@sema-agent/server 7.10.0 → 7.12.0

package/dist/http/server.js

@@ -30,7 +30,10 @@ import { clampVerifyRounds, verifyRoundsFromBody } from "./verify-rounds.js"; //
 import { handleCapabilities } from "./routes/capabilities.js";
 import { handleObservability } from "./routes/observability.js";
 import { handleDiagnostics } from "./routes/diagnostics.js";
+import { handleAdoption } from "./routes/adoption.js";
 import { handleMemoryPolicy } from "./routes/memory-policy.js";
+import { handleSharedMemory } from "./routes/shared-memory.js";
+import { handleRules } from "./routes/rules.js";
 import { handleSessionsList } from "./routes/sessions-list.js";
 import { handleSessions, createSessionsLocal } from "./routes/sessions.js";
 import { handleSessionSync, createSessionSyncLocal } from "./routes/session-sync.js";
@@ -147,7 +150,10 @@ const ROUTE_DOMAINS = [
     handleImages,
     handleApprovalsAssistant,
     handleObservability,
+    handleAdoption,
     handleMemoryPolicy,
+    handleSharedMemory,
+    handleRules,
     handleSessionsList,
     handleSessions,
     handleSessionSync,
@@ -598,9 +604,20 @@ export function createHttpServer(rawDeps) {
         // #154 件三:装配自证只读面(routes/diagnostics.ts):GET /v1/diagnostics/wiring(operator-only)。
         if (await handleDiagnostics(req, res, url, ctx))
             return;
+        // design/183 §4.3:收编面(routes/adoption.ts,operator lane;POST /v1/adoption + GET /v1/adoption/:id)。
+        if (await handleAdoption(req, res, url, ctx))
+            return;
         // design/158 A9:memory 导出/同步 + /v1/policy 只读面(routes/memory-policy.ts)。
         if (await handleMemoryPolicy(req, res, url, ctx))
             return;
+        // #154 车二:CC settings 导入两口(lane=principal,billable=false)。
+        if (await handleRules(req, res, url, ctx))
+            return;
+        // design/177 共享记忆库只读面(routes/shared-memory.ts)。🔴 域头的合取式**就是**挂载条件:供给面
+        // 与 org 折叠面双在场才有这个域,缺一个则请求落到本函数尾的全局 404(诚实缺席,不是 501)。
+        // `capabilities.sharedMemory` 读同一个合取式 ——「说 yes ⟺ 面真能用」因此是结构性的,不靠人盯。
+        if (deps.sharedMemoryStore && deps.orgMemoryDirectory && (await handleSharedMemory(req, res, url, ctx)))
+            return;
         // design/158 A9:会话/发件链接列表面(routes/sessions-list.ts)。
         if (await handleSessionsList(req, res, url, ctx))
             return;
@@ -1065,6 +1082,13 @@ export function createHttpServer(rawDeps) {
             sendError(res, 400, "request.field_invalid", "interactiveTools must be a boolean");
             return null;
         }
+        // [1909]⑧ oneShot(core 5.23.0):boolean fail-loud,与它的姊妹旋钮 interactiveTools 逐字同姿势 ——
+        // 两者说的是同一件事的两半(这次提交是不是 `-p` 一次性形)。非 boolean 静默丢会让调用方以为已经声明
+        // 了一次性、模型却照旧被告知「结束回合等通知」= 后台结果丢失,正是本键存在的那个失败形。
+        if (body.oneShot !== undefined && typeof body.oneShot !== "boolean") {
+            sendError(res, 400, "request.field_invalid", "oneShot must be a boolean");
+            return null;
+        }
         // [854]② retainBackgroundProcesses:boolean fail-loud(邻居姿势 —— 非 boolean 静默变「不驻留」正是
         // silent-drop 病灶);单用户闸/多租忽略在 resolveSpec(retainBackgroundProcessesFromBody)。
         if (body.retainBackgroundProcesses !== undefined && typeof body.retainBackgroundProcesses !== "boolean") {
@@ -1254,7 +1278,15 @@ export function createHttpServer(rawDeps) {
      * rebuild the taskConfig via the same `resolveSpec` path (from the sessionId-keyed checkpoint_ctx), then
      * `runner.resume`. The capability token never leaves the service. Updates the parked run row to its new state.
      */
-    async function resumeCheckpoint(sessionId, decision, reason, req, // absent on the internal D-D SLA deny-sweep (resolveSpec rebuilds auth from the checkpoint, not req)
+    async function resumeCheckpoint(sessionId, decision, reason, 
+    // core `ApprovalSettledBy`(5.23.0):**这次结算的出处**,由调用方命名。REQUIRED —— core 的字段
+    // 文档把义务钉在结算点上(「Fill it at every settlement site」),并说明集中推导正是「窗到期被报成
+    // 另一个人拒绝」的成因。本函数有两个调用方且函数内**无从分辨**(sweep 与人为 decide 在这里唯一
+    // 的差别是 `req` 缺席,那是「有没有 HTTP 请求」不是「谁结算的」),所以只能穿参。
+    // ⚠️ core 的相容规则:`decision:"approve"` 只接受 `"human"` 或缺席 —— 「没人答所以它跑了」不是
+    // 任何事实的记录。今天唯一传非 `"human"` 的调用方(SLA sweep)恒 deny,故不冲突;将来若有一个
+    // 会 approve 的非人调用方,它该传的是**缺席**而不是一个自造的词。
+    settledBy, req, // absent on the internal D-D SLA deny-sweep (resolveSpec rebuilds auth from the checkpoint, not req)
     answer, binding, onResumeCommitted) {
         const cs = deps.checkpointStore;
         // No scope filter here BY DESIGN (council): an operator may view/decide ANY tenant's pending approval.
@@ -1371,7 +1403,9 @@ export function createHttpServer(rawDeps) {
                 ...(deps.logger ? { warn: (event, fields) => deps.logger?.warn?.(event, fields) } : {}),
             }, {
                 token, scope: cp.scope, sessionId: cp.sessionId, pendingAction: cp.pendingAction,
-                decision, ...(reason !== undefined ? { reason } : {}),
+                // #204 件6③:赎回腿是**另一个**结算点,出处同样穿参(它自己不猜)。今天走到这里的恒是人为
+                // /decide —— 上面那道门写着 `req !== undefined`,而 sweep 恰是 req 缺席的那条腿。
+                decision, settledBy, ...(reason !== undefined ? { reason } : {}),
                 ...(binding !== undefined ? { binding: { ...(binding.boundCallId !== undefined ? { boundCallId: binding.boundCallId } : {}), ...(binding.boundInputHash !== undefined ? { boundInputHash: binding.boundInputHash } : {}), ...(binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}) } } : {}),
                 // remember 的 grant 闭包(onResumeCommitted 的唯一现役来源)在 parked 腿以行的 root/host
                 // 会话为锚透传([1591] 候裁② server 修——落子代会话则探针键永不相交,见 grantOnCommit 注);
@@ -1509,6 +1543,8 @@ export function createHttpServer(rawDeps) {
             ...(decision === "approve" && binding?.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
             ...(reason ? { reason } : {}),
             ...(answer !== undefined ? { answer } : {}),
+            // #204 件6:结算出处逐字上 outcome(见参数顶注)。core 只接受它自己那三个词,server 不派生、不缺省。
+            settledBy,
         };
         // Developer-mode verify (1.44) survives suspend/resume (core `resumeWithVerification`, design/51 P1-b): a
         // task submitted with verify:true that hit an F4 gate must STILL be gated by the adversarial verifier on
@@ -2096,6 +2132,60 @@ export function createHttpServer(rawDeps) {
         }
         catch (e) {
             if (e instanceof CheckpointError) {
+                // ── A-010.2:`checkpoint.resume_aborted` = 取消终局(既非 terminal-failed,也**不是** retriable)──
+                // core 只在 `taskConfig.signal.aborted === true` 时铸这个码(四个铸造点:pre-CAS 入口 / 编辑复裁
+                // 竞速两处 / consumed 后 / reopen 成功后),而本腿递进去的 `signal` 只有 `cancelCtrl.signal` ——
+                // 其唯一 abort 源是取消(inflightRuns 句柄 + 心跳轮询的持久取消旗)。所以收到该码 ⟺ 这条 run
+                // 被取消了,四形的正确落点因此**同一个**:按取消结算(下面那道 pending/consumed 的判别式,在
+                // 「该做什么」这个问题上是无差别的,故不做)。
+                //  · 归下面的 terminal 支(修前现状)= 200 的取消出路(本 catch 更下面的 `cancelCtrl.signal.aborted`
+                //    分支)被本 CheckpointError 分支**遮蔽**:运维拿到 409 + core 裸报文,行虽落 failed 但
+                //    `errorCode` 不是 `cancelled` 且 `setTerminal` 连 TaskResult 都不写(null),pre-CAS 三形的
+                //    卡还留 pending = 行终局 + 卡 pending 的孤儿对。
+                //  · 归 retriable(把该码加进下面的闭集)= 把一条**用户已取消**的 run 重新 park 成 `suspended`;
+                //    下一次 /decide 的 markResuming 会重置取消旗并把活真跑起来 —— 取消被静默打败,执行车道回归。
+                // ⛔ 修法刻意是「只给该码开一条臂」而不是把 `cancelCtrl.signal.aborted` 分支上提到本分支之前:
+                //    同在 abort 期铸的 `checkpoint.reopen_failed` 两形(store 拒 reopen = 审批已终局消耗;reopen
+                //    在飞失败 = 卡的状态从这里无法证明)带的信息比 "cancelled" 多,上提会把它们折没。
+                if (e.code === "checkpoint.resume_aborted") {
+                    // 序与 /v1/runs/:id/cancel 的 cancelSuspended 逐字同向:**先**按 cancel 语义结算卡,**再**驱行
+                    // 终局(行终局会释放 task_active;反序会开一个「卡还 pending 而行已死」的窗)。cancel 的卡结算
+                    // 语义是 expire(≈ deny 的 reaper 终局),不是 resolve —— 取消意味着 run 死掉,deny-RESUME 会
+                    // 把拒绝喂回模型烧 token。consumed 那一形(core 3894)在这里天然是 no-op:CAS 只翻 pending。
+                    // ⚠️ 与 `/v1/runs/:id/cancel` 的 `cancelSuspended` **刻意分道**的一点(codex 对抗复审 R2-高2
+                    // 的处置):那只在 CAS 输掉时会改答 409,因为它站在腿**外面**——输掉意味着「可能有一条 decide
+                    // 腿正在跑」,它没资格驱行终局。本臂站在腿**里面**:markResuming 已经赢过、这条 run 归我们,
+                    // 而本码的语义是「它被取消了」。此刻 CAS 输掉只可能是卡已离开 pending(自己那次 resume 消费掉
+                    // 的 consumed 形,或 reaper 先收了)——两种都意味着**没有活审批留在外面**,行照驱终局才是对的:
+                    // 不驱才会把会话锁一直攥着(这正是 [868] 那条事故)。故不改结果面,但**必须留痕**。
+                    const cs2 = deps.checkpointStore;
+                    if (cs2) {
+                        try {
+                            const live = await cs2.get(token);
+                            if (live?.status === "pending" && !(await cs2.expire(token, live.scope))) {
+                                // CAS 输了:卡在我们读它与写它之间被别人(自己的 resume / reaper)settle 了。行为面无变化,
+                                // 但「取消时这张卡到底是谁收的」不留痕就永远查不出来。
+                                deps.logger?.warn?.("resume_cancel_checkpoint_settle_lost", { taskId, sessionId });
+                            }
+                        }
+                        catch (cancelSettleErr) {
+                            // 卡结算是尽力而为:行终局才是释放锁的权威写,残留的 pending 卡另有 reaper 车道兜底。
+                            // 但**必须留痕** —— 静默吞掉的话「取消之后卡为什么还在」在遥测里没有任何线索。
+                            deps.logger?.warn?.("resume_cancel_checkpoint_settle_failed", {
+                                taskId, sessionId, err: cancelSettleErr instanceof Error ? cancelSettleErr.message : String(cancelSettleErr),
+                            });
+                        }
+                    }
+                    // `claimedRow &&` 与下面那道分支**同一个**守卫,不是多余的:驱行终局是有资格才做的写(只有
+                    // 抢到这条 run 的腿才有资格),而「本码只可能在 markResuming 之后铸」这件事是当前控制流的
+                    // 巧合、不是结构保证。守卫写出来,这条臂就不依赖那个巧合。
+                    if (claimedRow && taskId && deps.runStore) {
+                        const c = { taskId, sessionId, status: "failed", errorCode: "cancelled", errorMessage: e.message, stats: { turns: 0, tokens: 0 } };
+                        await deps.runStore.setTerminal(taskId, "failed", c, c.errorMessage ?? null).catch(() => undefined);
+                    }
+                    settleFleet("failed"); // MF-Fleet (#7): 取消结算终局 → 行从 fleet 摘除
+                    return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
+                }
                 // We flipped the row to `running` (claimedRow). Two CheckpointError classes diverge here (D-1, core 1.101):
                 //  • TERMINAL (already_resolved / not_found / gate_mismatch / unsupported_version): the checkpoint is
                 //    consumed or gone — drive the row terminal now (releasing task_active) instead of leaving a zombie
@@ -2110,6 +2200,13 @@ export function createHttpServer(rawDeps) {
                     e.code === "checkpoint.reopened_concurrently" ||
                     e.code === "resume.parent_constraint_missing" || // 历史复审轴A #4(1.254):core 新增两码同为
                     e.code === "resume.parent_constraint_mismatch" || // PRE-CAS(checkpoint 保持 pending)——按本块 doctrine 归 retriable;当前 /decide 面只 resume 顶层 checkpoint 应不可达,前瞻补齐防嵌套 resume 面开放时踩中
+                    // core 5.22.0(BREAKING「编辑复裁前移 pre-CAS」)闭集加员:审批人**改写**入参时,继承祖先链
+                    // 的冻结投影先静态复裁 —— 判 deny ⇒ constraint_rejected;链上有 opaque 层/声明 live remainder
+                    // ⇒ constraint_unprojectable。两者与上面两码同族:PRE-CAS、checkpoint 留 pending 且**同 token
+                    // 仍可再决**(core 明写 fresh-redecision 语义:照原样批 / deny / 改别的都还点得动)。归 terminal
+                    // 会释放 task_active 并孤儿化那条仍 pending 的卡 —— 一张还能点的卡当场变死件。
+                    e.code === "resume.constraint_rejected" ||
+                    e.code === "resume.constraint_unprojectable" ||
                     e.code.startsWith("wake."); // design/144:wake 拒绝(gate_pending/nothing_to_deliver)全是 PRE-CAS,checkpoint 保持 pending——驱 terminal 会孤儿化仍在等的 park
                 if (claimedRow && taskId && deps.runStore) {
                     // Re-park on the SAME gate family the outcome targeted: a plan_review retry must re-park `needs_review`
@@ -2689,7 +2786,9 @@ export function createHttpServer(rawDeps) {
                 parkedSkipped += 1;
                 continue;
             }
-            await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied").then((r) => { if (r.status >= 400)
+            // #204 件6②:出处 = `"timeout"`(窗到期,**没有人**答)。此前这里与人为 /decide 共用一个不带
+            // 出处的构造,于是下游把一次自动拒渲染成「有人拒绝了你」。
+            await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", "timeout").then((r) => { if (r.status >= 400)
                 deps.logger?.warn?.("deny_sweep_resume_blocked", { sessionId, status: r.status, body: r.body }); }, (e) => deps.logger?.warn?.("deny_sweep_resume_failed", { sessionId, err: e instanceof Error ? e.message : String(e) }));
         }
         if (parkedSkipped > 0)
@@ -2770,12 +2869,19 @@ const ROUTE_LABEL_PATTERNS = [
     // #151 车4:durable 回决口。必须排在 `/v1/tasks/:id/$sub` **之前**?—— 不必(那条只认三个字面动词),
     // 但仍按「具体先于泛化」的表序纪律放在它前面,免得日后 $sub 放宽成 `[^/]+` 时静默吞掉本条。
     [/^\/v1\/tasks\/[^/]+\/asks\/[^/]+\/decision$/, "/v1/tasks/:id/asks/:askId/decision"],
+    // [3321] tool-results 读面:同样排在 `/v1/tasks/:id/$sub` 之前(具体先于泛化的表序纪律;$sub 那条
+    // 只认三个字面动词,今日不冲突,但它日放宽成 `[^/]+` 时本条不会被静默吞掉)。
+    [/^\/v1\/tasks\/[^/]+\/tool-results\/[^/]+$/, "/v1/tasks/:id/tool-results/:ref"],
     [/^\/v1\/tasks\/[^/]+\/(turns|stream|artifacts)$/, "/v1/tasks/:id/$sub"],
     [/^\/v1\/leader\/[^/]+$/, "/v1/leader/:id"],
     [/^\/v1\/attachments\/[^/]+$/, "/v1/attachments/:id"],
     [/^\/v1\/capabilities\/scenarios\/[^/]+$/, "/v1/capabilities/scenarios/:name"],
+    [/^\/v1\/adoption\/[^/]+$/, "/v1/adoption/:id"],
     [/^\/v1\/memory\/sync\/[^/]+$/, "/v1/memory/sync/:scope"],
     [/^\/v1\/usage\/(summary|series|breakdown)$/, "/v1/usage/$sub"],
+    // design/177 共享记忆库只读面。两条各自成桶(列举是窗口读、正文是单文档读,延迟分布不同族)。
+    [/^\/v1\/shared-memory\/stores\/[^/]+\/documents$/, "/v1/shared-memory/stores/:store/documents"],
+    [/^\/v1\/shared-memory\/stores\/[^/]+\/document$/, "/v1/shared-memory/stores/:store/document"],
 ];
 const ROUTE_LABEL_LITERALS = new Set([
     "/health", "/metrics", "/metrics/summary", "/metrics/plan-cache",
@@ -2789,8 +2895,22 @@ const ROUTE_LABEL_LITERALS = new Set([
     // 名册门的枚举器当时只认 `url === …`,整条路由对门隐形(枚举器已一并补上)。
     "/v1/fleet/stream",
     "/v1/memory/export", "/v1/sendfile-links",
+    // design/177:共享记忆库清单面(具名两条走上面的模式表)。
+    "/v1/shared-memory/stores",
     // #154:装配自证读面(operator-only)。低频但**每次都在排障现场被打**,落进 `other` 桶等于排障时看不见。
     "/v1/diagnostics/wiring",
+    // design/183:收编发起口(operator-only,一次性部署级动作)。低频、但它的 duration 与失败率是
+    // 迁移现场唯一的机器信号,落进 `other` 桶就看不见了。
+    "/v1/adoption",
+    // #154 车二:CC settings 导入两口。字面量(无 id 段)⇒ 进 LITERALS 表而不是模式表。
+    // 🔴 写**字面量**而不是引 `RULES_CC_IMPORT_*_PATH` 常量:名册门与 billable 申明门都是**扫源码文本**
+    // 的(它们正则抓本表里的双引号词),引常量会让两条新路由对两道门隐形 —— 那不是「过了门」,是绕过门。
+    // ⚠️ 本段注释里也不许出现方括号后紧跟右圆括号的字符对:billable 门的表捕获正则是**非贪婪**的,
+    //    那两个字符会让它在这里提前收尾,后面的字面量整段落在门的视野外(写这条注时真的踩到过)。
+    "/v1/rules/cc-import/prepare", "/v1/rules/cc-import/redeem",
+    // #203 §2:撤销面两口(GET 列举 / DELETE 撤销)共用一个字面路径。同样写字面量而不是引 `RULES_PATH`
+    // 常量,理由与上一条逐字相同(名册门与 billable 申明门都扫源码文本)。
+    "/v1/rules",
 ]);
 /** Stable, low-cardinality route label for metrics/logs (ids collapsed to `:id`).
  *  [#104] 字面量**先于**模式:此前模式先查,五条精确路由被形状桶吞掉(`/v1/approvals/stream`

package/dist/http/wire-types.d.ts

@@ -10,6 +10,14 @@ import type { AgentDefinition, McpServerSpec } from "@sema-agent/core";
 export interface TaskRequestBody {
     objective: string;
     sessionId?: string;
+    /** Which deployment SCENARIO assembles this task's tools/prompt/skills (the keys of the worker's scenario
+     *  table — e.g. "default"/"code-review"/"scan"/"team"). An INTENT bounded by the deployment's own table AND,
+     *  on a governed worker, by the principal's center-resolved allowlist: an unknown name is a typed 400
+     *  `scenario_unknown`, a known-but-not-allowed one a typed 400 `scenario_not_allowed`; absent ⇒ the ruling's
+     *  assigned scenario, else `DEFAULT_SCENARIO` (consumed at `boot/resolve-spec.ts` via `gateScenarioRequest`).
+     *  ⚠️ scenario-SPECIFIC keys (`repo`/`lenses`/`rounds`, read through `ScenarioRequest`'s index signature) are
+     *  deliberately NOT declared here — they belong to one scenario each, not to the shared submit surface. */
+    scenario?: string;
     /** dispatch-gateway failover 幂等第二级:caller-minted 任务 id(uuidv7)。同 owner 重放同 id ⇒ 幂等重放;
      *  异 owner ⇒ 409 `conflict.run_exists`;非 uuidv7 ⇒ 400 `request.id_invalid`(routes/runs.ts:192-208 真验收)。
      *  [2400] TR-16 连带:此键此前只活在 runs.ts 读点,导出类型漏declared——CAPS-OPS-13 同族第 9 键。 */
@@ -76,6 +84,14 @@ export interface TaskRequestBody {
      *  a rung fails the gate (default = it didn't complete). Default off; mutually exclusive with `verify`;
      *  not on /v1/tasks/stream. ⚠️ each rung is a cold re-run — use for read-only / idempotent tasks. */
     cascade?: boolean;
+    /** Multi-lens review council (the `code-review` scenario's expensive tier) — `council:true` fans the review out
+     *  to N parallel lenses + an arbiter instead of the lead reviewing in-line; `debate:true` additionally runs the
+     *  L2 peer-debate rounds. Read on TWO seams and both matter: the scenario builder mounts `run_council`
+     *  (`capabilities/scenarios.ts` `codeReview`), and `boot/resolve-spec.ts` treats either flag as an EXPLICIT team
+     *  declaration — it widens the task's wall-clock tenancy budget (`resolveTaskLimits`) and suppresses the value
+     *  router's auto-escalation (`explicitTeam`). Only literal `true` counts on both seams. */
+    council?: boolean;
+    debate?: boolean;
     /** Work-view correlation id (optional): groups the runs of one logical task across both client doors
      *  (MCP façade / portal) so a fragmented set of runs reads as one task. Opaque to the engine — only
      *  persisted on the run row + filterable via `GET /v1/tasks?jobId=`. ≤64 chars (matches the column). */
@@ -102,6 +118,18 @@ export interface TaskRequestBody {
      *  surfaces the validated object as `TaskResult.structuredOutput` (an invalid submit retries, then fails with
      *  `output.invalid`). A plain JSON-schema OBJECT (shape + size validated here; deep validity is core's). */
     outputSchema?: Record<string, unknown>;
+    /** Retry budget for an INVALID `submit_output` against `outputSchema` (core `TaskSpec.outputRetries`) — the
+     *  caller-facing other half of the structured-output pair. Narrow acceptance in `boot/resolve-spec.ts`:
+     *  finite, ≥1, floored, capped at 10; anything else ⇒ key omitted (core's own default). Meaningless without
+     *  `outputSchema` (core ignores it there). */
+    outputRetries?: number;
+    /** Within-task compaction tuning (core design/145 `TaskSpec.compaction`). ⚠️ ONLY `clampTolerance` is a caller
+     *  knob — the rest of core's compaction object is an OPERATOR axis and is deliberately not on the wire, so this
+     *  type is narrower than core's field on purpose. `boot/resolve-spec.ts` accepts a finite number in [0,1] and
+     *  omits the whole `compaction` key otherwise. Pairs with `compactionModel` (which gear compacts). */
+    compaction?: {
+        clampTolerance?: number;
+    };
     /** Reasoning-effort selection (CC `/effort` picker, shell-host contract E7): a neutral effort tier mapped to
      *  core's `TaskSpec.thinking` (`ThinkingLevel`). Accepted set = core's tiers (off/minimal/low/medium/high/xhigh/max);
      *  the picker's advertised default set is `/v1/models` `supportedEffortLevels`. A provided-but-unknown value is a
@@ -275,6 +303,26 @@ export interface TaskRequestBody {
      *  (a caller can't point a shared/cloud worker at an arbitrary host path). Validated absolute (prepareSpec 400s a
      *  relative cwd — it would silently resolve against the SERVICE process cwd). */
     cwd?: string;
+    /** design/119 (CC `--add-dir`, core `TaskSpec.additionalDirectories`): extra host dirs the FILE tools may reach
+     *  beyond the containment root. 🔒 Gated exactly like `cwd`/`shellEnv` — honored ONLY on the single-user host
+     *  lane (`task-cwd.ts` `cwdHonored`); off that lane `boot/resolve-spec.ts` drops them with a loud
+     *  `task_additional_directories_ignored` (never silently). SHAPE is fail-loud at submit (absolute host paths,
+     *  no `..` segments, ≤ MAX_ADDITIONAL_DIRS entries) — separate from whether the lane honors them.
+     *  `additionalReadDirectories` (core 5.11.0) is the same door with a READ-only semantic: it widens the read
+     *  containment (classify auto-allow + read_file/grep) and never the write face. Rides the persisted body onto
+     *  resume legs. */
+    additionalDirectories?: string[];
+    additionalReadDirectories?: string[];
+    /** [1909]⑧/[1910]/[1911] (core 5.23.0 `TaskSpec.oneShot`): this SUBMISSION is one-shot — no later turn exists
+     *  in which an async background notification could land (the archetypal case is a headless `sema -p` whose
+     *  process exits when the turn ends). PER-REQUEST on purpose: "does this submission expect to be continued" is
+     *  a property of the submission, not of the connection it arrived on. core consumes it as GUIDANCE ONLY (the
+     *  `RunWorkflow` / delegation receipts tell the model to block-wait via `TaskOutput({block:true})` instead of
+     *  "end your turn, you will be notified" — the latter is actively wrong here and loses background results); it
+     *  grants nothing, so there is no tenancy gate. Sibling of `interactiveTools` (the same `-p` posture) and passed
+     *  through the same way: a boolean rides, absent/garbage ⇒ key omitted (core's default = interactive). Rides the
+     *  persisted body onto resume legs. */
+    oneShot?: boolean;
     /** [R3] Caller-supplied per-request MCP servers (the TOC client's local `.mcp.json`), aligned to core
      *  `McpServerSpec`. 🔒 honored on any SINGLE-USER deployment (task-mcp.ts `mcpInjectionHonored` = `requirePrincipal!==true`)
      *  — the requester is the super-admin of their OWN worker (CC-parity), on ANY execution lane (the stdio MCP runs on the

package/dist/main.js

@@ -43,13 +43,17 @@ import { createResolveSpec } from "./boot/resolve-spec.js";
 import { createParkedReviveInheritedGate } from "./boot/parked-revive-gate.js";
 import { startReapers } from "./boot/reapers.js";
 import { openStores } from "./boot/stores.js";
+import { runAdoptionBootScan } from "./boot/adoption.js";
+import { auditDormantPermissionRules } from "./boot/permission-rules-audit.js";
 import { createBudgetAndTracing } from "./boot/budget-tracing.js";
+import { createRuleConsentLane } from "./rules-consent.js";
 import { createExecutionEnv } from "./boot/execution-env.js";
 import { createWorkflowOrchestration } from "./boot/workflow-orchestration.js";
 import { createLiveCoordinators } from "./boot/coordinators.js";
 import { createRuntimeCaps } from "./boot/runtime-caps.js";
-import { createRunnerDeps, createSharedRunnerDeps } from "./boot/runner-deps.js";
+import { createRunnerDeps, createRunnerDepsOnAsk, createSharedRunnerDeps } from "./boot/runner-deps.js";
 import { createOrgMemoryAdmissionWiring } from "./boot/org-memory.js";
+import { createSharedMemoryScopeAuthorizer } from "./shared-memory-scope-authorizer.js";
 import { createSessionFaces } from "./boot/session-faces.js";
 import { createLeaderFace } from "./boot/leader.js";
 import { assertStaticWiringConsistent } from "./http/routes/diagnostics.js";
@@ -168,9 +172,27 @@ async function main() {
     // design/158 A10:持久层装配搬到 src/boot/stores.ts(逐字)。⚠️ 该段就地归一 `config.sessionBackend`
     // 且承载三条 fail-loud 拒启断言 —— 位置即契约,理由见该文件头注。
     const { backend, storeBackendDegraded, memoryEngine, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, memoryExportBackend, memorySyncRunner, sessionStore, breakerState, usageWindowStore, } = await openStores({ config, logger, metrics, localRoot });
+    // design/183 I6(server 同族):**每副本 boot 必查**收编日志的在飞行 —— 续跑或响亮留痕,禁静默跳过。
+    // 位置:store 开完之后(要 backend)、任何路由装配之前(半迁移状态绝不带进服务期)。判据与「为什么
+    // 是续跑而不是拒启」见 boot/adoption.ts 顶注。
+    const adoptionBoot = await runAdoptionBootScan({ backend, logger });
+    if (adoptionBoot.scanned > 0 || adoptionBoot.error !== undefined) {
+        logger.info("adoption_boot_scan", { ...adoptionBoot });
+    }
     // design/158 A10:计费/追踪/预算装配搬到 src/boot/budget-tracing.ts(逐字;tracer 与 side-query 同 sink 实例的
     // 「同段构造」契约见该文件头注)。
     const { brain, pricing, counterDegradeHook, costQuota, modelUsageTracker, promptManifestTracker, fleetUsage, fleetLease, tracer, sideQueryAccounting, toolResultStore, sessionPolicyStore, fileSnapshotStore, } = createBudgetAndTracing({ config, logger, metrics, backend, breakerState });
+    // #154 车二:持久化权限规则店(core 5.18.0 design/179 + 5.22.0 design/182)。三面一束 —— 规则桶
+    // provider 上 `RunnerDeps.permissionRuleStore`(引擎据它铸 ruleSuggestions + 把 manifest 的
+    // `permissionRules.storeWired` 报成真),审批记录 + 导入票喂同意车道(HTTP 两口的属主)。
+    // 缺席(local 车道 / 无 backend)⇒ 诚实缺席:storeWired:false、帧上零候选、两口 501。
+    // 🔴 总开关在最前(codex round7 [high] 一):关 ⇒ 整条车道根本不装配(店/车道/帧键/两口一起消失)。
+    const permissionRuleStores = config.permissionRulesEnabled && backend ? backend.permissionRule() : undefined;
+    const ruleConsent = permissionRuleStores ? createRuleConsentLane(permissionRuleStores) : undefined;
+    // #203 §3(设计稿 v2 F4 残余):默认 ON 会把**既有**规则桶一并唤醒 —— 在启动日志里把它说出来。
+    // 三条判据(店缺席 / 零桶 / 运维显式表过态 ⇒ 都不打行)与失败方向(数不出来只 warn,绝不拒启、
+    // 也绝不编一个 0)逐字见 `boot/permission-rules-audit.ts`。
+    await auditDormantPermissionRules({ stores: permissionRuleStores, logger, explicit: config.permissionRulesEnabledExplicit });
     // design/158 A10:执行环境装配搬到 src/boot/execution-env.ts(逐字)。
     // ⚠️ 工厂装饰顺序=行为(scratchpad → worktree → SendUserFile 登记 → 附件物化最外层),见该文件头注。
     const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore });
@@ -189,11 +211,25 @@ async function main() {
     const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
     // design/158 A10:活体协调器 + SendUserFile 工具面搬到 src/boot/coordinators.ts(逐字;durableEnabled 的
     // 「必须早于 runnerDeps 求值」次序契约见该文件头注)。
-    const { elicitation, question, toolApproval, durableEnabled, streamApprovalGate, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({ config, logger, backend, sendUserFileTaskEnvs });
+    const { elicitation, question, toolApproval, durableEnabled, streamApprovalGate, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({ config, logger, backend, sendUserFileTaskEnvs, ruleConsent });
     // design/158 A10:per-principal caps 段搬到 src/boot/runtime-caps.ts(逐字)。
     const { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver } = createRuntimeCaps({ config, logger });
     // design/170 件A(#148 件3③):org 记忆准入装配(目录源三态选择+C12 能力探测,坏配置在此拒启动)。
     const orgMemoryAdmission = createOrgMemoryAdmissionWiring({ config, logger, metrics });
+    // design/177 —— org 共享记忆库(memory_list/memory_read + `/v1/shared-memory/*` 只读面)。
+    // 🔴 铸它的合取式是**唯一**的挂载条件,模型面与 HTTP 面共用:
+    //   ① SQL 供给面在场(`backend.sharedMemoryStore` —— local 车道诚实缺席,理由在 store-backend.ts);
+    //   ② org 折叠面在场(目录源)—— 没有成员性判据的共享读面只能全放或全拒,两个都比"这个面不存在"差。
+    // deployment-origin scope 只在**无租户边界**的部署里授予:多租户下一条部署级声明会同时授予每一个
+    // principal,那是跨租户读而不是配置便利(org-memory.ts 的 N2 同判)。择净在这一行,授权模块只忠实使用。
+    const sharedMemoryStore = orgMemoryAdmission.directory !== undefined
+        ? backend?.sharedMemoryStore?.(createSharedMemoryScopeAuthorizer({
+            directory: orgMemoryAdmission.directory,
+            deploymentScopes: config.requirePrincipal === true ? [] : orgMemoryAdmission.deploymentMemoryScopes,
+        }))
+        : undefined;
+    if (sharedMemoryStore)
+        logger.info("shared_memory_stores_enabled", { backend: backend?.kind });
     // 🔴 codex 复审(#196 finding-2b):`toolResultStore` 在**无 backend** 形下是 undefined,而 core 的
     // Runner 构造函数会在缺席时**每只各自私建**一份 `RunnerSharedToolResultStore`(runtask.js
     // `if (!this.deps.toolResultStore)`)。本部署有多只 Runner(主 / subRunner / hookAgent / #196 的两只无手
@@ -209,8 +245,10 @@ async function main() {
         config, logger, metrics, localRoot, promptSource: configCenter.promptSource, rosterStore, backgroundAgentStore, mailboxStore, usageWindowStore, brain,
         pricing, tracer, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine,
         memorySyncRunner, toolResultStore: runnerOffloadStore, sessionPolicyStore, runtimeCapsResolver, fileSnapshotStore,
+        permissionRuleStore: permissionRuleStores?.provider,
         executionEnvFactory, lspManager, fleetBus, deploymentHooks, workflowRunStore, workflowJournalStore,
         workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, orgMemoryAdmission,
+        sharedMemoryStores: sharedMemoryStore ? sharedMemoryStore : undefined,
         getRunStore: () => runStore,
     });
     const runner = new Runner(runnerDeps);
@@ -380,6 +418,7 @@ async function main() {
             sessionPolicyStore,
             usageWindowStore,
             orgMemoryAdmission,
+            sharedMemoryStores: sharedMemoryStore ? sharedMemoryStore : undefined, // design/177:与主 runner 同实例
         }),
         // ── 以下为 subRunner 差异键(不在共享基座;逐个有因)──────────────────────────────────────
         sessionStore: subRunnerSessions, // 子代转录=私有短 TTL fork 路由店,生命周期异于宿主 durable 店
@@ -679,8 +718,27 @@ async function main() {
     // 「部署 ⊇ 操作员」两层完整链(design/181 件二收编;实现与全部理由在 boot/parked-revive-gate.ts,
     // 提出去的唯一理由是 main.ts 顶层 `void main()` 让那条腿的运行期语义在原地一格都钉不住)。
     // 构造条件逐字保持:裸 Agent 工具在场 ∧ 部署真开了 durable 审批。
+    // `approverSeat`:与 `RunnerDeps.onAsk` **同一个具名工厂**(单一属主,禁在此处手搓等价闭包)。core
+    // 5.22.0 起链条目的 `durableMandate` 位进了摘要,而该位的判据正是这只席位在不在场——两处若不同源,
+    // 赎回腿算出的摘要与 park 记的对不上,跨副本赎回整条腿被 pre-CAS 拒(见 parked-revive-gate.ts
+    // `mandatePostureOf`)。此处新铸的转发闭包与 runnerDeps 那只行为逐字相同(都只转 `toolApproval.ask`),
+    // 摘要只看在场性;仅 core 的 hook 席位去重按函数身份判,那一侧的身份未命中是**多筛一次**(core 自述
+    // 的保守方向),不是漏筛。
+    // A-010.1 同族的另外两位(`resolveRuntimeCaps` / `autoModeSeatMounted`):5.22.0 的摘要卷进的是**三**位
+    // 决议链元数据,其中 `autoModeArmed` 与 `durableMandate` 的 `forceDurableGate` 项都由 per-principal 的
+    // `RuntimeCaps` 决定。两处必须与 core 看到的**同一只**事实源接线,否则同样是「park 记 true 而赎回腿供
+    // false ⇒ 摘要恒不匹配 ⇒ 这批 principal 的卡永不可赎」:
+    //  · `resolveRuntimeCaps` = 递给 `RunnerDeps.runtimeCapsResolver` 的同一只(单一属主 boot/runtime-caps.ts);
+    //  · `autoModeSeatMounted` = **读** runnerDeps 上那一位,不写字面 `true` —— core 的武装式是
+    //    `runtimeCaps.autoMode === true ∧ deps.autoMode !== undefined`,第二个半场的真值只有 runnerDeps 知道,
+    //    在此处手抄 `true` 会在 runner-deps 那边改成有条件挂载的那一天静默错供一位。
     const parkedReviveInheritedGate = parkedReviveTool && config.durableApproval
-        ? createParkedReviveInheritedGate({ config, question, approvalExemptionStore, logger, localRoot })
+        ? createParkedReviveInheritedGate({
+            config, question, approvalExemptionStore, logger, localRoot,
+            approverSeat: createRunnerDepsOnAsk(toolApproval),
+            ...(runnerDeps.runtimeCapsResolver ? { resolveRuntimeCaps: runnerDeps.runtimeCapsResolver } : {}),
+            autoModeSeatMounted: runnerDeps.autoMode !== undefined,
+        })
         : undefined;
     // 场景详情:内建 details 必须在 overlay 合并【前】构建(探针要打纯内建工厂,不是被 center 顶掉的);
     // center details 随 overlay 同判定源盖同名——source 语义与 selectScenario 实际取用永一致(约定①)。
@@ -782,11 +840,17 @@ async function main() {
         approvalExemptionStore: approvalExemptionStore ? approvalExemptionStore : undefined, // decide remember="session" + list/revoke
         checkpointStore,
         sessionPolicyStore: sessionPolicyStore ? sessionPolicyStore : undefined, // E6 operator session-rule store (PUT/GET /v1/sessions/:id/policy)
+        ruleConsent, // #154 车二:CC settings 导入两口的属主(缺席 ⇒ 两口 501)
         // E19 cap: core's gate-split (1.134.0) REMOVED the isRemoteExecutionEnv skip — core now snapshots each
         // completed turn + restores on resumeAt for ANY ExecutionEnv when fileSnapshotStore is wired (captureManifest/
         // applyManifest run over any env's FileSystem ops; a 30s timeout bounds a slow remote walk). So rewind works for
         // host/e2b/k8s/ssh/adb/local-docker AND the in-process worker → advertise `rewindFiles` whenever the store is wired.
         fileSnapshotStore: fileSnapshotStore ? fileSnapshotStore : undefined,
+        // [3321] tool-results 读面(GET /v1/tasks/:id/tool-results/:ref)的数据源。传的是 **durable** 的那一只
+        // (`toolResultStore`,present ⇔ 有 store backend),**不是** Runner 侧的内存兜底 `runnerOffloadStore`:
+        // 无 backend 部署里那只是进程内的、跨副本读不到的,把它接上读面只会让调用方读到「有时有有时无」。
+        // undefined ⇒ 路由 404 同形(理由见 ServiceStoreDeps.toolResultStore 的头注)。
+        toolResultStore,
         taskAttachmentStore: taskAttachmentStore ? taskAttachmentStore : undefined, // D-1 上传/取回/删除三动词面
         // design/153 件3d(/decide parked 赎回腿):durable bg 行店 + boot 裸 Agent 工具,与 RunnerDeps/
         // scenarioDeps 同实例(claim/expire/consumeParkedFlip 作用于同一行)。任一缺席=分支不存在。
@@ -855,6 +919,9 @@ async function main() {
         // (`createOrgMemoryAdmissionWiring` 的产物),两面因此共享 TTL 缓存/退避窗/gen 高水位 —— 一个进程
         // 对「谁属于 org:acme」只有一个答案。缺席(无 center 且无 env 表)⇒ 策略面 `org:` 键仍 operator-only。
         orgMemoryDirectory: orgMemoryAdmission.directory,
+        // design/177:HTTP 只读面与模型面共用**同一个** provider 实例 —— 两面看到的库集合按定义一致,
+        // 不可能出现「壳能读到模型读不到的库」。缺席 ⇒ `/v1/shared-memory/*` 整域不挂载(见 server.ts 域头)。
+        sharedMemoryStore: sharedMemoryStore ? sharedMemoryStore : undefined,
         // sessionMirror 观测面(server 非执法端,论证在 ServiceDeps.sessionMirrorRuling):
         // 与 executionRuling 同车同缓存(零额外 center RTT);无 center/dry-run ⇒ 不接线,观测面暗、零行为差。
         sessionMirrorRuling: principalCaps

package/dist/observability/fail-open.d.ts

@@ -41,6 +41,18 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "`/v1/fleet/stream` 连接时快照的**近期终态行窗**(#189:引擎重启后 boot 判死的 workflow 行,pull 自 durable store)读失败或超预算(2s)⇒ 本次快照少这几行历史。放行的最坏后果=面板首屏看不到刚结束的 workflow(与本修之前的行为等同,不是新损失);真源不受影响(`GET /v1/workflows` 照常)。方向刻意 fail-open:一次慢查询不该把整条 SSE 的握手拖住——少几行是难看,连不上流是坏掉。";
     };
+    readonly "server.rules.rejected-prepare-row-left": {
+        readonly cls: "F";
+        readonly note: "被拒的 CC 导入 prepare(候选超帽)未能收掉 core 已落盘的那条 pending 审批记录。放行的最坏后果 = 共享库里留一条**永远没人要的** pending 行(零权限影响:没有票就兑不动它,而且它连确认都没过)。不留痕就没人知道清理面在漏,故记 F 类;真解是给 permission_rule_approval / permission_rule_ticket 加保留期清扫腿(已列后续件)。";
+    };
+    readonly "server.rules.ticket-claim-release-failed": {
+        readonly cls: "F";
+        readonly note: "CC 规则导入票的**认领回滚**失败(认领之后的某一步没成 ⇒ 本该把认领放回去,而这次放回本身也抛了)。放行的最坏后果 = 这张票留在已认领态、属主这一轮不能重试 —— 恰好等于加认领回滚**之前**的行为,不是新损失;票随 TTL 自然消失,属主重走一次 prepare 即可拿新票(导入按 core 的设计幂等:同一条规则再兑付只是同一个 dot 的重放)。方向上没有任何权限被放宽(规则**没有**落地才走到这条臂),故 F 类;必须留痕,否则「票为什么突然不能用了」在遥测里没有任何痕迹。";
+    };
+    readonly "server.parked-revive.ancestor-classifier-unreachable": {
+        readonly cls: "P-DEBT";
+        readonly note: "跨副本赎回 parked 审批时,祖先层在 park 时是 **auto-mode 武装**的,但那只分类器是祖先任务上的活闭包(绑着它自己的转写窗+brain),跨进程重建不出来 ⇒ 本仓交一只如实拒答的 decider,core 收到 `unavailable` 后**不产生任何自动裁决**、原样落到祖先冻结审批席那条链(本腿的席位又是无 ALS 的降级形 ⇒ 再 park 给人)。方向:分类器本会 allow 的改成问人(更严),本会 block 的也改成问人(**不是自动放行**,但比自动拒松一档)⇒ 记债不当合法兜底。计数 = 「丢了祖先分类器判决的继承 ask」次数。收口件二选一:core 把分类器判据持久进链条目,或让祖先 decider 有可跨进程重建的形。";
+    };
     readonly "server.fleet.subscriber-callback-threw": {
         readonly cls: "F";
         readonly note: "fleet bus 某订阅回调抛错 ⇒ 该回调本帧作废,其余订阅方与发布方不受影响。隔离是承重的:扇出同步,修前异常会传回发布方 put/update 投影点,core 持久化 catch{} 且不推进 storeRev ⇒ durable 行冻在 running 而 notify 已 ack(#183 复审 R3 HIGH)。丢的只是一个消费方的一帧渲染,故 F 类;但必须留痕——静默吞掉等于订阅方病灶永不显形。";

package/dist/observability/fail-open.js

@@ -64,6 +64,18 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "`/v1/fleet/stream` 连接时快照的**近期终态行窗**(#189:引擎重启后 boot 判死的 workflow 行,pull 自 durable store)读失败或超预算(2s)⇒ 本次快照少这几行历史。放行的最坏后果=面板首屏看不到刚结束的 workflow(与本修之前的行为等同,不是新损失);真源不受影响(`GET /v1/workflows` 照常)。方向刻意 fail-open:一次慢查询不该把整条 SSE 的握手拖住——少几行是难看,连不上流是坏掉。",
     },
+    "server.rules.rejected-prepare-row-left": {
+        cls: "F",
+        note: "被拒的 CC 导入 prepare(候选超帽)未能收掉 core 已落盘的那条 pending 审批记录。放行的最坏后果 = 共享库里留一条**永远没人要的** pending 行(零权限影响:没有票就兑不动它,而且它连确认都没过)。不留痕就没人知道清理面在漏,故记 F 类;真解是给 permission_rule_approval / permission_rule_ticket 加保留期清扫腿(已列后续件)。",
+    },
+    "server.rules.ticket-claim-release-failed": {
+        cls: "F",
+        note: "CC 规则导入票的**认领回滚**失败(认领之后的某一步没成 ⇒ 本该把认领放回去,而这次放回本身也抛了)。放行的最坏后果 = 这张票留在已认领态、属主这一轮不能重试 —— 恰好等于加认领回滚**之前**的行为,不是新损失;票随 TTL 自然消失,属主重走一次 prepare 即可拿新票(导入按 core 的设计幂等:同一条规则再兑付只是同一个 dot 的重放)。方向上没有任何权限被放宽(规则**没有**落地才走到这条臂),故 F 类;必须留痕,否则「票为什么突然不能用了」在遥测里没有任何痕迹。",
+    },
+    "server.parked-revive.ancestor-classifier-unreachable": {
+        cls: "P-DEBT",
+        note: "跨副本赎回 parked 审批时,祖先层在 park 时是 **auto-mode 武装**的,但那只分类器是祖先任务上的活闭包(绑着它自己的转写窗+brain),跨进程重建不出来 ⇒ 本仓交一只如实拒答的 decider,core 收到 `unavailable` 后**不产生任何自动裁决**、原样落到祖先冻结审批席那条链(本腿的席位又是无 ALS 的降级形 ⇒ 再 park 给人)。方向:分类器本会 allow 的改成问人(更严),本会 block 的也改成问人(**不是自动放行**,但比自动拒松一档)⇒ 记债不当合法兜底。计数 = 「丢了祖先分类器判决的继承 ask」次数。收口件二选一:core 把分类器判据持久进链条目,或让祖先 decider 有可跨进程重建的形。",
+    },
     "server.fleet.subscriber-callback-threw": {
         cls: "F",
         note: "fleet bus 某订阅回调抛错 ⇒ 该回调本帧作废,其余订阅方与发布方不受影响。隔离是承重的:扇出同步,修前异常会传回发布方 put/update 投影点,core 持久化 catch{} 且不推进 storeRev ⇒ durable 行冻在 running 而 notify 已 ack(#183 复审 R3 HIGH)。丢的只是一个消费方的一帧渲染,故 F 类;但必须留痕——静默吞掉等于订阅方病灶永不显形。",

package/dist/observability/metrics.js

@@ -336,7 +336,8 @@ export function createMetrics() {
     m.counter("web_search_bad_payload_total", "Web-search provider responses whose results field was not an array (LOW), by provider");
     // 收账批(2026-07-08):这 15 个计数器一直只有 inc 没注册 — 在 auto-register 落地前
     // 整批从未上过 /metrics(inc 曾对未注册名静默 no-op)。补显式注册拿正经 HELP 文案。
-    m.counter("permission_denied_total", "Tool-gate denials by source (policy/hook/plan-mode; goal B4 always-on deny meter)");
+    m.counter("permission_denied_total", "Tool-gate denials by source (core's PermissionDeniedSource, incl. org governance; 'other' = a word this build does not know; goal B4 always-on deny meter)");
+    m.counter("permission_rule_events_total", "Persisted allow-rule seam events by event (persisted_rule_allowed = a rule authorized a call with nobody asked; rule_store_unreadable = the store failed to read so the call was adjudicated with ZERO rules)");
     m.counter("compaction_events_total", "Compaction lifecycle events by outcome (started/completed/failed/skipped) and trigger");
     m.counter("hook_llm_calls_total", "prompt/agent hook entries that completed a model call (hooks 3b), by type");
     m.counter("auth_bridge_verify_total", "Registry SSO JWT verifications (auth-bridge), by outcome");

package/dist/observability/tool-trace.d.ts

@@ -1,6 +1,10 @@
-import type { Hooks } from "@sema-agent/core";
+import type { Hooks, PermissionDeniedSource } from "@sema-agent/core";
 import type { Logger } from "./logger.js";
 import type { Metrics } from "./metrics.js";
+/** 表内 ⇒ 收窄成 `PermissionDeniedSource`(类型守卫)。计量点用它判「这个词是不是本 build 认得的真词」。
+ *  导出是为了让运行期锚(`test/tool-trace.test.ts`,从装树 core 的 `.d.ts` 解析真词表)**复用同一个谓词**
+ *  —— 测试自己另写一份判据 = 又一张手抄表,正是本文件刚消灭的那个病。 */
+export declare function isKnownDenySource(v: unknown): v is PermissionDeniedSource;
 /**
  * ALWAYS-ON gate-deny meter (goal B4, 2026-07-08): `permission_denied_total{source}` — how often the
  * adjudicate chain DENIES a tool call, by gate source. Deliberately SEPARATE from {@link createToolTracer}:

package/dist/observability/tool-trace.js

@@ -1,8 +1,34 @@
 import { redactSecrets } from "../trace/redact.js";
-/** The gate sources core's `PermissionDeniedPayload.source` documents today. It is an OPEN enum by
- *  contract (a future "timeout" etc. must not break consumers) — unknown values fold to "other" so the
- *  Prometheus label set stays bounded no matter what core adds. */
-const KNOWN_DENY_SOURCES = new Set(["policy", "hook", "safety", "shellGate", "planMode"]);
+/**
+ * The gate sources core's `PermissionDeniedPayload.source` names. Treated as an OPEN enum on the WIRE
+ * (a core newer than this build may send a word this table has never heard of — that must not explode
+ * the Prometheus label set), but as a CLOSED SET against the core we compile with.
+ *
+ * 🔴 core 5.23.0([3372] 提货批件②):这张表**曾是手抄的**(`new Set([...五个字面量])`,与 core 的类型
+ * 零编译期联系),于是 core 先加 `classifier`、又在 5.23.0(design/182 §7)加 `org` 时,两个**真词**都
+ * 被静默折进了 `other`。那不是「少一个标签」——`permission_denied_total{source="other"}` 的告警语义是
+ * 「引擎发了本 build 不认识的词,去对表」,真词混进来就把这个信号读废了,而 `org`(组织治理层的拒)
+ * 恰恰是运维最该单独看见的一类。
+ *
+ * ⇒ 表改为 `Record<PermissionDeniedSource, true>` 穷举:**core 增删一个词,本表编译期先红**(闭集词表
+ * 禁手抄、必须从 core 类型推导的成文纪律)。运行期配对锚在 `test/tool-trace.test.ts`(从装树 core 的
+ * `.d.ts` 解析联合词表逐词断言),因为 vitest 走 esbuild 不查类型 —— 两道锚缺一不可。
+ */
+const KNOWN_DENY_SOURCE_TABLE = {
+    policy: true,
+    hook: true,
+    safety: true,
+    shellGate: true,
+    planMode: true,
+    classifier: true,
+    org: true,
+};
+/** 表内 ⇒ 收窄成 `PermissionDeniedSource`(类型守卫)。计量点用它判「这个词是不是本 build 认得的真词」。
+ *  导出是为了让运行期锚(`test/tool-trace.test.ts`,从装树 core 的 `.d.ts` 解析真词表)**复用同一个谓词**
+ *  —— 测试自己另写一份判据 = 又一张手抄表,正是本文件刚消灭的那个病。 */
+export function isKnownDenySource(v) {
+    return typeof v === "string" && Object.hasOwn(KNOWN_DENY_SOURCE_TABLE, v);
+}
 /**
  * ALWAYS-ON gate-deny meter (goal B4, 2026-07-08): `permission_denied_total{source}` — how often the
  * adjudicate chain DENIES a tool call, by gate source. Deliberately SEPARATE from {@link createToolTracer}:
@@ -15,7 +41,7 @@ const KNOWN_DENY_SOURCES = new Set(["policy", "hook", "safety", "shellGate", "pl
 export function createPermissionDeniedMeter(metrics) {
     return {
         permissionDenied(payload) {
-            metrics.inc("permission_denied_total", { source: KNOWN_DENY_SOURCES.has(payload.source) ? payload.source : "other" });
+            metrics.inc("permission_denied_total", { source: isKnownDenySource(payload.source) ? payload.source : "other" });
         },
     };
 }
@@ -82,7 +108,8 @@ export function createToolTracer(logger) {
         },
         // core 1.257: the gate's DENY short-circuit never reaches postToolUse* (the call
         // doesn't execute), so denied calls were INVISIBLE to this trace — the exact observability hole
-        // asked about. `source` = core's adjudicate-chain enum (policy/hook/safety/shellGate/planMode); the
+        // asked about. `source` = core's adjudicate-chain enum (the closed set is `KNOWN_DENY_SOURCE_TABLE`
+        // above — deliberately NOT re-listed here, a second hand-written copy is how the meter drifted); the
         // deny `reason` can quote the adjudicated args (an approver's text, a policy message), so redact+clip
         // like every other line. Same `tool_trace` key so existing grep workflows see denies in sequence.
         permissionDenied(payload) {