@sema-agent/server 6.8.0 → 7.0.0

package/dist/boot/org-memory.d.ts

@@ -0,0 +1,36 @@
+/**
+ * design/170 件A(#148 件3③)——org 记忆准入的装配点:把 org-memory-admission 模块接上 core 5.13.0
+ * 的两个 seam(`RunnerDeps.memoryScopeAdmission` / `RunnerDeps.deploymentMemoryScopes`)。
+ *
+ * 目录源三态(单选,授权面不做双源合并):
+ *  · center 在场(configCenter 且非 dryRun)⇒ 远程腿:per-principal caps 响应的 `orgMemory` 段
+ *    (fetchPrincipalCaps 已 schema 读+透传;段键缺席=旧 center 能力握手 ⇒ 目录记 section_absent 瞬时)。
+ *    **独立 fetch,不复用 caps 缓存条目**(C3:org 授权段自带判别联合缓存,两张表的失败域互不干扰
+ *    ——caps 腿的 deny 缓存/304 复用机制一旦共享,org 面的 gen 拒退与退避语义就会被 caps 语义污染)。
+ *    流量记账:每 principal 每 grant TTL(60s)至多多一拍 caps 拉取,有界。
+ *  · 无 center 而 `MEMORY_ORG_DIRECTORY_JSON` 在场 ⇒ 单机腿:operator 自证静态表(此处装载=启动期,
+ *    坏表 parseOrgDirectoryStatic 直接 throw 拒启动——config 层因 A4 分层不校验,见 config.ts 注)。
+ *    两者都在 ⇒ center 胜,env 表忽略 + warn(授权面双源合并=语义地雷,显式拒)。
+ *  · 都缺 ⇒ resolver 缺席:core 对 request-origin org scope 铸 `memory.admission_required`(fail-closed),
+ *    deployment-origin 走 `deploymentMemoryScopes` 自证通道不受影响(单用户零迁移,v4 §0 伤害①)。
+ *
+ * 能力探测(C12,fail-loud):多租户(requirePrincipal)部署的 projects 登记簿里挂了 org 键 ——这些
+ * 键在多租户下按 request-origin 盖章(N2 部署形态维)——而目录源缺席(含 configCenter dryRun 形)
+ * ⇒ 启动报错:该部署的每个 projectId 请求都会在 prepare 期被整拒,「audit 在跑但恒拒」不是可运行
+ * 状态,响亮拒启动比静默全拒服务诚实(clay 三裁 [2687]:直接 BREAKING,不留兼容臂)。
+ */
+import type { RunnerDeps } from "@sema-agent/core";
+import type { ServiceConfig } from "../config.js";
+import type { Logger } from "../observability/logger.js";
+import type { Metrics } from "../observability/metrics.js";
+export interface OrgMemoryAdmissionWiring {
+    memoryScopeAdmission: RunnerDeps["memoryScopeAdmission"];
+    deploymentMemoryScopes: RunnerDeps["deploymentMemoryScopes"];
+}
+/** 依赖收窄到真实消费面(warn/inc 各一手)——接口隔离让测试用真形字面量,零铸形([2704] §1)。 */
+export declare function createOrgMemoryAdmissionWiring(opts: {
+    config: ServiceConfig;
+    logger: Pick<Logger, "warn">;
+    metrics: Pick<Metrics, "inc">;
+}): OrgMemoryAdmissionWiring;
+//# sourceMappingURL=org-memory.d.ts.map

package/dist/boot/org-memory.js

@@ -0,0 +1,76 @@
+import { fetchPrincipalCaps } from "../config-center/http-client.js";
+import { createMemoryScopeAdmission, createOrgMemoryDirectory, parseOrgDirectoryStatic } from "../org-memory-admission.js";
+const ORG_PREFIX = "org:";
+/** 部署自证 org scope 集(core 准入门的 deployment origin 词表):env 钉的 MEMORY_SCOPE(org 形时)
+ *  + **单用户部署**的 projects 登记簿 org 键(N2:requirePrincipal !== true 的部署无租户边界,operator
+ *  登记簿条目归 deployment)。多租户下登记簿 org 键**不入**此集——它们由 resolve-spec 按 request 盖章,
+ *  走目录判决。 */
+function collectDeploymentOrgScopes(config) {
+    const scopes = new Set();
+    if (config.memoryScope !== undefined && config.memoryScope.startsWith(ORG_PREFIX))
+        scopes.add(config.memoryScope);
+    if (config.requirePrincipal !== true) {
+        for (const project of Object.values(config.projects)) {
+            for (const s of project.defaultScopes ?? [])
+                if (s.startsWith(ORG_PREFIX))
+                    scopes.add(s);
+        }
+    }
+    return [...scopes];
+}
+/** 依赖收窄到真实消费面(warn/inc 各一手)——接口隔离让测试用真形字面量,零铸形([2704] §1)。 */
+export function createOrgMemoryAdmissionWiring(opts) {
+    const { config, logger, metrics } = opts;
+    const deploymentMemoryScopes = collectDeploymentOrgScopes(config);
+    const centerLeg = config.configCenter !== undefined && !config.configCenter.dryRun ? config.configCenter : undefined;
+    const staticJson = config.memoryOrgDirectoryJson;
+    if (centerLeg !== undefined && staticJson !== undefined) {
+        logger.warn("org_memory_directory_env_ignored", {
+            reason: "MEMORY_ORG_DIRECTORY_JSON is set but a config-center is wired — the center directory wins; the env table is IGNORED (authorization faces never merge two sources)",
+        });
+    }
+    const directory = centerLeg !== undefined
+        ? createOrgMemoryDirectory({
+            fetchSection: async (principal) => {
+                // etag 恒缺席 ⇒ fetchPrincipalCaps 永不走 304 臂(返回 null 的唯一途径是条件请求),
+                // 这里的 null 防御臂只为类型收口;C8 回声核与 schema 校验都在 fetchPrincipalCaps 内。
+                const r = await fetchPrincipalCaps(centerLeg.baseUrl, centerLeg.token, principal, undefined, fetch, centerLeg.worker);
+                if (r === null)
+                    throw new Error("config-center returned 304 to a non-conditional org-directory fetch");
+                return r.orgMemory;
+            },
+            grantTtlMs: config.memoryOrgGrantTtlMs,
+            unavailableBackoffMs: config.memoryOrgUnavailableBackoffMs,
+        })
+        : staticJson !== undefined
+            ? createOrgMemoryDirectory({
+                staticTable: parseOrgDirectoryStatic(staticJson), // 启动期 fail-loud(坏表拒启动)
+                grantTtlMs: config.memoryOrgGrantTtlMs,
+                unavailableBackoffMs: config.memoryOrgUnavailableBackoffMs,
+            })
+            : undefined;
+    // C12 能力探测:多租户 + 登记簿有 org 用面 + 目录源缺席 ⇒ 拒启动(见文件头注)。
+    if (directory === undefined && config.requirePrincipal === true) {
+        const orgProjects = Object.entries(config.projects)
+            .filter(([, p]) => (p.defaultScopes ?? []).some((s) => s.startsWith(ORG_PREFIX)))
+            .map(([id]) => id);
+        if (orgProjects.length > 0) {
+            throw new Error(`multi-tenant deployment has org: keys in projects[${orgProjects.join(", ")}].defaultScopes but NO org-memory directory source ` +
+                `(config-center absent/dry-run and MEMORY_ORG_DIRECTORY_JSON unset) — every request selecting these projects would be refused at prepare ` +
+                `(memory.admission_required, fail-closed). Wire a config-center or set MEMORY_ORG_DIRECTORY_JSON, or remove the org keys.`);
+        }
+    }
+    const memoryScopeAdmission = directory !== undefined
+        ? createMemoryScopeAdmission(directory, {
+            mode: config.memoryOrgAdmissionMode,
+            // §5 观测:outcome 闭集 metric + 审计日志线(per-principal 归因走日志,principal 不入 metric label)。
+            onOutcome: (outcome, details) => {
+                metrics.inc("memory_admission_total", { outcome });
+                if (outcome !== "ok" || details !== undefined)
+                    logger.warn("memory_admission_outcome", { outcome, ...details });
+            },
+        })
+        : undefined;
+    return { memoryScopeAdmission, deploymentMemoryScopes };
+}
+//# sourceMappingURL=org-memory.js.map

package/dist/boot/resolve-spec.d.ts

@@ -55,6 +55,12 @@ export interface ResolveSpecCtx {
         root: string;
     } | undefined;
     durableEnabled: boolean;
+    /** #152 ([2703] 案二):活体 AskUserQuestion 面(QuestionCoordinator 的判决探针切面)。在场(=
+     *  ASK_QUESTION_ENABLED)时 durable question 门按活流上下文分腿、spec 不再 stamp QUESTION_AWAITS_RESUME
+     *  (否则 spec.onQuestion 恒遮蔽 RunnerDeps.onQuestion 的活人腿);缺席时行为与旧形逐字一致。 */
+    liveQuestionFace: {
+        hasLiveContext(): boolean;
+    } | undefined;
     approvalExemptionStore: ReturnType<StoreBackend["approvalExemption"]> | undefined;
     singleUserAutoAcceptBaseline: boolean;
     checkpointStore: ReturnType<NonNullable<StoreBackend["checkpoint"]>> | undefined;

package/dist/boot/resolve-spec.js

@@ -48,8 +48,27 @@ import { resolveRequestMcp } from "../task-mcp.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, acceptAppendSystemPrompt, applyTaskSettings, coercePermissionMode, effectiveThinking, hasConstitutionAnchors, parseTaskSettings, providerDropsAppend, withPermissionMode } from "../task-settings.js";
 import { enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
+/** #152([2703] 案二):durable 部署上的 AskUserQuestion 门。活体面(QuestionCoordinator)缺席 ⇒ 原形
+ *  `createDurableQuestionPolicy()`(恒 ask ⇒ 恒 durable park)。在场 ⇒ **判决时**按活流上下文分腿:
+ *  活流腿(bg/SSE,coordinator.runWithContext 包裹,ALS 判)allow——工具执行落到 RunnerDeps.onQuestion
+ *  的 coordinator,问正在 tail 流的活人;无活流腿(sync /v1/tasks、verify/cascade)ask——durable park
+ *  原语义逐字保留(此时执行只会拿到 headless 空答,park 才是把问题送到人面前的那条腿)。
+ *  工具名字面量与 server.ts 的 pre-CAS 守卫同源("AskUserQuestion",core 未根导出常量)。 */
+function durableQuestionPolicy(live) {
+    if (live === undefined)
+        return createDurableQuestionPolicy();
+    return {
+        check(req) {
+            if (req.toolName !== "AskUserQuestion")
+                return { action: "allow" };
+            return live.hasLiveContext()
+                ? { action: "allow" }
+                : { action: "ask", message: "AskUserQuestion: awaiting a human answer (durable)" };
+        },
+    };
+}
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, } = ctx;
     // Deployment-owned mapping. Tools/prompt/skills come from the selected scenario (assembled once,
     // bound per request); identity/session/policy stay server-side. Never taken from the request body.
     // design/158 A8:从 createHttpServer 实参里提出来(原地占该字面量 1,093 行中的 967 行)——
@@ -677,7 +696,9 @@ export function createResolveSpec(ctx) {
             // (`writeScope:null` — the engine materializes/reads but harvest commits nothing). Per-request (not a
             // stored flag) → no new per-session state; the shell carries the toggle. RESUME re-runs resolveSpec
             // from the persisted body, so a paused run stays paused across resume legs.
-            memory: memoryEngine ? memorySpecForRequest(auth?.memoryScope, body.memoryWrite, s4DefaultScopes) : undefined,
+            // 件A origin 盖章(#148 件3④):部署形态维随 requirePrincipal——多租户下登记簿种子(projectId
+            // 选定)按 request 盖章走 core 准入门,单用户一律 deployment(v4 §1 N2;零 org 键=整键缺席零迁移)。
+            memory: memoryEngine ? memorySpecForRequest(auth?.memoryScope, body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }) : undefined,
             // Scenario-provided capabilities (e.g. code-review = repo tools + reviewer subagents + prompt).
             // RFC A2: the SelectEnvironment tool rides after the scenario's tools (spec.tools is ADDITIVE to core's
             // built-in roster — prepare-task mounts first-party tools separately). Only when the image chain is live.
@@ -711,10 +732,11 @@ export function createResolveSpec(ctx) {
             // operator with approval intent but no checkpointStore falls to `undefined` (core's UNGATED warning).
             // Durable ask (TC-5.4, core 1.95): in durable mode an AskUserQuestion call suspends like an F4 gate —
             // the question policy adjudicates it `ask`, the operator answers out-of-band, and the resume carries
-            // the QuestionAnswer (server.ts `body.answer` → onQuestion closure). Suspend side mounts the tool with
-            // QUESTION_AWAITS_RESUME (it must never run pre-suspend; reaching it = wiring bug, typed throw).
+            // the QuestionAnswer (server.ts `body.answer` → onQuestion closure). #152([2703] 案二): the question
+            // policy is LIVE-AWARE when the QuestionCoordinator is wired — a live-stream leg adjudicates `allow`
+            // (the live human answers over the stream) instead of unconditionally parking; see durableQuestionPolicy.
             toolPolicy: durableEnabled
-                ? combinePolicies(createDurableQuestionPolicy(), createDurableAskPolicy({
+                ? combinePolicies(durableQuestionPolicy(liveQuestionFace), createDurableAskPolicy({
                     requireApproval: config.approvalRequire, deny: config.approvalDeny, autoBudget: config.approvalAutoBudget, neverAuto: config.approvalNeverAuto,
                     // The probe key is the CONTINUED session (auth.sessionId — the same id that keys the
                     // durable checkpoint /decide route). A fresh session (no body.sessionId) has no exemptions by
@@ -761,7 +783,11 @@ export function createResolveSpec(ctx) {
                         isCascade: body.cascade === true,
                         scope: encodeCheckpointScope(auth?.principal),
                     })),
-                    onQuestion: QUESTION_AWAITS_RESUME,
+                    // #152([2703] 案二):sentinel 只在活体面缺席时 stamp。core 取 `spec.onQuestion ?? deps.onQuestion`
+                    // (spec 位恒赢),无条件 stamp 会把 ASK_QUESTION_ENABLED 部署的活人腿永久遮蔽成 durable park。
+                    // 活体面在场 ⇒ 键缺席,RunnerDeps.onQuestion 的 coordinator 生效;park 与否由上面的判决门分腿。
+                    // (suspend 侧的「未答 approve」拒绝不靠 sentinel:server.ts decide 路由 pre-CAS 400 守着。)
+                    ...(liveQuestionFace === undefined ? { onQuestion: QUESTION_AWAITS_RESUME } : {}),
                 }
                 : {}),
         };

package/dist/boot/runner-deps.d.ts

@@ -49,6 +49,10 @@ export interface RunnerDepsCtx {
         root: string;
     } | undefined;
     memorySyncRunner: MemorySyncRunner | undefined;
+    /** design/170 件A(#148 件3③):org 记忆准入两 seam 的装配产物(boot/org-memory.ts)。进**共享
+     *  基座**——主/sub 两 Runner 必须同源:委托子代的 prepare 同样跑准入(委托冻结的重判腿),漏挂
+     *  subRunner=子代平面绕过目录判决。 */
+    orgMemoryAdmission: import("./org-memory.js").OrgMemoryAdmissionWiring;
     toolResultStore: ToolResultStoreFull | undefined;
     sessionPolicyStore: ReturnType<StoreBackend["sessionPolicy"]> | undefined;
     runtimeCapsResolver: RunnerDeps["runtimeCapsResolver"];
@@ -68,7 +72,7 @@ export interface RunnerDepsCtx {
 }
 /** design/158 A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes">;
 /**
  * design/158 A10 留档发现②(review 2026-07-29,[1543]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -97,7 +101,7 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
 /** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "sessionPolicyStore" | "usageWindowStore">;
+export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "sessionPolicyStore" | "usageWindowStore" | "orgMemoryAdmission">;
 export declare function createSharedRunnerDeps(ctx: SharedRunnerDepsCtx): SharedRunnerDeps;
 export declare function createRunnerDeps(ctx: RunnerDepsCtx): RunnerDeps;
 //# sourceMappingURL=runner-deps.d.ts.map

package/dist/boot/runner-deps.js

@@ -49,6 +49,12 @@ export function createSharedRunnerDeps(ctx) {
         // E6: operator-tightened session tool rules — core folds them into the ToolPolicy FIRST (subtract-only) for tasks
         // carrying a sessionId (a delegated subagent has none → inherits no rules). Opt-in: undefined ⇒ no rules read.
         sessionPolicyStore: ctx.sessionPolicyStore ? ctx.sessionPolicyStore : undefined,
+        // design/170 件A:org 记忆准入两 seam(core 5.13.0)。共享基座=主/sub 同源(委托子代 prepare 的
+        // 委托冻结重判腿同样过目录);resolver 缺席=core 对 request-origin org 铸 admission_required
+        // fail-closed,deployment 自证集空=键缺席(诚实缺席>空数组——core 按 Set 语义消费,空集与缺席
+        // 同义,但缺席让 deps 字面量不携带死键)。
+        memoryScopeAdmission: ctx.orgMemoryAdmission.memoryScopeAdmission ? ctx.orgMemoryAdmission.memoryScopeAdmission : undefined,
+        deploymentMemoryScopes: ctx.orgMemoryAdmission.deploymentMemoryScopes && ctx.orgMemoryAdmission.deploymentMemoryScopes.length > 0 ? ctx.orgMemoryAdmission.deploymentMemoryScopes : undefined,
         // design/166-T1:治理窗两键**成对**且进共享基座——主/sub/hook 三 runner 全覆盖(漏挂 subRunner=
         // 子代用量不进窗,治理可被 subagent 刷穿;双记不存在:core stats.nested 是旁路侧栏不折入
         // stats.tokens,governance.commit 是 per-任务 delta 制)。store 只在 config.usageWindows 配置时
@@ -203,8 +209,11 @@ export function createRunnerDeps(ctx) {
         // E23: the live-only inbound-elicitation seam. core invokes it only for servers that opted in via
         // McpServerSpec.elicitation (default OFF) AND only when this is wired — both must hold (doubly fail-closed).
         onElicit: elicitation ? elicitation.elicit : undefined,
-        // §4④: the live AskUserQuestion seam. core mounts the tool when onQuestion is present + routes each ask here; the
-        // DURABLE leg's spec.onQuestion (QUESTION_AWAITS_RESUME) OVERRIDES this per-task so a disconnected-human ask suspends.
+        // §4④: the live AskUserQuestion seam. core mounts the tool when onQuestion is present + routes each ask here.
+        // #152([2703] 案二): with the coordinator wired the durable leg NO LONGER stamps spec.onQuestion
+        // (QUESTION_AWAITS_RESUME) — park-vs-live is decided per-leg by resolve-spec's live-aware question policy
+        // (live-stream leg → this coordinator; no-live-context leg → durable park). The sentinel is stamped only
+        // when the coordinator is absent (ASK_QUESTION_ENABLED off).
         onQuestion: question ? question.question : undefined,
         // [816]/[820]②: the live tool-approval seam (core `resolveAsk` — `spec.onAsk ?? deps.onAsk`). ALS-routed like
         // onQuestion: a leg wrapped by the coordinator's runWithContext reaches the human.

package/dist/config-center/http-client.d.ts

@@ -38,6 +38,7 @@ export declare function fetchPrincipalCaps(baseUrl: string, token: string, princ
     scenario?: ScenarioRuling;
     execution?: ExecutionRuling;
     executionDrift?: string;
+    orgMemory?: unknown;
     etag?: string;
 } | null>;
 /** An HTTP error from a config-center fetch that carries the response status so callers can branch on it

package/dist/config-center/http-client.js

@@ -5,7 +5,7 @@
  * facade re-exports every symbol below unchanged).
  */
 import { createHash } from "node:crypto";
-import { readEffectiveWire } from "@sema-agent/registry-core";
+import { readEffectiveWire, PrincipalCapsWire } from "@sema-agent/registry-core";
 import { centerPromptsFromEffective } from "../prompts-domain-validate.js"; // #100 worker 腿 prompts 边界归一(中立叶)
 /** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
  *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[2281] 裁B)。
@@ -94,7 +94,22 @@ export async function fetchPrincipalCaps(baseUrl, token, principal, etag, fetchI
     }
     if (!res.ok)
         throw new Error(`config-center principal-caps HTTP ${res.status}`);
-    const body = (await res.json());
+    // 边界读=schema(clay 宪法 [2704] §2,同源锚=registry-core PrincipalCapsWire):治理面
+    // runtimeCaps/budget 严格+passthrough(值漂移整体拒 ⇒ 本函数 throw ⇒ resolver fail-close,
+    // 「outage 绝不静默 GRANT」同向);[565]/[580] fail-open 面与 orgMemory(C3 失败域隔离)在
+    // schema 里保持宽读,归一/校验仍在下方与目录腿(极性不因 schema 化翻转)。
+    const parsedBody = PrincipalCapsWire.safeParse(await res.json());
+    if (!parsedBody.success) {
+        throw new Error(`config-center principal-caps body failed schema validation: ${parsedBody.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ").slice(0, 600)}`);
+    }
+    const body = parsedBody.data;
+    // design/170 件A C8(响应 principal 回声核,串租户防线一行):center 两条 ?principal= 腿的 body 都
+    // 回带 principal——在场且与请求不符 = 中间层/LB 把别人的 caps 视图递了过来,弃用整响应(throw ⇒
+    // caps 腿 fail-close、org 目录腿记 unavailable)。键缺席 = 旧 center 形,按无证据容忍(回声核只拦
+    // 「有回声且对不上」的确定性错递,不把旧形升级成故障)。
+    if (body.principal !== undefined && body.principal !== principal) {
+        throw new Error(`config-center principal-caps response echoes principal ${JSON.stringify(body.principal)} but ${JSON.stringify(principal)} was requested — discarding the whole response (cross-tenant delivery defense)`);
+    }
     return {
         runtimeCaps: body.runtimeCaps ?? null,
         configured: Boolean(body.configured),
@@ -120,28 +135,37 @@ export async function fetchPrincipalCaps(baseUrl, token, principal, etag, fetchI
         // and a drifted `required` into silent non-enforcement. Now: drift ⇒ DROP the whole ruling (fail-open,
         // gate passes) + `executionDrift` so the caller's audit line fires (the resolver routes it to onError).
         ...((() => {
-            const ex = body.execution;
-            if (ex === undefined || ex === null)
+            // [2704] §1:unknown 面的窄化走运行时类型谓词(真检查),不走断言。
+            const isRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+            const exRaw = body.execution;
+            if (exRaw === undefined || exRaw === null)
                 return {};
-            if (typeof ex.required !== "boolean")
-                return { executionDrift: `execution.required is ${typeof ex.required}, expected boolean — ruling dropped (fail-open)` };
-            if (!Array.isArray(ex.allowedLanes))
-                return { executionDrift: `execution.allowedLanes is ${typeof ex.allowedLanes}, expected string[] — ruling dropped (fail-open)` };
-            const execution = { required: ex.required, allowedLanes: ex.allowedLanes.filter((s) => typeof s === "string") };
+            if (!isRecord(exRaw))
+                return { executionDrift: `execution is ${Array.isArray(exRaw) ? "array" : typeof exRaw}, expected object — ruling dropped (fail-open)` };
+            if (typeof exRaw.required !== "boolean")
+                return { executionDrift: `execution.required is ${typeof exRaw.required}, expected boolean — ruling dropped (fail-open)` };
+            if (!Array.isArray(exRaw.allowedLanes))
+                return { executionDrift: `execution.allowedLanes is ${typeof exRaw.allowedLanes}, expected string[] — ruling dropped (fail-open)` };
+            const execution = { required: exRaw.required, allowedLanes: exRaw.allowedLanes.filter((s) => typeof s === "string") };
             // registry-core 0.10.1-0.10.2:execution.sessionMirror 宽读。observation-only 子面
             // (server 非执法端,见 ExecutionRuling.sessionMirror 注),所以形状漂移只丢**本子面**并走 executionDrift
             // 审计线(resolver 路由到 onError),**绝不**连带丢 lane ruling(那是真执法面,不能被观测子面拖垮)。
             // required 缺省 false = registry-core zod 默认(便利态);engineUrl 必须非空 string。
-            if (ex.sessionMirror !== undefined && ex.sessionMirror !== null) {
-                const sm = ex.sessionMirror;
-                const smOk = typeof sm === "object" && typeof sm.engineUrl === "string" && sm.engineUrl.length > 0 && (sm.required === undefined || typeof sm.required === "boolean");
-                if (smOk)
+            if (exRaw.sessionMirror !== undefined && exRaw.sessionMirror !== null) {
+                const sm = exRaw.sessionMirror;
+                if (isRecord(sm) && typeof sm.engineUrl === "string" && sm.engineUrl.length > 0 && (sm.required === undefined || typeof sm.required === "boolean")) {
                     execution.sessionMirror = { engineUrl: sm.engineUrl, required: sm.required === true };
-                else
+                }
+                else {
                     return { execution, executionDrift: "execution.sessionMirror malformed — mirror observation dropped (fail-open; lane ruling kept)" };
+                }
             }
             return { execution };
         })()),
+        // design/170 件A:org 记忆解析段**原值透传**(键在场保在场、缺席保缺席——缺席=旧 center 能力握手,
+        // org 目录腿据此判 section_absent 瞬时;形状校验是 org-memory-admission 模块用 PrincipalOrgMemoryWire
+        // 的事,本腿保持薄透传不预判)。
+        ...("orgMemory" in body ? { orgMemory: body.orgMemory } : {}),
         etag: res.headers.get("etag") ?? undefined,
     };
 }

package/dist/config-types.d.ts

@@ -205,6 +205,21 @@ export interface ServiceConfigFlat {
         maxPushEntries?: number;
         maxPullEntries?: number;
     };
+    /** design/170 件A(clay 三裁 [2687]):org 记忆准入模式。`enforce`(默认)=判决即结果;`audit`=判决
+     *  照算但纯观察零行为变化(不整拒、不窄化 writeScope,只记 would-deny/would-narrow)——运维诊断位,
+     *  非发布步骤(audit-first 灰度步按裁2 免除)。env `MEMORY_ORG_ADMISSION_MODE`(enumEnv 二值)。 */
+    memoryOrgAdmissionMode: "audit" | "enforce";
+    /** 件A 单机形目录:env `MEMORY_ORG_DIRECTORY_JSON` 原文(`Record<principal, Record<org:scope, {write?}>>`)。
+     *  config 解析期即整段校验(parseOrgDirectoryStatic,fail-loud);此处存**原文**(config=纯数据,
+     *  Map 在装配点重建)。与 config-center 目录腿互斥的裁决在装配点(两者都在=center 腿胜,env 表忽略
+     *  并 warn——授权面不做双源合并)。 */
+    memoryOrgDirectoryJson?: string;
+    /** 件A 目录 granted(含负结果)缓存 TTL(ms)。新任务/新 resume 腿的准入判决滞后上限=此值(「TTL 即
+     *  有界 LKG」);与同仓保护面 grant TTL 对齐默认 60s。env `MEMORY_ORG_GRANT_TTL_MS`(numEnvBounded)。 */
+    memoryOrgGrantTtlMs: number;
+    /** 件A 目录 unavailable 退避窗(ms)——取数失败的退避语义(bound center hammering),不是策略负结果。
+     *  默认 10s。env `MEMORY_ORG_UNAVAILABLE_BACKOFF_MS`(numEnvBounded)。 */
+    memoryOrgUnavailableBackoffMs: number;
     /** design/48 v1b + design/61: opt-in remote execution backend (PEER adapters, chosen by REMOTE_EXEC). Unset
      *  (OA/review deployments) → in-process stub env, zero behavior change. Secrets (apiKey/privateKey) ONLY from env.
      *   - `e2b`  → per-task E2B Firecracker VM (isolated, suspendable). The default code-agent worker.
@@ -893,7 +908,7 @@ export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" |
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
 export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "askQuestionEnabled" | "toolApprovalEnabled" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
-export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memorySync" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
+export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memorySync" | "memoryOrgAdmissionMode" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析
  *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;

package/dist/config.js

@@ -987,6 +987,18 @@ function parseMemoryDomain(ctx) {
     // design/158 B4 ② 的 D 家族四枚里,唯一落在 ServiceConfig 上的就是这枚(其余三枚只在使用点懒读,
     // 预登记留在 orchestration 域 —— 顺序与改前一致:本枚的弃用通知仍先于那三枚)。
     const projectMemoryEnabled = boolEnvWithLegacyNegated("PROJECT_MEMORY_ENABLED", "PROJECT_MEMORY_DISABLED", true);
+    // design/170 件A(clay 三裁 [2687]):org 记忆准入四旋钮。模式=enumEnv 二值非布尔(N9),默认
+    // enforce(裁2:audit-first 灰度步免除,audit 降级为运维诊断位);TTL/退避窗=numEnvBounded 启动期
+    // 报错(env-numeric-fail-loud 门,F6:optFinitePositiveEnv 的静默回默认恰是要消灭的形)。单机目录
+    // env 表在这里就整段校验(fail-loud 越早越好——一张半坏的授权表比拒绝启动更危险),config 上只存
+    // 原文(纯数据;Map 在装配点重建)。
+    const memoryOrgAdmissionMode = enumEnv("MEMORY_ORG_ADMISSION_MODE", "enforce", ["audit", "enforce"]);
+    // 原文存 config(纯数据);整段 fail-loud 校验(parseOrgDirectoryStatic)在装配点——它传递值引
+    // security.js(assertPrincipalShape),而 base config 层禁值引 auth 模块(design/158 A4 分层),
+    // 校验不能放这里。装配点仍在启动期,坏表照样拒启动。
+    const memoryOrgDirectoryJson = process.env.MEMORY_ORG_DIRECTORY_JSON || undefined;
+    const memoryOrgGrantTtlMs = numEnvBounded("MEMORY_ORG_GRANT_TTL_MS", "60000", 1000, 3_600_000);
+    const memoryOrgUnavailableBackoffMs = numEnvBounded("MEMORY_ORG_UNAVAILABLE_BACKOFF_MS", "10000", 500, 600_000);
     return {
         memoryEngineEnabled,
         memoryEngineDir: process.env.MEMORY_ENGINE_DIR || undefined,
@@ -1000,6 +1012,10 @@ function parseMemoryDomain(ctx) {
         memoryEngineBackend,
         memoryScope, // hoisted above (the 142-S2.5-W1 sync-scope default consumes it)
         ...(memorySync ? { memorySync } : {}),
+        memoryOrgAdmissionMode,
+        ...(memoryOrgDirectoryJson !== undefined ? { memoryOrgDirectoryJson } : {}),
+        memoryOrgGrantTtlMs,
+        memoryOrgUnavailableBackoffMs,
         projectMemoryEnabled, // design/113 C4 opt-out, flipped positive in design/158 B4 (3.0.0 起 legacy PROJECT_MEMORY_DISABLED = fail-loud 墓碑)
         syncImportLeaseStaleSec: Math.max(0, numEnv("SYNC_IMPORT_LEASE_STALE_SEC", "600")),
     };
@@ -1362,7 +1378,8 @@ const APPROVAL_GROUP_KEYS = [
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",
-    "memorySync", "projectMemoryEnabled", "syncImportLeaseStaleSec",
+    "memorySync", "memoryOrgAdmissionMode", "memoryOrgDirectoryJson", "memoryOrgGrantTtlMs", "memoryOrgUnavailableBackoffMs",
+    "projectMemoryEnabled", "syncImportLeaseStaleSec",
 ];
 const AUTH_GROUP_KEYS = [
     "authToken", "authTokens", "allowUnauthedWrites", "corsOrigins", "principalHeader", "requirePrincipal", "autonomy",

package/dist/fleet/fleet-bus.d.ts

@@ -1,3 +1,12 @@
+import type { TaskNotificationPayload } from "@sema-agent/core";
+/** [2687-cli] 幽灵行案的单源判别:一条 `task_notification` 只有在 **agent 族 × 终态** 时才允许打
+ *  `onChildTerminal`(fleet「subagent 树」只渲 agent 子代)。`background_bash`/`monitor`/`external`
+ *  不属 agent fleet 树——它们此前每条都打,fleet-bus 的「无 tick 无 claim」臂给 b\* 与 m\* handle 合成
+ *  agent 形瞬态终帧,壳终态留存池把这帧渲 60s = footer 幽灵子行;monitor 的 `status:"event"` 还被
+ *  终态映射折成 `failed`。**两侧都正向枚举**(新 task_type/新 status 默认不铸行=安全方向)。
+ *  与 core `isDelegatedAgentTerminal`(task-notification.js,未从包根导出)语义同源——core 根导出后
+ *  换装 import 删本镜像(提货件已上板)。 */
+export declare function isFleetAgentTerminalNotification(n: Pick<TaskNotificationPayload, "task_type" | "status">): boolean;
 /** The fleet vocabulary the shell renders (MF-Fleet `FleetTask.status`). The service maps its run/workflow status
  *  onto this neutral set; `awaiting approval` = a needs-review/plan-approval park, `waiting` = a durable suspend.
  *

package/dist/fleet/fleet-bus.js

@@ -22,6 +22,16 @@
  */
 import { EventEmitter } from "node:events";
 import { redactSecrets } from "../trace/redact.js";
+/** [2687-cli] 幽灵行案的单源判别:一条 `task_notification` 只有在 **agent 族 × 终态** 时才允许打
+ *  `onChildTerminal`(fleet「subagent 树」只渲 agent 子代)。`background_bash`/`monitor`/`external`
+ *  不属 agent fleet 树——它们此前每条都打,fleet-bus 的「无 tick 无 claim」臂给 b\* 与 m\* handle 合成
+ *  agent 形瞬态终帧,壳终态留存池把这帧渲 60s = footer 幽灵子行;monitor 的 `status:"event"` 还被
+ *  终态映射折成 `failed`。**两侧都正向枚举**(新 task_type/新 status 默认不铸行=安全方向)。
+ *  与 core `isDelegatedAgentTerminal`(task-notification.js,未从包根导出)语义同源——core 根导出后
+ *  换装 import 删本镜像(提货件已上板)。 */
+export function isFleetAgentTerminalNotification(n) {
+    return n.task_type === "background_agent" && (n.status === "completed" || n.status === "failed" || n.status === "killed" || n.status === "cancelled");
+}
 /**
  * The process-local fleet aggregation bus. Holds the current active set + fans out deltas to SSE subscribers.
  * Upserts MERGE (a partial delta patches the existing row), so a publisher can emit just the field that changed

package/dist/http/routes/tasks.js

@@ -1,7 +1,7 @@
 import { runWithVerification, runCascade, uuidv7 } from "@sema-agent/core";
 import { markChildrenStoppedByUserOnAbort, resumeAtHttpStatus, stripCheckpointToken, HEARTBEAT_MS } from "../../runs.js";
 import { withPrincipal } from "../../observability/principal-context.js";
-import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals } from "../../fleet/fleet-bus.js";
+import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../../fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "../../fleet/subagent-tail-bus.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
 import { createLedgerSink } from "../../trace/ledger-sink.js";
@@ -448,7 +448,9 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                         defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
                                     }
                                     // id-domain alias: flip by payload.sessionId (= the tick's uuid domain), fallback task_id.
-                                    const hadRow = fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false;
+                                    // [2687-cli] 幽灵行案:只对 agent 族终态打(isFleetAgentTerminalNotification 单源判别,
+                                    // 病灶链见其 doc 注);bash/monitor 的通知帧/park 面照走。孪生:runs.ts bg 腿、http/server.ts resume 腿。
+                                    const hadRow = isFleetAgentTerminalNotification(n) ? (fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false) : false;
                                     // 🔴 对抗评审 2026-07-11(HIGH,「下一 turn 0 帧」最强根因):the teardown WINDOW — after the
                                     // client disconnects (the user killed the turn → ac.abort → core reaps the bg child → THIS
                                     // notification fires) but BEFORE the outer finally flips `syncLegLive=false` (several awaits sit
@@ -1075,7 +1077,13 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 if (resumeAtStatus) {
                     if (durableTaskId && deps.runStore)
                         await deps.runStore.setTerminal(durableTaskId, "failed", stripCheckpointToken(result), result.errorMessage ?? null);
-                    return { status: resumeAtStatus, body: { errorCode: result.errorCode, error: result.errorMessage ?? "resume-at failed" } };
+                    // #148 件4: the transient org-memory refusal carries core's retry hint — forward it as
+                    // retryAfterSec (seconds, ceil; family shape = usage.window_exhausted). ONLY on the transient
+                    // code: a wait hint on a terminal 4xx would be a directional lie.
+                    const retryAfterSec = result.errorCode === "memory.admission_required" && result.retryAfterMs !== undefined
+                        ? Math.max(1, Math.ceil(result.retryAfterMs / 1000))
+                        : undefined;
+                    return { status: resumeAtStatus, body: { errorCode: result.errorCode, error: result.errorMessage ?? "resume-at failed", ...(retryAfterSec !== undefined ? { retryAfterSec } : {}) } };
                 }
                 // Durable suspend on the sync path: PARK it as an async run + return a pollable taskId, NEVER the
                 // capability token. The submitter switches to GET /v1/runs/:id. Cost is recorded

package/dist/http/server.js

@@ -16,7 +16,7 @@ import { runInBackground, evictIfConflict, stripCheckpointToken, TurnAnchorCaptu
 import { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
 import {} from "../orchestration/workflow-agent-steer.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
-import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals } from "../fleet/fleet-bus.js";
+import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "../fleet/subagent-tail-bus.js";
 import {} from "../observability/rate-limit.js";
 import { withPrincipal } from "../observability/principal-context.js";
@@ -1372,9 +1372,10 @@ export function createHttpServer(rawDeps) {
         if (deps.config.remoteExec)
             for (const name of HAND_TOOL_NAMES)
                 availableTools.add(name);
-        // AskUserQuestion (durable ask, TC-5.4) is ALSO not in spec.tools — core mounts it from `onQuestion`, which
-        // the durable path always sets (QUESTION_AWAITS_RESUME on suspend, the answer closure on resume). Without
-        // this it 422s on resume exactly like a hand tool would. Gated on checkpointStore = durable mode is active.
+        // AskUserQuestion (durable ask, TC-5.4) is ALSO not in spec.tools — core mounts it from `onQuestion`
+        // (#152: the QUESTION_AWAITS_RESUME sentinel when no live coordinator is wired, else RunnerDeps.onQuestion's
+        // coordinator serves the seat). Without this it 422s on resume exactly like a hand tool would. Gated on
+        // checkpointStore = durable mode is active.
         if (deps.checkpointStore)
             availableTools.add("AskUserQuestion");
         // Workflow (codex round-2 on [1245]/[1248]②): `run_workflow` is ALSO mounted at the runner, never in
@@ -1775,7 +1776,9 @@ export function createHttpServer(rawDeps) {
                                 defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
                             }
                             // id-domain alias: flip by payload.sessionId (= the tick's uuid domain), fallback task_id.
-                            const hadRow = fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false;
+                            // [2687-cli] 幽灵行案:只对 agent 族终态打(isFleetAgentTerminalNotification 单源判别,
+                            // 病灶链见其 doc 注);bash/monitor 的通知帧/park 面照走。孪生:runs.ts bg 腿、routes/tasks.ts sync 腿。
+                            const hadRow = isFleetAgentTerminalNotification(n) ? (fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false) : false;
                             const parked = !resumeLegLive && Boolean(deps.workflowCompletionInbox && sessionId);
                             // diagnosability (rationale in runs.ts twin).
                             deps.logger?.info?.("task_notification_observed", { route: "resume", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: resumeLegLive, parkedDurable: parked });

package/dist/main.js

@@ -46,6 +46,7 @@ import { createWorkflowOrchestration } from "./boot/workflow-orchestration.js";
 import { createLiveCoordinators } from "./boot/coordinators.js";
 import { createRuntimeCaps } from "./boot/runtime-caps.js";
 import { createRunnerDeps, createSharedRunnerDeps } from "./boot/runner-deps.js";
+import { createOrgMemoryAdmissionWiring } from "./boot/org-memory.js";
 import { createSessionFaces } from "./boot/session-faces.js";
 import { createLeaderFace } from "./boot/leader.js";
 import { installShutdownHandlers } from "./boot/shutdown.js";
@@ -183,13 +184,15 @@ async function main() {
     const { elicitation, question, toolApproval, durableEnabled, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({ config, logger, backend, sendUserFileTaskEnvs });
     // design/158 A10:per-principal caps 段搬到 src/boot/runtime-caps.ts(逐字)。
     const { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver } = createRuntimeCaps({ config, logger });
+    // design/170 件A(#148 件3③):org 记忆准入装配(目录源三态选择+C12 能力探测,坏配置在此拒启动)。
+    const orgMemoryAdmission = createOrgMemoryAdmissionWiring({ config, logger, metrics });
     // design/158 A10:RunnerDeps 装配段搬到 src/boot/runner-deps.ts(逐字;runStore 晚绑改取值,见该文件头注)。
     const runnerDeps = createRunnerDeps({
         config, logger, metrics, localRoot, promptSource: configCenter.promptSource, rosterStore, backgroundAgentStore, mailboxStore, usageWindowStore, brain,
         pricing, tracer, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine,
         memorySyncRunner, toolResultStore, sessionPolicyStore, runtimeCapsResolver, fileSnapshotStore,
         executionEnvFactory, lspManager, fleetBus, deploymentHooks, workflowRunStore, workflowJournalStore,
-        workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion,
+        workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, orgMemoryAdmission,
         getRunStore: () => runStore,
     });
     const runner = new Runner(runnerDeps);
@@ -330,6 +333,7 @@ async function main() {
             toolResultStore,
             sessionPolicyStore,
             usageWindowStore,
+            orgMemoryAdmission,
         }),
         // ── 以下为 subRunner 差异键(不在共享基座;逐个有因)──────────────────────────────────────
         sessionStore: subRunnerSessions, // 子代转录=私有短 TTL fork 路由店,生命周期异于宿主 durable 店
@@ -870,6 +874,7 @@ async function main() {
         selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore,
         singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage,
         sessionEnvSelection,
+        liveQuestionFace: question, // #152:活体问答面在场 ⇒ durable question 门按活流分腿(见 ResolveSpecCtx 注)
     });
     const server = createHttpServer({ runner, config, resolveSpec, stores, coordinators, seams, observability, governance, deployment, knobs });
     // D-D SLA-timer: wire the server's deny-sweep into the reaper holder declared above (the reaper is defined

package/dist/memory-scope.d.ts

@@ -58,9 +58,18 @@ export declare function memoryEngineBackendFor(config: ServiceConfig, fallbackRo
  * (memory feature off for this run). Pure (testable in isolation) — main.ts's resolveSpec composes it with the
  * engine-backend presence guard.
  */
-export declare function memorySpecForRequest(scope: string | undefined, memoryWrite: boolean | undefined, defaultScopes?: string[]): {
+export declare function memorySpecForRequest(scope: string | undefined, memoryWrite: boolean | undefined, defaultScopes?: string[], 
+/** design/170 件A(#148 件3④):origin 盖章的部署形态维(N2)。`multiTenant=true`(requirePrincipal)
+ *  ⇒ 登记簿 defaultScopes 的 org 键按 **request** 盖章(条目由调用方 projectId 选定=caller 可影响的
+ *  选择器,core 准入门据此过目录判决);单用户 ⇒ 一律 deployment(operator 登记簿条目归 deployment,
+ *  否则单用户部署被自家规则整拒——v4 §0 伤害①的成立前提)。缺参=旧调用形,不盖章(整键缺席=
+ *  core legacy 语义,零迁移)。 */
+originPolicy?: {
+    multiTenant: boolean;
+}): {
     scopes: string[];
     writeScope?: string | null;
     scopeContract?: "v2";
+    scopeOrigins?: Record<string, "deployment" | "request">;
 } | undefined;
 //# sourceMappingURL=memory-scope.d.ts.map

package/dist/memory-scope.js

@@ -98,7 +98,13 @@ export function memoryEngineBackendFor(config, fallbackRoot) {
  * (memory feature off for this run). Pure (testable in isolation) — main.ts's resolveSpec composes it with the
  * engine-backend presence guard.
  */
-export function memorySpecForRequest(scope, memoryWrite, defaultScopes) {
+export function memorySpecForRequest(scope, memoryWrite, defaultScopes, 
+/** design/170 件A(#148 件3④):origin 盖章的部署形态维(N2)。`multiTenant=true`(requirePrincipal)
+ *  ⇒ 登记簿 defaultScopes 的 org 键按 **request** 盖章(条目由调用方 projectId 选定=caller 可影响的
+ *  选择器,core 准入门据此过目录判决);单用户 ⇒ 一律 deployment(operator 登记簿条目归 deployment,
+ *  否则单用户部署被自家规则整拒——v4 §0 伤害①的成立前提)。缺参=旧调用形,不盖章(整键缺席=
+ *  core legacy 语义,零迁移)。 */
+originPolicy) {
     if (!scope)
         return undefined;
     // 142-S1.5: a scope carrying a v2 typed prefix rides WITH the explicit contract marker — core validates
@@ -119,7 +125,21 @@ export function memorySpecForRequest(scope, memoryWrite, defaultScopes) {
     // 最后一层就是派生 scope=正确,不钉保持最小形)。
     const layered = extras.length > 0 ? { scopes: [scope, ...extras], writeScope: scope } : { scopes: [scope] };
     const v2 = isV2(scope) || extras.some(isV2) ? { scopeContract: "v2" } : {};
+    // 件A origin 盖章(core 5.13.0 `memory.scopeOrigins` 两格语义):只盖 org 键(非 org 不入准入判决,
+    // v4 §1);派生/env 位的 `scope` org 形只可能来自 operator 显式 MEMORY_SCOPE(memoryScopeFor 多租户
+    // 恒铸 user: 形)⇒ deployment;登记簿种子按部署形态维分格(见参数注)。零 org 键 ⇒ 整键缺席
+    // (core legacy 零迁移;非 org 部署形状逐字节不变=additive 锁)。
+    const stamped = {};
+    if (originPolicy !== undefined) {
+        if (scope.startsWith("org:"))
+            stamped[scope] = "deployment";
+        for (const extra of extras) {
+            if (extra.startsWith("org:"))
+                stamped[extra] = originPolicy.multiTenant ? "request" : "deployment";
+        }
+    }
+    const origins = Object.keys(stamped).length > 0 ? { scopeOrigins: stamped } : {};
     // memoryWrite === false(MF-30 pause)wins over the layered writeScope pin — 只读语义在有种子时同样成立。
-    return memoryWrite === false ? { ...layered, writeScope: null, ...v2 } : { ...layered, ...v2 };
+    return memoryWrite === false ? { ...layered, writeScope: null, ...v2, ...origins } : { ...layered, ...v2, ...origins };
 }
 //# sourceMappingURL=memory-scope.js.map

package/dist/org-memory-admission.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Org 记忆准入 resolver — server 侧对接 @sema-agent/core@5.13.0 `RunnerDeps.memoryScopeAdmission` seam。
+ * 授权事实来自「目录」抽象:远程腿 = config-center per-principal caps 响应里的 `orgMemory` 段(形状
+ * 同源锚 = registry-core `PrincipalOrgMemoryWire`,zod schema 直接 safeParse);单机腿 = env JSON 静态表
+ * (`MEMORY_ORG_DIRECTORY_JSON`,{@link parseOrgDirectoryStatic} 装载,启动期 fail-loud)。
+ *
+ * 判别联合 {@link OrgDirectoryLookup} 是本模块的核心裁定(设计 N3/C5):取数成功(granted,含零授权空表
+ * = 负结果)与瞬时不可用(unavailable)绝不塌成一格——granted 空表是 resolver 可以终局判决的「事实」
+ * (「这个 principal 没有这个 scope」),unavailable 必须让 core 铸瞬时码 memory.admission_required 重试,
+ * 而不是被误判成「没这个 scope」而永久拒绝。
+ *
+ * core 侧契约(RunnerDeps.memoryScopeAdmission,core types.d.ts):resolver 返回 {ok:false} ⇒ core 铸终局码
+ * memory.admission_denied;resolver throw 一个带 `retryAfterMs`(ms)属性的 Error ⇒ core 铸瞬时码
+ * memory.admission_required 并透传 retryAfterMs;{ok:true}.scopes 只能 ⊆ requested(多给 = resolver fault
+ * 会被 core 整拒)。core 只在「存在 request-origin org scope 且 principal 缺席」时自己先拒——本模块仍防御
+ * `principal === undefined` 这一支(不能信任「core 一定先拒过」这件事)。
+ */
+import type { MemoryScopeAdmission } from "@sema-agent/core";
+/**
+ * 单机腿:装载 `MEMORY_ORG_DIRECTORY_JSON`(`Record<principal, Record<orgScope, {write?}>>`)。启动期调用,
+ * **fail-loud**——任何非法直接 throw 且消息点名坏在哪个键(响亮拒是正确方向:一张半坏的授权表比拒绝
+ * 启动更危险)。principal 键复用 {@link assertPrincipalShape}(拒保留哨兵/超长租户名,与所有其它
+ * principal 入口同一道闸);scope 键必须是 `org:` 前缀、值必须是仅含可选 `write: boolean` 的 plain object。
+ */
+export declare function parseOrgDirectoryStatic(json: string): Map<string, Record<string, {
+    write?: boolean;
+}>>;
+/**
+ * 目录条目的判别联合(设计裁定 N3/C5):`granted` 是取数成功——包括零授权空表(负结果,由 resolver
+ * 判终局拒);`unavailable` 是瞬时臂(取数本身失败/形状不可信/LB 陈旧副本),只在这一支才该让 core 重试。
+ */
+export type OrgDirectoryLookup = {
+    kind: "granted";
+    scopes: Readonly<Record<string, {
+        write?: boolean;
+    }>>;
+} | {
+    kind: "unavailable";
+    reason: OrgDirectoryUnavailableReason;
+    retryAfterMs: number;
+};
+/** {@link createOrgMemoryDirectory} 的产物 —— 单一 per-principal 查表口。 */
+export interface OrgMemoryDirectory {
+    lookup(principal: string): Promise<OrgDirectoryLookup>;
+}
+export interface OrgMemoryDirectoryOptions {
+    /** 远程腿:返回 caps 响应的 `orgMemory` 段原值(unknown,本模块用 `PrincipalOrgMemoryWire.safeParse` 校验)。
+     *  返回 undefined = 响应里键整体缺席(旧 center 能力握手)⇒ unavailable("section_absent")。
+     *  throw = fetch 失败 ⇒ unavailable("fetch_failed")。
+     *  与 `staticTable` 互斥:二者恰好给一个(装配点保证;都给或都缺 = 构造期 throw,fail-loud)。 */
+    fetchSection?: (principal: string) => Promise<unknown>;
+    /** 单机腿:{@link parseOrgDirectoryStatic} 的产物。查表恒「取数成功」:缺 principal ⇒ granted 空表。 */
+    staticTable?: Map<string, Record<string, {
+        write?: boolean;
+    }>>;
+    /** granted(含负结果)缓存 TTL——ms。负结果与正授权同 TTL:未授权 principal 不该比授权 principal 打出
+     *  更多流量。默认值不在本模块(接线点决定,设计定 60_000)。 */
+    grantTtlMs: number;
+    /** 一次 unavailable 之后,同 principal 在这个窗口内的 lookup 直接返回 unavailable(不重新 fetch)——
+     *  防止对一个持续故障/未授权目标反复打 center。默认值不在本模块(接线点决定,设计定 10_000)。 */
+    unavailableBackoffMs: number;
+    /** 时间注入(测试用);默认 `Date.now`。 */
+    now?: () => number;
+}
+type OrgDirectoryUnavailableReason = "fetch_failed" | "section_absent" | "malformed" | "stale_generation";
+/**
+ * 建目录:远程腿(fetchSection,per-principal TTL 缓存 + in-flight 去重 + 退避窗 + gen 高水位)或单机腿
+ * (staticTable,恒同步成功、无 TTL/退避语义——operator 自证配置面)。两腿互斥,装配点必须恰好给一个。
+ */
+export declare function createOrgMemoryDirectory(opts: OrgMemoryDirectoryOptions): OrgMemoryDirectory;
+export interface MemoryScopeAdmissionOptions {
+    /** "audit": 判决照算但从不真拒——会拒的结果（终局 ok:false 或瞬时 throw）一律换成全额放行 + 观测记录
+     *  would-deny；真通过的判决（含 write 收窄为 null）照常返回。"enforce": 判决即结果。 */
+    mode: "audit" | "enforce";
+    /** 观测 hook。outcome ∈ "ok" | "denied" | "principal_missing" | "directory_absent" | "directory_stale" |
+     *  "directory_malformed"。audit 模式下的 would-deny 也走这里，`details.audited === true`。hook 本身绝不
+     *  允许打断准入判决——一律吞掉它可能抛出的异常。 */
+    onOutcome?: (outcome: string, details?: Record<string, unknown>) => void;
+}
+/** core 侧「瞬时不可用，重试」契约的载体：一个带 `retryAfterMs`（ms）属性的真 Error 子类，core 据此铸
+ *  memory.admission_required 终局码并透传该值。子类而非事后挂属性——避免任何宽松断言就能拿到正确类型。 */
+export declare class OrgMemoryAdmissionRetryError extends Error {
+    readonly retryAfterMs: number;
+    constructor(message: string, retryAfterMs: number);
+}
+/**
+ * `RunnerDeps.memoryScopeAdmission` 的 server 实装。deployment-origin 的 requested 项一律放行（operator
+ * 自证——v1 不做中央收窄部署声明）；request-origin 项查 `directory.lookup(principal)`：granted 时逐项核
+ * 对是否在授权集里（任何一项缺席 = 整体终局拒绝，不做部分放行——reason 只点名调用方自己请求过的 scope
+ * 串，不逐 scope 展开「为什么」，避免变成成员探针）；unavailable 时 throw 一个带 `retryAfterMs` 的
+ * {@link OrgMemoryAdmissionRetryError}。write 面独立收窄：deployment-origin 恒授，request-origin 仅当目录
+ * 条目 `write === true` 才授，否则收窄为 null（即使读侧整体放行）。
+ */
+export declare function createMemoryScopeAdmission(directory: OrgMemoryDirectory, opts: MemoryScopeAdmissionOptions): MemoryScopeAdmission;
+export {};
+//# sourceMappingURL=org-memory-admission.d.ts.map

package/dist/org-memory-admission.js

@@ -0,0 +1,224 @@
+import { PrincipalOrgMemoryWire } from "@sema-agent/registry-core";
+import { assertPrincipalShape } from "./security.js";
+const isPlainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const ORG_SCOPE_RE = /^org:\S+$/;
+/**
+ * 单机腿:装载 `MEMORY_ORG_DIRECTORY_JSON`(`Record<principal, Record<orgScope, {write?}>>`)。启动期调用,
+ * **fail-loud**——任何非法直接 throw 且消息点名坏在哪个键(响亮拒是正确方向:一张半坏的授权表比拒绝
+ * 启动更危险)。principal 键复用 {@link assertPrincipalShape}(拒保留哨兵/超长租户名,与所有其它
+ * principal 入口同一道闸);scope 键必须是 `org:` 前缀、值必须是仅含可选 `write: boolean` 的 plain object。
+ */
+export function parseOrgDirectoryStatic(json) {
+    let parsed;
+    try {
+        parsed = JSON.parse(json);
+    }
+    catch (e) {
+        throw new Error(`MEMORY_ORG_DIRECTORY_JSON is not valid JSON: ${e.message}`);
+    }
+    if (!isPlainObject(parsed)) {
+        throw new Error("MEMORY_ORG_DIRECTORY_JSON must be a JSON object: Record<principal, Record<orgScope, {write?: boolean}>>");
+    }
+    const table = new Map();
+    for (const [principal, scopesRaw] of Object.entries(parsed)) {
+        assertPrincipalShape(principal); // reserved sentinel / oversized tenant name → throws (same gate as every other principal entry point)
+        if (!isPlainObject(scopesRaw)) {
+            throw new Error(`MEMORY_ORG_DIRECTORY_JSON[${JSON.stringify(principal)}] must be an object of org scopes`);
+        }
+        const scopes = {};
+        for (const [scope, entryRaw] of Object.entries(scopesRaw)) {
+            if (!ORG_SCOPE_RE.test(scope)) {
+                throw new Error(`MEMORY_ORG_DIRECTORY_JSON[${JSON.stringify(principal)}] has an invalid org scope key ${JSON.stringify(scope)} (must match /^org:\\S+$/)`);
+            }
+            if (!isPlainObject(entryRaw)) {
+                throw new Error(`MEMORY_ORG_DIRECTORY_JSON[${JSON.stringify(principal)}][${JSON.stringify(scope)}] must be an object`);
+            }
+            for (const key of Object.keys(entryRaw)) {
+                if (key !== "write") {
+                    throw new Error(`MEMORY_ORG_DIRECTORY_JSON[${JSON.stringify(principal)}][${JSON.stringify(scope)}] has an unexpected key ${JSON.stringify(key)} (only "write" is allowed)`);
+                }
+            }
+            if (entryRaw.write !== undefined && typeof entryRaw.write !== "boolean") {
+                throw new Error(`MEMORY_ORG_DIRECTORY_JSON[${JSON.stringify(principal)}][${JSON.stringify(scope)}].write must be a boolean`);
+            }
+            scopes[scope] = entryRaw.write !== undefined ? { write: entryRaw.write } : {};
+        }
+        table.set(principal, scopes);
+    }
+    return table;
+}
+/**
+ * 建目录:远程腿(fetchSection,per-principal TTL 缓存 + in-flight 去重 + 退避窗 + gen 高水位)或单机腿
+ * (staticTable,恒同步成功、无 TTL/退避语义——operator 自证配置面)。两腿互斥,装配点必须恰好给一个。
+ */
+export function createOrgMemoryDirectory(opts) {
+    if ((opts.fetchSection !== undefined) === (opts.staticTable !== undefined)) {
+        throw new Error("createOrgMemoryDirectory requires exactly one of fetchSection or staticTable (both given or both missing)");
+    }
+    if (opts.staticTable !== undefined) {
+        const table = opts.staticTable;
+        return {
+            async lookup(principal) {
+                return { kind: "granted", scopes: table.get(principal) ?? {} };
+            },
+        };
+    }
+    if (opts.fetchSection === undefined) {
+        // Unreachable given the xor guard above (staticTable was undefined, so fetchSection must not be) — this
+        // check exists ONLY so the type checker narrows fetchSection to a function without a cast.
+        throw new Error("createOrgMemoryDirectory: fetchSection missing (invariant violated)");
+    }
+    const fetchSection = opts.fetchSection;
+    const grantTtlMs = opts.grantTtlMs;
+    const backoffMs = opts.unavailableBackoffMs;
+    const now = opts.now ?? (() => Date.now());
+    const states = new Map();
+    const inflight = new Map();
+    function markUnavailable(state, reason) {
+        state.unavailable = { until: now() + backoffMs, reason };
+        // C6: retryAfterMs never 0/negative — the window just opened, so its remaining time IS backoffMs.
+        return { kind: "unavailable", reason, retryAfterMs: Math.max(backoffMs, 1000) };
+    }
+    async function doFetch(principal, state) {
+        let raw;
+        try {
+            raw = await fetchSection(principal);
+        }
+        catch {
+            return markUnavailable(state, "fetch_failed");
+        }
+        if (raw === undefined)
+            return markUnavailable(state, "section_absent");
+        const parsed = PrincipalOrgMemoryWire.safeParse(raw);
+        if (!parsed.success) {
+            // malformed: does NOT touch state.grant — a bad shape must not refresh (or clear) an existing granted entry's
+            // timestamp; a still-fresh old grant keeps serving from cache on the NEXT lookup (checked before we ever get here).
+            return markUnavailable(state, "malformed");
+        }
+        if (state.highWaterGen !== undefined && parsed.data.gen < state.highWaterGen) {
+            // LB stale-replica defense: an older generation than one we've already seen is NEVER adopted.
+            return markUnavailable(state, "stale_generation");
+        }
+        state.highWaterGen = parsed.data.gen;
+        state.grant = { scopes: parsed.data.scopes, at: now() };
+        delete state.unavailable; // a real success clears any prior backoff window
+        return { kind: "granted", scopes: parsed.data.scopes };
+    }
+    return {
+        async lookup(principal) {
+            let state = states.get(principal);
+            if (!state) {
+                state = {};
+                states.set(principal, state);
+            }
+            const t = now();
+            // 1. Fresh grant (positive OR negative/empty result) always wins — no fetch, no backoff check.
+            if (state.grant && state.grant.at + grantTtlMs > t) {
+                return { kind: "granted", scopes: state.grant.scopes };
+            }
+            // 2. Inside an open backoff window → answer from the window WITHOUT re-fetching.
+            if (state.unavailable && state.unavailable.until > t) {
+                return { kind: "unavailable", reason: state.unavailable.reason, retryAfterMs: Math.max(state.unavailable.until - t, 1000) };
+            }
+            // 3. Grant expired (or never existed) and no active backoff → fetch, deduping concurrent callers.
+            const dup = inflight.get(principal);
+            if (dup)
+                return dup;
+            const p = doFetch(principal, state).finally(() => inflight.delete(principal));
+            inflight.set(principal, p);
+            return p;
+        },
+    };
+}
+/** core 侧「瞬时不可用，重试」契约的载体：一个带 `retryAfterMs`（ms）属性的真 Error 子类，core 据此铸
+ *  memory.admission_required 终局码并透传该值。子类而非事后挂属性——避免任何宽松断言就能拿到正确类型。 */
+export class OrgMemoryAdmissionRetryError extends Error {
+    retryAfterMs;
+    constructor(message, retryAfterMs) {
+        super(message);
+        this.retryAfterMs = retryAfterMs;
+        this.name = "OrgMemoryAdmissionRetryError";
+    }
+}
+/**
+ * `RunnerDeps.memoryScopeAdmission` 的 server 实装。deployment-origin 的 requested 项一律放行（operator
+ * 自证——v1 不做中央收窄部署声明）；request-origin 项查 `directory.lookup(principal)`：granted 时逐项核
+ * 对是否在授权集里（任何一项缺席 = 整体终局拒绝，不做部分放行——reason 只点名调用方自己请求过的 scope
+ * 串，不逐 scope 展开「为什么」，避免变成成员探针）；unavailable 时 throw 一个带 `retryAfterMs` 的
+ * {@link OrgMemoryAdmissionRetryError}。write 面独立收窄：deployment-origin 恒授，request-origin 仅当目录
+ * 条目 `write === true` 才授，否则收窄为 null（即使读侧整体放行）。
+ */
+export function createMemoryScopeAdmission(directory, opts) {
+    const emit = (outcome, details) => {
+        try {
+            opts.onOutcome?.(outcome, details);
+        }
+        catch {
+            /* an observability hook must never break admission */
+        }
+    };
+    return async ({ principal, requested, requestedWriteScope }) => {
+        const requestOriginRequested = requested.filter((r) => r.origin === "request");
+        const writeIsRequestOrigin = requestedWriteScope?.origin === "request";
+        const hasRequestOrigin = requestOriginRequested.length > 0 || writeIsRequestOrigin;
+        const fullScopes = requested.map((r) => r.scope);
+        const fullWriteScope = requestedWriteScope?.scope ?? null;
+        const admitFull = () => ({ ok: true, scopes: fullScopes, writeScope: fullWriteScope });
+        async function decide() {
+            // deployment-only requests (no request-origin item anywhere, including the write slot): nothing to
+            // look up — v1 does not centrally narrow operator-declared deployment scopes.
+            if (!hasRequestOrigin)
+                return { kind: "admit", verdict: admitFull() };
+            if (principal === undefined) {
+                // Defensive arm: core already refuses this shape itself when a request-origin org scope is present
+                // with no principal, but the resolver must not assume that guard always ran first.
+                return { kind: "deny", reason: "principal absent", outcome: "principal_missing" };
+            }
+            const lookup = await directory.lookup(principal);
+            if (lookup.kind === "unavailable") {
+                const outcome = lookup.reason === "stale_generation" ? "directory_stale" : lookup.reason === "malformed" ? "directory_malformed" : "directory_absent"; // fetch_failed | section_absent
+                return { kind: "unavailable", retryAfterMs: lookup.retryAfterMs, outcome, lookupReason: lookup.reason, details: { reason: lookup.reason } };
+            }
+            const deniedScopes = requestOriginRequested.filter((r) => !(r.scope in lookup.scopes)).map((r) => r.scope);
+            if (deniedScopes.length > 0) {
+                return {
+                    kind: "deny",
+                    reason: `org scope(s) not admitted for this principal: ${deniedScopes.join(", ")}`,
+                    outcome: "denied",
+                    details: { deniedScopes },
+                };
+            }
+            const writeScope = requestedWriteScope === null
+                ? null
+                : requestedWriteScope.origin === "deployment"
+                    ? requestedWriteScope.scope
+                    : lookup.scopes[requestedWriteScope.scope]?.write === true
+                        ? requestedWriteScope.scope
+                        : null;
+            return { kind: "admit", verdict: { ok: true, scopes: fullScopes, writeScope } };
+        }
+        const decision = await decide();
+        if (decision.kind === "admit") {
+            // C10(audit=纯观察**零**行为变化):write 收窄也是行为变化(enforce 下 harvest 静默零提交)——
+            // audit 模式对「读面通过但 write 未显式授」的判决只记 would-narrow,返回未收窄的全额;
+            // enforce 照常收窄。ok:true 分支的 writeScope 恒为 fullWriteScope 或 null(decide 只做这两值)。
+            if (opts.mode === "audit" && decision.verdict.ok && decision.verdict.writeScope !== fullWriteScope) {
+                emit("ok", { audited: true, wouldNarrowWriteScope: true });
+                return admitFull();
+            }
+            emit("ok");
+            return decision.verdict;
+        }
+        if (opts.mode === "audit") {
+            // Zero behavior change: a would-deny (terminal or transient) is overridden to a full, UNNARROWED admit —
+            // the real decision is only ever recorded via onOutcome, never enforced.
+            emit(decision.outcome, { ...decision.details, audited: true, wouldDeny: true, ...(decision.kind === "unavailable" ? { retryAfterMs: decision.retryAfterMs } : { reason: decision.reason }) });
+            return admitFull();
+        }
+        emit(decision.outcome, decision.details);
+        if (decision.kind === "deny")
+            return { ok: false, reason: decision.reason };
+        throw new OrgMemoryAdmissionRetryError(`org memory directory unavailable (${decision.lookupReason})`, decision.retryAfterMs);
+    };
+}
+//# sourceMappingURL=org-memory-admission.js.map

package/dist/question.d.ts

@@ -67,6 +67,11 @@ export declare class QuestionCoordinator {
     };
     /** Test/observability hook: number of currently-parked questions. */
     pendingCount(): number;
+    /** #152 ([2703] 案二):durable 部署上的 AskUserQuestion 判决探针——本调用点是否处在某条活流腿的
+     *  per-run 上下文里(runWithContext 包裹的 bg/SSE 腿=true;sync /v1/tasks、verify/cascade=false)。
+     *  resolve-spec 的 durable question policy 用它在**判决时**分腿:有活流 ⇒ allow(问活人),无 ⇒
+     *  ask(durable park)。ALS 让这个判断天然 per-leg,policy 组装期不必预知腿别。 */
+    hasLiveContext(): boolean;
     private countersFor;
 }
 //# sourceMappingURL=question.d.ts.map

package/dist/question.js

@@ -192,6 +192,13 @@ export class QuestionCoordinator {
     pendingCount() {
         return this.pending.size;
     }
+    /** #152 ([2703] 案二):durable 部署上的 AskUserQuestion 判决探针——本调用点是否处在某条活流腿的
+     *  per-run 上下文里(runWithContext 包裹的 bg/SSE 腿=true;sync /v1/tasks、verify/cascade=false)。
+     *  resolve-spec 的 durable question policy 用它在**判决时**分腿:有活流 ⇒ allow(问活人),无 ⇒
+     *  ask(durable park)。ALS 让这个判断天然 per-leg,policy 组装期不必预知腿别。 */
+    hasLiveContext() {
+        return this.als.getStore() !== undefined;
+    }
     countersFor(taskId) {
         let rc = this.counters.get(taskId);
         if (!rc) {

package/dist/runs.d.ts

@@ -106,6 +106,13 @@ export declare function isSessionConflictResult(result: {
  * UNCHANGED for the shell). `rewind_snapshot.unresolvable` (rewindFiles + "before": no snapshot at/above the branch
  * point) is core's third rejection with a DIFFERENT prefix — same caller-mistake shape (prepare-throw, nothing
  * billed), map it to 422 explicitly so it doesn't fall through to a 200-with-failed body.
+ *
+ * design/170 件A(#148 件4): core 5.13.0's org-memory admission rides the SAME prepare-throw pipe
+ * (GOVERNANCE_CODES). `memory.admission_denied` is TERMINAL — the principal has no grant on that tenant
+ * plane → 403 (a retry cannot change the verdict). `memory.admission_required` is TRANSIENT fail-closed —
+ * the directory is unreachable / no resolver is wired → 503 (retry later; the sync leg forwards the
+ * result's `retryAfterMs` as body `retryAfterSec`, same family shape as usage.window_exhausted). Exact
+ * codes only, no memory.* family grab — an unknown sibling stays a 200-with-failed-body until cataloged.
  */
 export declare function resumeAtHttpStatus(result: {
     status: string;

package/dist/runs.js

@@ -3,7 +3,7 @@ import { withPrincipal } from "./observability/principal-context.js";
 import { redactSecrets } from "./trace/redact.js";
 import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "./trace/project.js";
 import { createLedgerSink } from "./trace/ledger-sink.js";
-import { fleetRunResiduals } from "./fleet/fleet-bus.js";
+import { fleetRunResiduals, isFleetAgentTerminalNotification } from "./fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "./fleet/subagent-tail-bus.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "./orchestration/workflow-completion-inbox.js";
 /**
@@ -148,6 +148,13 @@ export function isSessionConflictResult(result) {
  * UNCHANGED for the shell). `rewind_snapshot.unresolvable` (rewindFiles + "before": no snapshot at/above the branch
  * point) is core's third rejection with a DIFFERENT prefix — same caller-mistake shape (prepare-throw, nothing
  * billed), map it to 422 explicitly so it doesn't fall through to a 200-with-failed body.
+ *
+ * design/170 件A(#148 件4): core 5.13.0's org-memory admission rides the SAME prepare-throw pipe
+ * (GOVERNANCE_CODES). `memory.admission_denied` is TERMINAL — the principal has no grant on that tenant
+ * plane → 403 (a retry cannot change the verdict). `memory.admission_required` is TRANSIENT fail-closed —
+ * the directory is unreachable / no resolver is wired → 503 (retry later; the sync leg forwards the
+ * result's `retryAfterMs` as body `retryAfterSec`, same family shape as usage.window_exhausted). Exact
+ * codes only, no memory.* family grab — an unknown sibling stays a 200-with-failed-body until cataloged.
  */
 export function resumeAtHttpStatus(result) {
     if (result.status !== "failed")
@@ -156,6 +163,10 @@ export function resumeAtHttpStatus(result) {
         return 404;
     if (result.errorCode === "rewind_snapshot.unresolvable")
         return 422;
+    if (result.errorCode === "memory.admission_denied")
+        return 403;
+    if (result.errorCode === "memory.admission_required")
+        return 503;
     if (!(result.errorCode?.startsWith("resume_at.") ?? false))
         return undefined;
     return result.errorCode === "resume_at.not_found" ? 404 : 422;
@@ -575,8 +586,11 @@ promptManifests) {
                     }
                     // id-domain alias (core): fleet child rows key by the TICK's taskId = the child's sessionId
                     // (uuid domain); the notification's task_id is the a* domain — payload.sessionId IS the tick-domain
-                    // alias, so flip by it (fallback task_id for pre-1.238 payloads / bash lane).
-                    const hadRow = fleetPublisher?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false;
+                    // alias, so flip by it (fallback task_id for pre-1.238 payloads).
+                    // [2687-cli] 幽灵行案:onChildTerminal 只对 **agent 族终态**调用(isFleetAgentTerminalNotification
+                    // 单源判别,理由与病灶链见其 doc 注)。通知帧/park 面照走,只掐 fleet 铸行。三消费点孪生同形
+                    // (http/server.ts resume 腿、routes/tasks.ts sync 腿)。
+                    const hadRow = isFleetAgentTerminalNotification(n) ? (fleetPublisher?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false) : false;
                     const parked = !legLive && Boolean(workflowCompletionInbox && spec.sessionId);
                     // diagnosability: one line per observed bg completion. hadFleetRow=false = the terminal frame was
                     // FLIP-THROUGH synthesized (the row was gone — parent settle removed it, or a bg BASH never ticked).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "6.8.0",
+  "version": "7.0.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.12.0",
-    "@sema-agent/registry-core": "^0.14.0",
+    "@sema-agent/core": "^5.13.0",
+    "@sema-agent/registry-core": "^0.16.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",