-                rmSync(dir, { recursive: true, force: true });
-            }
-        };
+        const push = createCoordinatorPush(body.durableRemote, body.targetRef, ident);
         const deps = {
             plan,
             provisionWorker,

package/dist/main.js

@@ -46,6 +46,7 @@ import { createWorkflowOrchestration } from "./boot/workflow-orchestration.js";
 import { createLiveCoordinators } from "./boot/coordinators.js";
 import { createRuntimeCaps } from "./boot/runtime-caps.js";
 import { createRunnerDeps, createSharedRunnerDeps } from "./boot/runner-deps.js";
+import { createOrgMemoryAdmissionWiring } from "./boot/org-memory.js";
 import { createSessionFaces } from "./boot/session-faces.js";
 import { createLeaderFace } from "./boot/leader.js";
 import { installShutdownHandlers } from "./boot/shutdown.js";
@@ -183,13 +184,15 @@ async function main() {
     const { elicitation, question, toolApproval, durableEnabled, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({ config, logger, backend, sendUserFileTaskEnvs });
     // design/158 A10:per-principal caps 段搬到 src/boot/runtime-caps.ts(逐字)。
     const { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver } = createRuntimeCaps({ config, logger });
+    // design/170 件A(#148 件3③):org 记忆准入装配(目录源三态选择+C12 能力探测,坏配置在此拒启动)。
+    const orgMemoryAdmission = createOrgMemoryAdmissionWiring({ config, logger, metrics });
     // design/158 A10:RunnerDeps 装配段搬到 src/boot/runner-deps.ts(逐字;runStore 晚绑改取值,见该文件头注)。
     const runnerDeps = createRunnerDeps({
         config, logger, metrics, localRoot, promptSource: configCenter.promptSource, rosterStore, backgroundAgentStore, mailboxStore, usageWindowStore, brain,
         pricing, tracer, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine,
         memorySyncRunner, toolResultStore, sessionPolicyStore, runtimeCapsResolver, fileSnapshotStore,
         executionEnvFactory, lspManager, fleetBus, deploymentHooks, workflowRunStore, workflowJournalStore,
-        workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion,
+        workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, orgMemoryAdmission,
         getRunStore: () => runStore,
     });
     const runner = new Runner(runnerDeps);
@@ -330,6 +333,7 @@ async function main() {
             toolResultStore,
             sessionPolicyStore,
             usageWindowStore,
+            orgMemoryAdmission,
         }),
         // ── 以下为 subRunner 差异键(不在共享基座;逐个有因)──────────────────────────────────────
         sessionStore: subRunnerSessions, // 子代转录=私有短 TTL fork 路由店,生命周期异于宿主 durable 店
@@ -870,6 +874,7 @@ async function main() {
         selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore,
         singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage,
         sessionEnvSelection,
+        liveQuestionFace: question, // #152:活体问答面在场 ⇒ durable question 门按活流分腿(见 ResolveSpecCtx 注)
     });
     const server = createHttpServer({ runner, config, resolveSpec, stores, coordinators, seams, observability, governance, deployment, knobs });
     // D-D SLA-timer: wire the server's deny-sweep into the reaper holder declared above (the reaper is defined

package/dist/memory-scope.d.ts

@@ -58,9 +58,18 @@ export declare function memoryEngineBackendFor(config: ServiceConfig, fallbackRo
  * (memory feature off for this run). Pure (testable in isolation) — main.ts's resolveSpec composes it with the
  * engine-backend presence guard.
  */
-export declare function memorySpecForRequest(scope: string | undefined, memoryWrite: boolean | undefined, defaultScopes?: string[]): {
+export declare function memorySpecForRequest(scope: string | undefined, memoryWrite: boolean | undefined, defaultScopes?: string[], 
+/** design/170 件A(#148 件3④):origin 盖章的部署形态维(N2)。`multiTenant=true`(requirePrincipal)
+ *  ⇒ 登记簿 defaultScopes 的 org 键按 **request** 盖章(条目由调用方 projectId 选定=caller 可影响的
+ *  选择器,core 准入门据此过目录判决);单用户 ⇒ 一律 deployment(operator 登记簿条目归 deployment,
+ *  否则单用户部署被自家规则整拒——v4 §0 伤害①的成立前提)。缺参=旧调用形,不盖章(整键缺席=
+ *  core legacy 语义,零迁移)。 */
+originPolicy?: {
+    multiTenant: boolean;
+}): {
     scopes: string[];
     writeScope?: string | null;
     scopeContract?: "v2";
+    scopeOrigins?: Record<string, "deployment" | "request">;
 } | undefined;
 //# sourceMappingURL=memory-scope.d.ts.map

package/dist/memory-scope.js

@@ -98,7 +98,13 @@ export function memoryEngineBackendFor(config, fallbackRoot) {
  * (memory feature off for this run). Pure (testable in isolation) — main.ts's resolveSpec composes it with the
  * engine-backend presence guard.
  */
-export function memorySpecForRequest(scope, memoryWrite, defaultScopes) {
+export function memorySpecForRequest(scope, memoryWrite, defaultScopes, 
+/** design/170 件A(#148 件3④):origin 盖章的部署形态维(N2)。`multiTenant=true`(requirePrincipal)
+ *  ⇒ 登记簿 defaultScopes 的 org 键按 **request** 盖章(条目由调用方 projectId 选定=caller 可影响的
+ *  选择器,core 准入门据此过目录判决);单用户 ⇒ 一律 deployment(operator 登记簿条目归 deployment,
+ *  否则单用户部署被自家规则整拒——v4 §0 伤害①的成立前提)。缺参=旧调用形,不盖章(整键缺席=
+ *  core legacy 语义,零迁移)。 */
+originPolicy) {
     if (!scope)
         return undefined;
     // 142-S1.5: a scope carrying a v2 typed prefix rides WITH the explicit contract marker — core validates
@@ -119,7 +125,21 @@ export function memorySpecForRequest(scope, memoryWrite, defaultScopes) {
     // 最后一层就是派生 scope=正确,不钉保持最小形)。
     const layered = extras.length > 0 ? { scopes: [scope, ...extras], writeScope: scope } : { scopes: [scope] };
     const v2 = isV2(scope) || extras.some(isV2) ? { scopeContract: "v2" } : {};
+    // 件A origin 盖章(core 5.13.0 `memory.scopeOrigins` 两格语义):只盖 org 键(非 org 不入准入判决,
+    // v4 §1);派生/env 位的 `scope` org 形只可能来自 operator 显式 MEMORY_SCOPE(memoryScopeFor 多租户
+    // 恒铸 user: 形)⇒ deployment;登记簿种子按部署形态维分格(见参数注)。零 org 键 ⇒ 整键缺席
+    // (core legacy 零迁移;非 org 部署形状逐字节不变=additive 锁)。
+    const stamped = {};
+    if (originPolicy !== undefined) {
+        if (scope.startsWith("org:"))
+            stamped[scope] = "deployment";
+        for (const extra of extras) {
+            if (extra.startsWith("org:"))
+                stamped[extra] = originPolicy.multiTenant ? "request" : "deployment";
+        }
+    }
+    const origins = Object.keys(stamped).length > 0 ? { scopeOrigins: stamped } : {};
     // memoryWrite === false(MF-30 pause)wins over the layered writeScope pin — 只读语义在有种子时同样成立。
-    return memoryWrite === false ? { ...layered, writeScope: null, ...v2 } : { ...layered, ...v2 };
+    return memoryWrite === false ? { ...layered, writeScope: null, ...v2, ...origins } : { ...layered, ...v2, ...origins };
 }
 //# sourceMappingURL=memory-scope.js.map

package/dist/org-memory-admission.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Org 记忆准入 resolver — server 侧对接 @sema-agent/core@5.13.0 `RunnerDeps.memoryScopeAdmission` seam。
+ * 授权事实来自「目录」抽象:远程腿 = config-center per-principal caps 响应里的 `orgMemory` 段(形状
+ * 同源锚 = registry-core `PrincipalOrgMemoryWire`,zod schema 直接 safeParse);单机腿 = env JSON 静态表
+ * (`MEMORY_ORG_DIRECTORY_JSON`,{@link parseOrgDirectoryStatic} 装载,启动期 fail-loud)。
+ *
+ * 判别联合 {@link OrgDirectoryLookup} 是本模块的核心裁定(设计 N3/C5):取数成功(granted,含零授权空表
+ * = 负结果)与瞬时不可用(unavailable)绝不塌成一格——granted 空表是 resolver 可以终局判决的「事实」
+ * (「这个 principal 没有这个 scope」),unavailable 必须让 core 铸瞬时码 memory.admission_required 重试,
+ * 而不是被误判成「没这个 scope」而永久拒绝。
+ *
+ * core 侧契约(RunnerDeps.memoryScopeAdmission,core types.d.ts):resolver 返回 {ok:false} ⇒ core 铸终局码
+ * memory.admission_denied;resolver throw 一个带 `retryAfterMs`(ms)属性的 Error ⇒ core 铸瞬时码
+ * memory.admission_required 并透传 retryAfterMs;{ok:true}.scopes 只能 ⊆ requested(多给 = resolver fault
+ * 会被 core 整拒)。core 只在「存在 request-origin org scope 且 principal 缺席」时自己先拒——本模块仍防御
+ * `principal === undefined` 这一支(不能信任「core 一定先拒过」这件事)。
+ */
+import type { MemoryScopeAdmission } from "@sema-agent/core";
+/**
+ * 单机腿:装载 `MEMORY_ORG_DIRECTORY_JSON`(`Record<principal, Record<orgScope, {write?}>>`)。启动期调用,
+ * **fail-loud**——任何非法直接 throw 且消息点名坏在哪个键(响亮拒是正确方向:一张半坏的授权表比拒绝
+ * 启动更危险)。principal 键复用 {@link assertPrincipalShape}(拒保留哨兵/超长租户名,与所有其它
+ * principal 入口同一道闸);scope 键必须是 `org:` 前缀、值必须是仅含可选 `write: boolean` 的 plain object。
+ */
+export declare function parseOrgDirectoryStatic(json: string): Map<string, Record<string, {
+    write?: boolean;
+}>>;
+/**
+ * 目录条目的判别联合(设计裁定 N3/C5):`granted` 是取数成功——包括零授权空表(负结果,由 resolver
+ * 判终局拒);`unavailable` 是瞬时臂(取数本身失败/形状不可信/LB 陈旧副本),只在这一支才该让 core 重试。
+ */
+export type OrgDirectoryLookup = {
+    kind: "granted";
+    scopes: Readonly<Record<string, {
+        write?: boolean;
+    }>>;
+} | {
+    kind: "unavailable";
+    reason: OrgDirectoryUnavailableReason;
+    retryAfterMs: number;
+};
+/** {@link createOrgMemoryDirectory} 的产物 —— 单一 per-principal 查表口。 */
+export interface OrgMemoryDirectory {
+    lookup(principal: string): Promise<OrgDirectoryLookup>;
+}
+export interface OrgMemoryDirectoryOptions {
+    /** 远程腿:返回 caps 响应的 `orgMemory` 段原值(unknown,本模块用 `PrincipalOrgMemoryWire.safeParse` 校验)。
+     *  返回 undefined = 响应里键整体缺席(旧 center 能力握手)⇒ unavailable("section_absent")。
+     *  throw = fetch 失败 ⇒ unavailable("fetch_failed")。
+     *  与 `staticTable` 互斥:二者恰好给一个(装配点保证;都给或都缺 = 构造期 throw,fail-loud)。 */
+    fetchSection?: (principal: string) => Promise<unknown>;
+    /** 单机腿:{@link parseOrgDirectoryStatic} 的产物。查表恒「取数成功」:缺 principal ⇒ granted 空表。 */
+    staticTable?: Map<string, Record<string, {
+        write?: boolean;
+    }>>;
+    /** granted(含负结果)缓存 TTL——ms。负结果与正授权同 TTL:未授权 principal 不该比授权 principal 打出
+     *  更多流量。默认值不在本模块(接线点决定,设计定 60_000)。 */
+    grantTtlMs: number;
+    /** 一次 unavailable 之后,同 principal 在这个窗口内的 lookup 直接返回 unavailable(不重新 fetch)——
+     *  防止对一个持续故障/未授权目标反复打 center。默认值不在本模块(接线点决定,设计定 10_000)。 */
+    unavailableBackoffMs: number;
+    /** 时间注入(测试用);默认 `Date.now`。 */
+    now?: () => number;
+}
+type OrgDirectoryUnavailableReason = "fetch_failed" | "section_absent" | "malformed" | "stale_generation";
+/**
+ * 建目录:远程腿(fetchSection,per-principal TTL 缓存 + in-flight 去重 + 退避窗 + gen 高水位)或单机腿
+ * (staticTable,恒同步成功、无 TTL/退避语义——operator 自证配置面)。两腿互斥,装配点必须恰好给一个。
+ */
+export declare function createOrgMemoryDirectory(opts: OrgMemoryDirectoryOptions): OrgMemoryDirectory;
+export interface MemoryScopeAdmissionOptions {
+    /** "audit": 判决照算但从不真拒——会拒的结果（终局 ok:false 或瞬时 throw）一律换成全额放行 + 观测记录
+     *  would-deny；真通过的判决（含 write 收窄为 null）照常返回。"enforce": 判决即结果。 */
+    mode: "audit" | "enforce";
+    /** 观测 hook。outcome ∈ "ok" | "denied" | "principal_missing" | "directory_absent" | "directory_stale" |
+     *  "directory_malformed"。audit 模式下的 would-deny 也走这里，`details.audited === true`。hook 本身绝不
+     *  允许打断准入判决——一律吞掉它可能抛出的异常。 */
+    onOutcome?: (outcome: string, details?: Record<string, unknown>) => void;
+}
+/** core 侧「瞬时不可用，重试」契约的载体：一个带 `retryAfterMs`（ms）属性的真 Error 子类，core 据此铸
+ *  memory.admission_required 终局码并透传该值。子类而非事后挂属性——避免任何宽松断言就能拿到正确类型。 */
+export declare class OrgMemoryAdmissionRetryError extends Error {
+    readonly retryAfterMs: number;
+    constructor(message: string, retryAfterMs: number);
+}
+/**
+ * `RunnerDeps.memoryScopeAdmission` 的 server 实装。deployment-origin 的 requested 项一律放行（operator
+ * 自证——v1 不做中央收窄部署声明）；request-origin 项查 `directory.lookup(principal)`：granted 时逐项核
+ * 对是否在授权集里（任何一项缺席 = 整体终局拒绝，不做部分放行——reason 只点名调用方自己请求过的 scope
+ * 串，不逐 scope 展开「为什么」，避免变成成员探针）；unavailable 时 throw 一个带 `retryAfterMs` 的
+ * {@link OrgMemoryAdmissionRetryError}。write 面独立收窄：deployment-origin 恒授，request-origin 仅当目录
+ * 条目 `write === true` 才授，否则收窄为 null（即使读侧整体放行）。
+ */
+export declare function createMemoryScopeAdmission(directory: OrgMemoryDirectory, opts: MemoryScopeAdmissionOptions): MemoryScopeAdmission;
+export {};
+//# sourceMappingURL=org-memory-admission.d.ts.map