@sema-agent/server 7.104.0 → 7.106.0

package/dist/http/admission.js

@@ -2,9 +2,9 @@ import { isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
-import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, singleMemberOffFieldIssue } from "../request-value-closure.js";
+import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
@@ -157,13 +157,11 @@ export function createAdmission(ctx) {
                 sendError(res, 400, "request.field_invalid", "settings.permissions must be an object");
                 return null;
             }
-            if (perms !== null && typeof perms === "object" && !Array.isArray(perms)) {
-                for (const k of ["allow", "deny", "ask"]) {
-                    const arr = perms[k];
-                    if (Array.isArray(arr) && arr.length > MAX_SETTINGS_PERMISSION_RULES) {
-                        sendError(res, 400, "request.field_invalid", `settings.permissions.${k} must have at most ${MAX_SETTINGS_PERMISSION_RULES} entries`);
-                        return null;
-                    }
+            {
+                const bucketIssue = settingsPermissionBucketIssue(perms);
+                if (bucketIssue) {
+                    sendError(res, 400, "request.field_invalid", bucketIssue.message, bucketIssue.fields);
+                    return null;
                 }
             }
             const envRaw = st.env;
@@ -333,6 +331,13 @@ export function createAdmission(ctx) {
                 return null;
             }
         }
+        {
+            const inheritEnvIssue = inheritEnvFieldIssue(body);
+            if (inheritEnvIssue) {
+                sendError(res, 400, "request.field_invalid", inheritEnvIssue);
+                return null;
+            }
+        }
         if (fileHistoryRestoreConflict(body)) {
             sendError(res, 400, "request.field_conflict", FILE_HISTORY_DISABLED_NO_RESTORE);
             return null;

package/dist/http/approval-sweeps.js

@@ -7,6 +7,18 @@ import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import { hasServiceAuth } from "./dispatch.js";
 import { gatedPrincipal } from "./principal-gate.js";
 import { readinessOf, billableRefusalOf } from "./readiness.js";
+const BLOCKED_SCALAR_KEYS = ["errorCode", "blockedBy", "field", "reason", "count", "cap", "index"];
+function blockedScalars(body) {
+    const out = {};
+    if (body === null || typeof body !== "object")
+        return out;
+    for (const k of BLOCKED_SCALAR_KEYS) {
+        const v = body[k];
+        if (typeof v === "string" || (typeof v === "number" && Number.isFinite(v)))
+            out[k] = v;
+    }
+    return out;
+}
 export function createApprovalSweeps(ctx) {
     const { deps, resumeCheckpoint, mayDiscloseRowError } = ctx;
     const denySweepClockGuard = createWallClockJumpGuard({
@@ -59,7 +71,7 @@ export function createApprovalSweeps(ctx) {
                 continue;
             }
             await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", { decidedBy: "sla_timeout" }).then((r) => { if (r.status >= 400)
-                deps.logger?.warn?.("deny_sweep_resume_blocked", { sessionId, status: r.status, errorCode: r.body?.errorCode }); }, (e) => deps.logger?.warn?.("deny_sweep_resume_failed", { sessionId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) }));
+                deps.logger?.warn?.("deny_sweep_resume_blocked", { sessionId, status: r.status, ...blockedScalars(r.body) }); }, (e) => deps.logger?.warn?.("deny_sweep_resume_failed", { sessionId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) }));
         }
         if (parkedSkipped > 0)
             deps.logger?.info?.("deny_sweep_parked_skipped", { count: parkedSkipped });

package/dist/http/dispatch.d.ts

@@ -22,6 +22,24 @@ import type { FlatServiceDeps } from "./server.js";
  *  凭证门、[ref] 的 parked 赎回席、以及 [ref] 的 consolidation 阀门启动期告警读同一句(手抄迟早
  *  只改一处,而这条判据决定的是「无凭证部署上写口开不开」)。导出仅为最后一个消费点(main.ts)。 */
 export declare function hasServiceAuth(config: ServiceConfig): boolean;
+/**
+ * 🔴 S-672(test T-72 [ref];主会话裁 ①,分诊 [ref])—— 全局服务凭据门**之前**那几族只读路
+ * (`route-table.ts` 里 `position: "read-credential"` 的行)的**唯一**鉴权谓词:「服务凭据 ∨ 已验 principal」。
+ *
+ * 病:这几族(trace-usage / workflows / fleet)排在全局门之前,理由只有一条 —— 只读 `TRACE_TOKEN` 单凭据的调用方
+ * (registry 用量 / 轨迹中继)在全局门会被 401。可排在门前之后,每一族只剩**块内**自己那道门:fleet / workflows
+ * 只在 `REQUIRE_PRINCIPAL` 时要身份,trace 认 `gatedPrincipal`(BFF 形上就是调用方自己写的 principal 头)。于是
+ * 配了 service token、没开 REQUIRE_PRINCIPAL 的部署上,`POST /v1/tasks` 吃凭据,这三族读路对端口全开。
+ *
+ * 规则(一条,三族同读;fail-closed):
+ *  · 部署**没配**任何 service 凭据(`hasServiceAuth` 假)⇒ 放行 —— 与全局门对 `/v1/tasks` 同判(run-local 形);
+ *  · 否则要么出示了**服务凭据**(service token 单 / 多,或只读 `TRACE_TOKEN` —— 后者正是这几族在门前的理由),
+ *    要么带着**验过的** principal(registry 登录令牌 / direct-door 签名 principal 令牌;判据 = `verifiedIdentitySource`,
+ *    与 off-box operator 读面同一只)。调用方自己写的 principal 头不是凭据。
+ * 过了本门,各族块内的门(属主 scope / fleet-wide 上限 / `REQUIRE_PRINCIPAL` 的身份门)照旧 —— 本谓词只回答
+ * 「这个请求带没带这台部署认的凭据」,不回答「它能看谁的行」。
+ */
+export declare function readCredentialOk(req: IncomingMessage, config: ServiceConfig): boolean;
 export declare function createDispatch(ctx: {
     deps: FlatServiceDeps;
     noteActivity: (url: string) => void;

package/dist/http/dispatch.js

@@ -3,14 +3,21 @@ import { setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isDestructiveSessio
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
-import { PRE_CREDENTIAL_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath } from "./route-table.js";
+import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath } from "./route-table.js";
 import { sendJson, sendError, isSseResponse } from "./send.js";
 import { readinessOf, healthReadinessKeys, sendReadyz, billableRefusalOf, sendBillableRefusal } from "./readiness.js";
-import { authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized } from "./principal-gate.js";
+import { authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, verifiedIdentitySource } from "./principal-gate.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 export function hasServiceAuth(config) {
     return Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
 }
+export function readCredentialOk(req, config) {
+    if (!hasServiceAuth(config))
+        return true;
+    if (verifiedIdentitySource(req, config) !== undefined)
+        return true;
+    return config.traceToken !== undefined && config.traceToken !== "" && authorized(req, config.traceToken);
+}
 function cors(res, req, origins, principalHeader) {
     if (!origins || origins.length === 0)
         return;
@@ -44,7 +51,7 @@ export function createDispatch(ctx) {
         };
         deps.drainState.lastAttachEndedAt = () => lastAttachEndedAt;
     }
-    async function dispatchSegment(rows, req, res, url, search, method, allow, ctx) {
+    async function dispatchSegment(rows, req, res, url, search, method, allow, ctx, admit) {
         for (const row of rows) {
             if (row.enabled !== undefined && !row.enabled(deps))
                 continue;
@@ -54,6 +61,10 @@ export function createDispatch(ctx) {
                     allow.push(m);
             if (found.decl === null)
                 continue;
+            if (admit !== undefined && !admit(req)) {
+                sendUnauthorized(res, "credential");
+                return true;
+            }
             await row.handler(req, res, { decl: found.decl, params: found.params, search }, ctx);
             return true;
         }
@@ -112,7 +123,7 @@ export function createDispatch(ctx) {
                 ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
                 ...(deps.drainState?.draining ? { draining: true, ...(deps.drainState.since ? { drainingSince: deps.drainState.since } : {}), ...(deps.drainState.reason ? { drainReason: deps.drainState.reason } : {}) } : {}),
                 ...(deps.drainState?.inflight ? { inflight: deps.drainState.inflight() } : {}),
-                ...(deps.storeDegraded ? { durable: false, storeDegraded: true } : {}),
+                ...(deps.storePosture?.degradedReason !== undefined ? { durable: false, storeDegraded: true } : {}),
                 ...healthReadinessKeys(readinessOf(deps)),
                 model: deps.config.model.id,
                 sessionBackend: deps.sessionStoreLabel ?? deps.config.sessionBackend,
@@ -204,7 +215,9 @@ export function createDispatch(ctx) {
                 }
             }
         }
-        if (await dispatchSegment(PRE_CREDENTIAL_ROUTES, req, res, url, search, method, allow.pre, ctx))
+        if (await dispatchSegment(READ_CREDENTIAL_ROUTES, req, res, url, search, method, allow.pre, ctx, (r) => readCredentialOk(r, deps.config)))
+            return;
+        if (await dispatchSegment(PUBLIC_ROUTES, req, res, url, search, method, allow.pre, ctx))
             return;
         let source = null;
         const anyServiceAuth = hasServiceAuth(deps.config);

package/dist/http/durable-run-leg.js

@@ -5,6 +5,7 @@ import { cascadeConfig, runMeta } from "./run-meta.js";
 import { resolveStreamApprovalGate } from "../tool-approval.js";
 import { buildActiveRunConflict } from "./active-run-conflict.js";
 import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js";
+import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
@@ -28,6 +29,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const placementReject = await commitPlacement(deps, runStore, taskId, args.prepared.bindingIntent);
     if (placementReject)
         return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
+    commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
     if (deps.checkpointStore) {
         await deps.checkpointStore.putCtx(sessionId, { body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope });
     }

package/dist/http/request-guards.d.ts

@@ -5,6 +5,31 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { FlatServiceDeps } from "./server.js";
+import type { LeaseRefusalAdmission } from "../fleet-lease.js";
+/**
+ * S-866 ③ —— 租约拒绝的应答形({@link leaseRefusalOf} 的产物;`{status, body}` 交回形 + 镜像头用的 `retryAfterSec`)。
+ * 体键序固定 `error, errorCode, …`(冻结门 `FROZEN_RESULT_BODY` 按这个字面形锚)。
+ */
+export interface LeaseRefusal {
+    readonly status: 429 | 503;
+    readonly body: {
+        readonly error: string;
+        readonly errorCode: string;
+        readonly retryAfterSec: number;
+        readonly [extra: string]: unknown;
+    };
+    readonly retryAfterSec: number;
+}
+/**
+ * S-866 ③ —— 一次被拒的租约准入 → HTTP 应答的**唯一**映射(三只门 {@link createRequestGuards} 里的 `leaseDenied` /
+ * `ownerLeaseDenied` / `ownerFleetLeaseDenied` 同调它;12 个调用点零改)。按拒因穷举(加一臂 = 编译红):
+ *  · `budget_exhausted` ⇒ **429 `quota_exhausted`**(字节同 7.105.0 的路由发送形:`retryAfterSec` + 中心 E4 结构化字段逐字透传);
+ *  · `lease_unavailable` ⇒ **503 `fleet.lease_unavailable`**(只在 `FLEET_LEASE_FAIL_CLOSED` 生效时出现):体 `{reason, retryAfterSec}`,
+ *    `reason` ∈ `auth-rejected | unreachable`(中心拒了本引擎的凭证 / 凭证读不出 ;中心不可达 / 5xx / 超时 / 坏体)。可重试。
+ * 7.105.0 及以前三只门各写一份 `!adm.ok ⇒ 429 quota_exhausted`,且 resume 族那份不带 E4 字段(两形分歧,当年如实登记);
+ * 一只映射之后两形同体(resume 族的 429 体多出中心的 E4 字段,additive)。
+ */
+export declare function leaseRefusalOf(adm: LeaseRefusalAdmission): LeaseRefusal;
 export declare function createRequestGuards(ctx: {
     deps: FlatServiceDeps;
 }): {

package/dist/http/request-guards.js

@@ -4,6 +4,27 @@ import { RUN_NOT_FOUND_MESSAGE } from "./route-ctx.js";
 import { sendError } from "./send.js";
 import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "./principal-gate.js";
 const MAX_BODY = 8 * 1024 * 1024;
+export function leaseRefusalOf(adm) {
+    switch (adm.reason) {
+        case "budget_exhausted":
+            return { status: 429, body: { error: "budget exhausted (quota lease)", errorCode: "quota_exhausted", retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) }, retryAfterSec: adm.retryAfterSec };
+        case "lease_unavailable":
+            return {
+                status: 503,
+                body: { error: "quota lease unavailable — this deployment enforces budgets fail-closed and could not confirm this caller's budget with the quota center, so nothing was run; retry after retryAfterSec seconds", errorCode: "fleet.lease_unavailable", reason: adm.cause, retryAfterSec: adm.retryAfterSec },
+                retryAfterSec: adm.retryAfterSec,
+            };
+        default: {
+            const unhandled = adm;
+            throw new Error(`lease refusal without an HTTP answer: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+function sendLeaseRefusal(res, refusal) {
+    const { error, errorCode, ...extra } = refusal.body;
+    res.setHeader("retry-after", String(refusal.retryAfterSec));
+    sendError(res, refusal.status, errorCode, error, extra);
+}
 export function createRequestGuards(ctx) {
     const { deps } = ctx;
     function quotaExceeded(req, res) {
@@ -36,7 +57,8 @@ export function createRequestGuards(ctx) {
         if (adm.ok)
             return undefined;
         deps.metrics?.inc("fleet_lease_rejected_total");
-        return { status: 429, body: { error: "budget exhausted (quota lease)", errorCode: "quota_exhausted", retryAfterSec: adm.retryAfterSec } };
+        const refusal = leaseRefusalOf(adm);
+        return { status: refusal.status, body: refusal.body };
     }
     async function ownerLeaseDenied(res, owner) {
         if (!deps.fleetLease || !owner)
@@ -45,8 +67,7 @@ export function createRequestGuards(ctx) {
         if (adm.ok)
             return false;
         deps.metrics?.inc("fleet_lease_rejected_total");
-        res.setHeader("retry-after", String(adm.retryAfterSec));
-        sendError(res, 429, "quota_exhausted", "budget exhausted (quota lease)", { retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
+        sendLeaseRefusal(res, leaseRefusalOf(adm));
         return true;
     }
     function ownerQuotaDenied(res, owner) {
@@ -68,8 +89,7 @@ export function createRequestGuards(ctx) {
         if (adm.ok)
             return false;
         deps.metrics?.inc("fleet_lease_rejected_total");
-        res.setHeader("retry-after", String(adm.retryAfterSec));
-        sendError(res, 429, "quota_exhausted", "budget exhausted (quota lease)", { retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
+        sendLeaseRefusal(res, leaseRefusalOf(adm));
         return true;
     }
     async function usageWindowDenialFor(key) {

package/dist/http/resume-legs.d.ts

@@ -24,7 +24,7 @@ import type { createRequestGuards } from "./request-guards.js";
 import type { FlatServiceDeps } from "./server.js";
 export declare function createResumeLegs(ctx: {
     deps: FlatServiceDeps;
-    runnerFor: NonNullable<FlatServiceDeps["runnerFor"]>;
+    runnerFor: FlatServiceDeps["runnerFor"];
 } & RunRegistry & RouteHelpers & Pick<RouteLegs, "prepareSpec" | "finalizeTaskResult"> & Pick<ReturnType<typeof createRequestGuards>, "ownerCostQuotaDenied" | "ownerFleetLeaseDenied" | "usageWindowDenialFor">): {
     routeCtxBase: RouteCtxBase;
     resumeCheckpoint: (sessionId: string, decision: "approve" | "deny", reason: string | undefined, hostDecision: HostDecision, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, onResumeCommitted?: (grant: {

package/dist/http/resume-legs.js

@@ -37,6 +37,7 @@ import { createCapabilitiesLocal } from "./routes/capabilities.js";
 import { gatedPrincipal, explicitOperatorOk } from "./principal-gate.js";
 import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
 import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js";
+import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
 import { httpErrorCode } from "./send.js";
@@ -265,6 +266,7 @@ export function createResumeLegs(ctx) {
                     sessionFaceOf: deps.sessionStorage?.sessionFaceOf ? deps.sessionStorage.sessionFaceOf.bind(deps.sessionStorage) : sessionFaceUnavailable,
                     ...(deps.parkedKnownAgentTypes ? { knownAgentTypes: deps.parkedKnownAgentTypes } : {}),
                     ...(deps.parkedReviveInheritedGate ? { rebuildInheritedGate: deps.parkedReviveInheritedGate } : {}),
+                    ...(deps.toolApproval ? { approverSeatFor: deps.toolApproval.boundUnattendedAsk } : {}),
                     ...(deps.logger ? { warn: parkWarn } : {}),
                 }, parkedReq, { handle: origin.handle, row: origin.row }));
                 void ctxPromise.catch(() => { });
@@ -297,7 +299,7 @@ export function createResumeLegs(ctx) {
         if (!ctx)
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
         const { spec, engineNotices } = resolved;
@@ -329,14 +331,18 @@ export function createResumeLegs(ctx) {
     }
     const ONE_SHOT_HISTORY_KEYS = ["resumeAt", "restoreFiles", "acceptPartialRestore", "rewindFilesTo", "rewindFiles"];
     const ONE_SHOT_HISTORY_STRIP = Object.fromEntries(ONE_SHOT_HISTORY_KEYS.map((k) => [k, undefined]));
-    const resolveResumeSpec = async (body, req, auth) => {
+    const resolveResumeSpec = async (ctx, req, auth) => {
         const engineNotices = [];
-        const spec = await deps.resolveSpec({ ...body, ...ONE_SHOT_HISTORY_STRIP }, req, auth, { leg: "resume", onNotice: (n) => engineNotices.push(n) });
+        const spec = await deps.resolveSpec({ ...ctx.body, ...ONE_SHOT_HISTORY_STRIP }, req, auth, {
+            leg: "resume",
+            onNotice: (n) => engineNotices.push(n),
+            ...(ctx.unattendedLeg === true ? { unattendedLeg: true } : {}),
+        });
         return { spec, engineNotices };
     };
-    const resolveResumeSpecOrBlocked = async (body, req, auth) => {
+    const resolveResumeSpecOrBlocked = async (ctx, req, auth) => {
         try {
-            const { spec, engineNotices } = await resolveResumeSpec(body, req, auth);
+            const { spec, engineNotices } = await resolveResumeSpec(ctx, req, auth);
             return { ok: true, spec, engineNotices };
         }
         catch (e) {
@@ -427,7 +433,7 @@ export function createResumeLegs(ctx) {
         if (deps.toolApproval && taskId) {
             const toolApproval = deps.toolApproval;
             resumeTaskConfig.onAsk = approvalLeg.windowZero
-                ? (askReq) => Promise.resolve(toolApproval.unattendedAskOutcome({ taskId, owner: principal ?? null, toolName: askReq.toolName }))
+                ? toolApproval.boundUnattendedAsk({ owner: principal ?? null, taskId, sessionId })
                 : toolApproval.boundAsk({
                     owner: principal ?? null,
                     taskId,
@@ -491,6 +497,7 @@ export function createResumeLegs(ctx) {
             deps.modelUsage?.register(taskId);
             resumeManifestLease = deps.promptManifests?.register(taskId) ?? 0;
         }
+        commitSessionInheritEnv(deps, sessionId, resumeCtx.ctx.body);
         if (args.onResumeCommitted)
             await args.onResumeCommitted();
         let unregisterEngineNotice;
@@ -1061,7 +1068,7 @@ export function createResumeLegs(ctx) {
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const ctx = ctxRead.ctx;
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
         const { spec, engineNotices } = resolved;
@@ -1093,7 +1100,7 @@ export function createResumeLegs(ctx) {
         if (windowDenial)
             return { status: windowDenial.status, body: windowDenial.body };
         const auth = { sessionId, principal, memoryScope: ctx.memoryScope };
-        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
         const { spec, engineNotices } = resolved;
@@ -1167,7 +1174,7 @@ export function createResumeLegs(ctx) {
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const ctx = ctxRead.ctx;
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
         const { spec, engineNotices } = resolved;
@@ -1267,7 +1274,8 @@ export function createResumeLegs(ctx) {
         }
         const approvedMode = decision === "approve" && effMode === "plan" ? (permissionModeAfter ?? "default") : undefined;
         const resumeBody = approvedMode === undefined ? ctx.body : { ...ctx.body, permissionMode: approvedMode };
-        const resolved = await resolveResumeSpecOrBlocked(resumeBody, req, auth);
+        const rebuildCtx = { ...ctx, body: resumeBody };
+        const resolved = await resolveResumeSpecOrBlocked(rebuildCtx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
         const { spec, engineNotices } = resolved;
@@ -1279,7 +1287,7 @@ export function createResumeLegs(ctx) {
             ...(editedPlan !== undefined ? { editedPlan } : {}),
             ...(reason ? { reason } : {}),
         };
-        const out = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx: { sessionId, ctx: { ...ctx, body: resumeBody } }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+        const out = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx: { sessionId, ctx: rebuildCtx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
         return out;
     }
     const routeCtxBase = {

package/dist/http/route-ctx.d.ts

@@ -147,6 +147,15 @@ export interface CheckpointCtx {
     body: TaskRequestBody;
     /** 提交时这条会话绑定的记忆域(重建 `RequestAuth` 用);缺席 = 没有记忆面。 */
     memoryScope?: string;
+    /**
+     * 🔴 S-877 候裁 18(codex r3 F1)—— 这条会话的 run 是**无人值守腿**铸的(今天唯一的写者 = leader worker 的 durable 块,
+     * `leader/wire.ts`),**服务端写、不来自请求体**(`body` 是提交体;本位是它的兄弟键,客户端够不着)。
+     * 续跑家族据此请 `resolveSpec` 带 `unattendedLeg: true`,由它按续跑 Runner 的同名座经 `createUnattendedLeg` / `withUnattendedLeg`
+     * 重挂整条腿(模式 = 旋钮、写面 roots、模式释放写保护时的写保护拒层)—— 拒层是活闭包、进不了 checkpoint,而 core 在 spec 不说
+     * 模式时取 checkpoint 记下的那一个(`seat ?? recorded`),不重挂 = 续跑落 bypass 而拒层缺席。写回口(`DriveResumeArgs.resumeCtx`)
+     * 传原 ctx / 其展开 ⇒ 标随行。缺席 = 不是无人值守腿(HTTP 提交腿;7.106.0 前落盘的行 —— 那时这些腿不铸模式,checkpoint 里也没有)。
+     */
+    unattendedLeg?: true;
 }
 /** B4①(命名化):`driveResumeIntoRunLog` 的入参形(resume 家族共用)——原为 9 成员内联匿名对象。 */
 export interface DriveResumeArgs {

package/dist/http/route-table.d.ts

@@ -55,7 +55,17 @@ import type { FlatServiceDeps } from "./server.js";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteDecl, RouteDispatchDecl, RouteMatch, RouteCtx, RouteMethod } from "./route-ctx.js";
 /** 一只域 handler 相对**全局服务凭据门**的位置。门前 = 未鉴权可达(每一只都要单独论证),门后 = 先过凭据。 */
-export type RoutePosition = "pre-credential" | "post-credential";
+/**
+ * 一行路由在全局服务凭据门的哪一侧、吃哪道门(闭集,三员;S-672 起由两员拆成三员):
+ *  · `"read-credential"` —— 门**之前**,但过**一只**读路谓词(`dispatch.ts` 的 `readCredentialOk`:部署配了 service
+ *    凭据时要「服务凭据(含只读 TRACE_TOKEN)∨ 已验 principal」,没配时与全局门同样放行)。只读路才能坐这一段:
+ *    它们在门前只为收只读 TRACE_TOKEN 单凭据的调用方,不是为了对端口全开;
+ *  · `"public"` —— 门之前、**不吃**任何凭据门:按裁定匿名可达的面(今天只有 A2A agent card,R-11「公网匿名可发现」,
+ *    零存量披露);
+ *  · `"post-credential"` —— 全局服务凭据门(+ 无凭据写门 / 排空 503 / roster-pending 503 / 破坏性会话写门)之后。
+ * 修前是 `"pre-credential" | "post-credential"` 两员:门前四族一律不吃任何门,三族只读路因此对端口全开(T-72)。
+ */
+export type RoutePosition = "read-credential" | "public" | "post-credential";
 export interface RouteRow {
     /** 域入口(`routes/*.ts` 的 `handleX`)。签名一致性是编译期钉:入口漂了形 = 编译红,不是运行时静默 404。
      *
@@ -79,9 +89,10 @@ export interface RouteRow {
     readonly enabled?: (deps: FlatServiceDeps) => boolean;
 }
 export declare const ROUTES: readonly RouteRow[];
-/** 两段(`dispatch.ts` 的分派循环各跑一段)。段内序 = 本表行序;
- *  「门前行不许出现在门后行之后」由 `test/route-order-freeze.test.ts` 钉住。 */
-export declare const PRE_CREDENTIAL_ROUTES: readonly RouteRow[];
+/** 三段(`dispatch.ts` 的分派循环按 read-credential → public → 全局门 → post-credential 各跑一段)。段内序 = 本表行序;
+ *  「三段各自连续、按这个次序排」由 `test/route-order-freeze.test.ts` 钉住。 */
+export declare const READ_CREDENTIAL_ROUTES: readonly RouteRow[];
+export declare const PUBLIC_ROUTES: readonly RouteRow[];
 export declare const POST_CREDENTIAL_ROUTES: readonly RouteRow[];
 /**
  * **探针路径**(k8s / 编排器 / 抓取器的常态高频采样):不计 admission inflight、不推活性时钟(`http/server.ts`

package/dist/http/route-table.js

@@ -38,10 +38,10 @@ function row(spec) {
     return spec;
 }
 export const ROUTES = [
-    row({ handler: handleTraceUsage, decls: TRACE_USAGE_ROUTES, position: "pre-credential", label: "trace-usage" }),
-    row({ handler: handleWorkflows, decls: WORKFLOWS_ROUTES, position: "pre-credential", label: "workflows" }),
-    row({ handler: handleFleet, decls: FLEET_ROUTES, position: "pre-credential", label: "fleet" }),
-    row({ handler: handleA2aServe, decls: A2A_SERVE_ROUTES, position: "pre-credential", label: "a2a-serve" }),
+    row({ handler: handleTraceUsage, decls: TRACE_USAGE_ROUTES, position: "read-credential", label: "trace-usage" }),
+    row({ handler: handleWorkflows, decls: WORKFLOWS_ROUTES, position: "read-credential", label: "workflows" }),
+    row({ handler: handleFleet, decls: FLEET_ROUTES, position: "read-credential", label: "fleet" }),
+    row({ handler: handleA2aServe, decls: A2A_SERVE_ROUTES, position: "public", label: "a2a-serve" }),
     row({ handler: handleCapabilities, decls: CAPABILITIES_ROUTES, position: "post-credential", label: "capabilities" }),
     row({ handler: handleSideQuery, decls: SIDE_QUERY_ROUTES, position: "post-credential", label: "side-query" }),
     row({ handler: handleTasks, decls: TASKS_ROUTES, position: "post-credential", label: "tasks" }),
@@ -78,7 +78,8 @@ export const ROUTES = [
     row({ handler: handleAttachments, decls: ATTACHMENTS_ROUTES, position: "post-credential", label: "attachments" }),
     row({ handler: handleNotifyWake, decls: NOTIFY_WAKE_ROUTES, position: "post-credential", label: "notify-wake" }),
 ];
-export const PRE_CREDENTIAL_ROUTES = ROUTES.filter((r) => r.position === "pre-credential");
+export const READ_CREDENTIAL_ROUTES = ROUTES.filter((r) => r.position === "read-credential");
+export const PUBLIC_ROUTES = ROUTES.filter((r) => r.position === "public");
 export const POST_CREDENTIAL_ROUTES = ROUTES.filter((r) => r.position === "post-credential");
 const PIPELINE_ROUTES = [
     { id: "health", path: "/health", methods: ["GET"] },

package/dist/http/routes/approvals-assistant.js

@@ -347,7 +347,6 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(s.mandate !== undefined ? { mandate: s.mandate } : {}),
                     ...(s.denialLimitFallback !== undefined ? { denialLimitFallback: s.denialLimitFallback } : {}),
                     ...(s.origin !== undefined ? { origin: s.origin } : {}),
-                    ...(s.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: s.ruleStoreUnreadable } : {}),
                     objective,
                     input,
                 };

package/dist/http/routes/capabilities.js

@@ -1,9 +1,9 @@
 import { expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
 import { isModelAllowlisted, selectableCatalog } from "../../model-select.js";
-import { resolveModelApiKey } from "../../key-resolver.js";
-import { isSealedKeyPoison, projectSealedKeyCapability } from "../../sealed-key.js";
+import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
+import { projectSealedKeyCapability } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
-import { taskApproverPostureHonored, taskWriteFaceRefusal } from "../../hosted-posture.js";
+import { taskWriteFaceRefusal } from "../../hosted-posture.js";
 import { autonomyOverrides } from "../../runtime-governance.js";
 import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protocol.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
@@ -16,9 +16,10 @@ import { fileHistoryCaptureOf } from "../../file-history-capture.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { projectMemoryEngineCapability } from "../../memory-posture.js";
 import { projectWriteProtectionCapability } from "../../write-protection.js";
-import { projectSqlEngineCapability } from "../../sql-engine-posture.js";
+import { projectStoreCapability } from "../../store-posture.js";
 import { projectWebSearchCapability } from "../../plugins/web-search.js";
 import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
+import { gateCompositeMembers } from "../../capabilities/composite-members.js";
 import { projectApprovalsStreamLiveCapability } from "../../capabilities/approvals-push.js";
 import { workflowModelAllowlistFor, selfOrchestrationDenial } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
@@ -27,7 +28,7 @@ import { coercePermissionModeStrict, SETTINGS_PERMISSION_MODE_WORDS } from "../.
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { sessionBackgroundFacesAvailable } from "./background.js";
 function routePairingOf(deps, name, m) {
-    if (isSealedKeyPoison(deps.config.modelApiKeys?.[name]))
+    if (modelKeyPoisonOf(name, deps.config.modelApiKeyEnv ?? {}, process.env, deps.config.modelApiKeys ?? {}) !== undefined)
         return "unknown";
     const key = resolveModelApiKey(name, deps.config.modelApiKeyEnv ?? {}, process.env, deps.config.modelApiKeys ?? {});
     return routePairingStatus(deps.routeJudgeBrain ?? {}, m, key !== undefined ? { apiKey: key } : undefined);
@@ -65,11 +66,11 @@ export async function handleCapabilities(req, res, match, ctx) {
                 return;
             }
             const entitlementSource = centerEntitlementSourceWired(deps.config);
-            const { fault: autoModeFault, ...autoMode } = await judgeAutoModeArming(deps.autoModeFace, { requestedMode, principal: gatedPrincipal(req, deps.config), entitlementSource, localDeny: deps.config.permissionsDisableAutoMode });
+            const { fault: autoModeFault, ...autoMode } = await judgeAutoModeArming(deps.autoModeFace, { requestedMode, principal: gatedPrincipal(req, deps.config), localDeny: deps.config.permissionsDisableAutoMode });
             if (autoModeFault !== undefined)
                 deps.logger?.warn("auto_mode_face_resolver_fault", { fault: autoModeFault });
             const rulesLaneReachable = Boolean(deps.ruleConsent) && gatedPrincipal(req, deps.config) !== undefined;
-            sendJson(res, 200, {
+            sendJson(res, 200, gateCompositeMembers({
                 ...deps.capabilities,
                 asyncRuns: Boolean(deps.runStore),
                 artifacts: Boolean(deps.runStore),
@@ -88,7 +89,8 @@ export async function handleCapabilities(req, res, match, ctx) {
                 memory: false,
                 memoryWrite: false,
                 memoryEngine: projectMemoryEngineCapability(deps.memoryPosture),
-                sql: projectSqlEngineCapability(deps.sqlEngineFacts?.()),
+                store: projectStoreCapability(deps.storePosture ?? { declared: deps.config.dbBackend, backend: "memory" }, deps.sqlEngineFacts?.()),
+                centerWiring: deps.centerWiring?.(gatedPrincipal(req, deps.config)),
                 webSearch: projectWebSearchCapability(deps.webSearchProvider),
                 sessionBackgroundable: Boolean(deps.runStore),
                 runMemoryCaptureOptOut: Boolean(deps.runStore),
@@ -125,7 +127,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                     accepted: true,
                     classifierSeat: deps.autoModeFace?.seatMounted === true,
                     entitlementSource,
-                    intentArming: deps.autoModeFace?.engineArmsOnIntent === true,
+                    intentArming: true,
                     ...autoMode,
                 },
                 readFace: deps.config.readFace ?? null,
@@ -141,7 +143,6 @@ export async function handleCapabilities(req, res, match, ctx) {
                 projectContext: cwdHonored(deps.config),
                 callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
                 taskWriteFaceOpen: taskWriteFaceRefusal(deps.config) === undefined && autonomyOverrides(deps.config.autonomy).writeFace !== "roots",
-                taskApproverPosture: taskApproverPostureHonored(deps.config),
                 executionLane: projectExecutionLaneCapability(deps.config),
                 mcpInjection: mcpInjectionHonored(deps.config),
                 a2a: true,
@@ -200,7 +201,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 manualCompact: Boolean(deps.runStore),
                 configCatalog: deps.config.configCatalogEnabled === true && deps.config.operatorPrincipals.length > 0,
                 sealedKey: projectSealedKeyCapability(deps.sealedKeyPublic),
-            });
+            }));
             return;
         }
         case "capability-mcp": {

package/dist/http/routes/config-catalog.js

@@ -2,7 +2,7 @@ import { DOMAINS } from "@sema-agent/settings-schema";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
-import { configKnobTable } from "../../config.js";
+import { buildRetiredEnvWire, configKnobTable } from "../../config.js";
 import { buildConfigCatalog } from "../../config-catalog.js";
 export const CONFIG_CATALOG_PATH = "/v1/config/catalog";
 const OPERATOR_ONLY_MESSAGE = "the config catalog is operator-only: the caller principal is not in OPERATOR_PRINCIPALS (an empty list means NO one is an operator — configure it to enable this endpoint)";
@@ -27,6 +27,7 @@ export async function handleConfigCatalog(req, res, match, ctx) {
                 knobs: configKnobTable(),
                 centerDomains: DOMAINS,
                 centerManagedKeys: deps.configCenterManagedKeys?.(),
+                retired: buildRetiredEnvWire(),
             }));
             return;
         }

package/dist/http/routes/diagnostics.js

@@ -1,5 +1,6 @@
 import { buildPostureKnobReading } from "../../posture-source.js";
 import { buildReadFaceWiring } from "../../read-face-posture.js";
+import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isLoopbackAddress, verifiedIdentitySource } from "../principal-gate.js";
@@ -104,6 +105,7 @@ export async function handleDiagnostics(req, res, match, ctx) {
                 sqlEngine: deps.sqlEngineFacts?.() ?? null,
                 writeProtection: deps.writeProtection ?? null,
                 readFace: buildReadFaceWiring(deps.config),
+                executionLane: projectExecutionLaneCapability(deps.config),
                 configApply: deps.configApplyState?.() ?? null,
                 mcpRevocations: deps.mcpRevocationState?.() ?? null,
                 serverGates: buildServerWiringGates({

package/dist/http/routes/fleet.d.ts

@@ -1,8 +1,9 @@
 /**
  * [ref] A9 域模块 —— MF-Fleet 实时舰队流。
  *
- * 路由:`GET /v1/fleet/stream`(SSE PUSH:连上先快照,之后每条 per-row delta)。跑在服务凭据门**之前**
- * (按 principal 自门,与 workflow 只读路由同列)。本域零可变状态。
+ * 路由:`GET /v1/fleet/stream`(SSE PUSH:连上先快照,之后每条 per-row delta)。跑在服务凭据门**之前**的
+ * 读路谓词段(S-672:先过 `dispatch.ts` 的 `readCredentialOk`「服务凭据 ∨ 已验 principal」,再按 principal 自门,
+ * 与 workflow 只读路由同段)。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";

package/dist/http/routes/images.js

@@ -420,7 +420,6 @@ async function streamBakeEvents(req, res, bakes, bakeId, staleMs) {
             return bake ? { status: bake.status, updatedAt: bake.updatedAt } : undefined;
         },
         getEvents: (id, after) => bakes.getEvents(id, after),
-        retainedFrom: (id) => bakes.retainedFrom(id),
         formatEvent: (ev) => ({
             id: ev.seq,
             event: ev.kind,