@sema-agent/server 7.105.0 → 7.106.0

package/dist/key-resolver.js

@@ -1,4 +1,46 @@
-import { isSealedKeyPoison, SealedKeyPoisonedError } from "./sealed-key.js";
+export function modelKeyPoison(p) {
+    const at = new Date().toISOString();
+    if (p.source === "sealed")
+        return { modelKeyPoison: true, source: "sealed", reason: p.reason, publicKeyId: p.publicKeyId, ...(p.errKind ? { errKind: p.errKind } : {}), at };
+    return { modelKeyPoison: true, source: "env", reason: p.reason, apiKeyEnv: p.apiKeyEnv, at };
+}
+export function isModelKeyPoison(v) {
+    return typeof v === "object" && v !== null && v.modelKeyPoison === true;
+}
+export function modelKeyPoisonIdentity(p) {
+    switch (p.source) {
+        case "sealed":
+            return p.publicKeyId;
+        case "env":
+            return p.apiKeyEnv;
+    }
+}
+function poisonedMessage(modelName, p) {
+    switch (p.reason) {
+        case "sealed_decrypt_failed":
+        case "stale_ciphertext":
+        case "no_key_store":
+            return (`sealed api key for model "${modelName}" is unusable (${p.reason}; publicKeyId "${modelKeyPoisonIdentity(p)}"; detected ${p.at}) — ` +
+                `refusing the gateway-key fallback. Fix custody: re-paste the key in the web UI (it seals against the newest registered public key), ` +
+                `or restore this host's private key for that id / complete the rotation so the ciphertext targets a held key.`);
+        case "env_missing":
+            return (`api key for model "${modelName}" is unusable (env_missing: the catalog entry declares apiKeyEnv "${modelKeyPoisonIdentity(p)}" but this service's environment ` +
+                `has no non-empty ${modelKeyPoisonIdentity(p)}; detected ${p.at}) — refusing the gateway-key fallback. Set ${modelKeyPoisonIdentity(p)} in the environment of the ` +
+                `process that runs this service (and restart it), or drop apiKeyEnv from the catalog entry to authenticate this model with the deployment's gateway key on purpose.`);
+    }
+}
+export class ModelKeyPoisonedError extends Error {
+    poison;
+    reason;
+    at;
+    constructor(modelName, poison) {
+        super(poisonedMessage(modelName, poison));
+        this.name = "ModelKeyPoisonedError";
+        this.poison = poison;
+        this.reason = poison.reason;
+        this.at = poison.at;
+    }
+}
 export function createKeyResolver(modelApiKeyEnv, env = process.env, modelApiKeys = {}) {
     if (Object.keys(modelApiKeyEnv).length === 0 && Object.keys(modelApiKeys).length === 0)
         return undefined;
@@ -7,15 +49,31 @@ export function createKeyResolver(modelApiKeyEnv, env = process.env, modelApiKey
         return apiKey ? { apiKey } : undefined;
     };
 }
-export function resolveModelApiKey(modelName, modelApiKeyEnv, env = process.env, modelApiKeys = {}) {
+function chainLookup(modelName, modelApiKeyEnv, env, modelApiKeys) {
     const sealed = modelApiKeys[modelName];
-    if (isSealedKeyPoison(sealed))
-        throw new SealedKeyPoisonedError(modelName, sealed);
+    if (isModelKeyPoison(sealed))
+        return { kind: "poison", poison: sealed };
     if (sealed)
-        return sealed;
+        return { kind: "key", key: sealed };
     const envName = modelApiKeyEnv[modelName];
     if (!envName)
-        return undefined;
-    return env[envName] || undefined;
+        return { kind: "undeclared" };
+    const value = env[envName];
+    return value ? { kind: "key", key: value } : { kind: "poison", poison: modelKeyPoison({ source: "env", reason: "env_missing", apiKeyEnv: envName }) };
+}
+export function modelKeyPoisonOf(modelName, modelApiKeyEnv, env = process.env, modelApiKeys = {}) {
+    const r = chainLookup(modelName, modelApiKeyEnv, env, modelApiKeys);
+    return r.kind === "poison" ? r.poison : undefined;
+}
+export function resolveModelApiKey(modelName, modelApiKeyEnv, env = process.env, modelApiKeys = {}) {
+    const r = chainLookup(modelName, modelApiKeyEnv, env, modelApiKeys);
+    switch (r.kind) {
+        case "key":
+            return r.key;
+        case "poison":
+            throw new ModelKeyPoisonedError(modelName, r.poison);
+        case "undeclared":
+            return undefined;
+    }
 }
 //# sourceMappingURL=key-resolver.js.map

package/dist/leader/leader.d.ts

@@ -16,6 +16,7 @@ import { type RunnerLike, type WorkerReport } from "./fanout.js";
 import { type ExecStreamLike } from "./diffout.js";
 import { type MergeDeps, type MergeResult } from "./merge.js";
 import { type TaskSpec, type VerifyConfig, type CheckpointToken, type TerminalCause, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
+import { type UnattendedLeg } from "../unattended-permission-mode.js";
 /** [ref] Slice 6: drive a worker's resource-suspend auto-resume to a terminal (or bound) state. Exported
  *  for unit tests. Loops `resume(token, slice)` WHILE the result's terminal cause is a park on a
  *  `resource_limit` gate. Exits on: a terminal cause that is not a park, a park on any OTHER gate
@@ -67,6 +68,11 @@ export interface ProvisionedWorker {
 export interface LeaderDeps {
     /** Plan a task into N disjoint-file sub-tasks (MVP: simple/hand-authored; adaptive replan = scale). */
     plan: (task: string) => Promise<SubtaskSpec[]>;
+    /** S-877 候裁 15 / 18 —— 本车道有手的 run 并进的无人值守腿(模式 = 运维旋钮 `UNATTENDED_PERMISSION_MODE`、写面 roots、模式释放写保护时的
+     *  写保护拒层),由 `wire.ts` 经 `createUnattendedLeg` 铸一次递进来。本文件自己起的有手 run(模块门修复)与 `repair-wire.ts` 的单代理修复环按
+     *  `sub.spec` 起 run、不经 provisionWorker —— 两处都经 `withUnattendedLeg` 并进这一份。**必填**(缺席 = core「Absent = default」⇒ 无人可答的腿上
+     *  写与非只读命令被当场拒,codex F1 的病)。 */
+    unattendedLeg: UnattendedLeg;
     /** Provision a leader-owned worker (its env seeded with base at `branch` + an env-bound runner). */
     provisionWorker: (sub: SubtaskSpec) => Promise<ProvisionedWorker>;
     /** Ephemeral no-creds integration sandbox + the credentialed Coordinator push (merge(b) deps). */

package/dist/leader/leader.js

@@ -4,6 +4,7 @@ import { pullDiff } from "./diffout.js";
 import { mergeBranches } from "./merge.js";
 import { Runner, runWithVerification, resumeWithVerification } from "@sema-agent/core";
 import { pausedCauseOf, outwardPlane } from "../terminal.js";
+import { withUnattendedLeg } from "../unattended-permission-mode.js";
 const MAX_RESUME_SLICES = 200;
 export async function autoResumeOnResource(initial, signal, resume, maxSlices = MAX_RESUME_SLICES) {
     let vr = initial;
@@ -200,7 +201,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     }
                     deps.logger?.info?.("module_repair", { workerId: r.workerId, attempt: attempt + 1, reason: redactHead(verdict.reason ?? "", 500) });
                     try {
-                        const rr = await w.runner.runTaskStream({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` }).result();
+                        const rr = await w.runner.runTaskStream(withUnattendedLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` }, deps.unattendedLeg)).result();
                         if (r.stats && rr?.stats)
                             r.stats = { ...r.stats, tokens: (r.stats.tokens ?? 0) + (rr.stats.tokens ?? 0), costMicroUsd: (r.stats.costMicroUsd ?? 0) + (rr.stats.costMicroUsd ?? 0) };
                     }

package/dist/leader/repair-wire.js

@@ -2,6 +2,7 @@ import { runRepairLoop, delimitUntrusted, } from "@sema-agent/core";
 import { mkRepairOracle } from "./repair-oracle.js";
 import { outwardPlane } from "../terminal.js";
 import { redactHead } from "../observability/run-terminal.js";
+import { withUnattendedLeg } from "../unattended-permission-mode.js";
 function statusForTerminal(t) {
     return t === "fixed" || t === "candidate_only" ? "completed" : "failed";
 }
@@ -86,7 +87,7 @@ export function attachRepairLoopDeps(deps, resolve) {
     deps.repairLoop = {
         run: async (solo, sub) => {
             const cfg = await resolve(solo, sub);
-            const implSpec = { ...sub.spec, sessionId: solo.sessionId };
+            const implSpec = withUnattendedLeg({ ...sub.spec, sessionId: solo.sessionId }, deps.unattendedLeg);
             return runRepairLoopForLeader(solo, implSpec, cfg);
         },
     };

package/dist/leader/wire.d.ts

@@ -1,4 +1,4 @@
-import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps } from "@sema-agent/core";
+import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps, type PermissionMode } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type LeaderDeps, type LeaderResult } from "./leader.js";
 import { type DeploymentPostureSeats } from "../boot/runner-deps.js";
@@ -19,6 +19,14 @@ export interface LeaderWireConfig {
      *  REMOTE_EXEC (e2b or k8s/Kata) — workers and the integration sandbox run on envs from THIS factory.
      *  Requires `s3` (diff-out is the worker's self-upload; there is no leader-held env to pull from). */
     envFactory?: ExecutionEnvFactory;
+    /**
+     * S-877 候裁 15 → B —— 本车道**有手**的每一条 run(worker 两车道、集成沙箱修复、模块门修复、单代理修复环)的
+     * `TaskSpec.permissionMode`。**必填**:缺席 = core「Absent = `default`」⇒ 写与非只读命令在无人可答的这条腿上被
+     * headless 当场拒(codex F1 的病);必填让每一个构造本配置的地方都得表态,不许静默落回那一形。
+     * 唯一取值点 = `boot/leader.ts` 调 `unattendedPermissionMode(config)`(`src/unattended-permission-mode.ts`,与 run-local 同一只);
+     * 本文件经 `createUnattendedLeg` / `withUnattendedLeg` 铸并(模式 + 写面 roots + 候裁 18 的写保护拒层)。planner 路由无手,不读。
+     */
+    unattendedPermissionMode: PermissionMode;
     /** Durable suspend/resume for SUB-WORKERS ([ref] C4): when the seat yields a value, that worker task carries
      *  the durable question/ask policy + checkpoint store, so a gated ask/AskUserQuestion SUSPENDS the worker
      *  (checkpoint + paused env) instead of failing — the trigger replan-lite C4 arbitrates on. Mirrors main.ts's

package/dist/leader/wire.js

@@ -5,6 +5,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { Runner, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, delimitUntrusted, hasDestroy, } from "@sema-agent/core";
+import { createUnattendedLeg, withUnattendedLeg } from "../unattended-permission-mode.js";
 import { RemoteContainerExecutionEnv } from "../plugins/remote-env-e2b.js";
 import { E2B_SANDBOX_HOME } from "../execution-lane-caps.js";
 import { createDurableAskPolicy } from "../approval.js";
@@ -138,6 +139,7 @@ export function createLeaderRunner(cfg) {
     const onNoticeSeat = createEngineNoticeSeat(cfg.logger);
     const governanceSeat = cfg.governance ?? {};
     const deploymentPostureSeat = () => cfg.deploymentPosture?.() ?? {};
+    const unattendedLeg = () => createUnattendedLeg(cfg.unattendedPermissionMode, deploymentPostureSeat());
     const tracerSeat = cfg.tracer ? { tracer: cfg.tracer } : {};
     const usageWindowSeat = cfg.usageWindows && cfg.usageWindowStore ? { usageWindows: cfg.usageWindows, usageWindowStore: cfg.usageWindowStore } : {};
     const promptSourceSeat = cfg.promptSource ? { promptSource: cfg.promptSource } : {};
@@ -169,12 +171,12 @@ export function createLeaderRunner(cfg) {
                         delimitUntrusted("FAILING OUTPUT (untrusted)", errorText),
                     ].join("\n");
                     const res = await runner
-                        .runTaskStream({
+                        .runTaskStream(withUnattendedLeg({
                         objective,
                         ...principalSpec(),
                         sessionId: `leader-repair-${Date.now()}-${round}`,
                         limits: { maxCostUsd: repairBudgetUsd, maxWalltimeMs: Math.max(300_000, Math.floor(leaderTimeoutMs / 2)) },
-                    })
+                    }, unattendedLeg()))
                         .result();
                     if (res.terminal.kind !== "completed")
                         throw new Error(`repair round ${round} did not complete (status=${outwardPlane(res.terminal).status})`);
@@ -243,6 +245,7 @@ export function createLeaderRunner(cfg) {
         const provisionWorker = async (sub) => {
             const sessionId = `leader-${sub.workerId}-${Date.now()}`;
             const durable = cfg.durable?.();
+            const resumeCtx = { body: { objective: sub.spec.objective }, unattendedLeg: true };
             let durableSpec = {};
             if (durable) {
                 const d = durable;
@@ -252,7 +255,7 @@ export function createLeaderRunner(cfg) {
                     durableApproval: { scope: "_leader", ...(d.ttlMs ? { ttlMs: d.ttlMs } : {}) },
                     onQuestion: QUESTION_AWAITS_RESUME,
                 };
-                await d.checkpointStore.putCtx(sessionId, { body: { objective: sub.spec.objective } }).catch((e) => {
+                await d.checkpointStore.putCtx(sessionId, resumeCtx).catch((e) => {
                     cfg.logger?.warn?.("leader_putctx_failed", { workerId: sub.workerId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
                 });
             }
@@ -287,7 +290,7 @@ export function createLeaderRunner(cfg) {
                 runner.runTaskStream = (spec, resume) => {
                     const stream = orig(spec, resume);
                     const iv = setInterval(() => {
-                        void d.checkpointStore.putCtx(sessionId, { body: { objective: sub.spec.objective } }).catch(() => { });
+                        void d.checkpointStore.putCtx(sessionId, resumeCtx).catch(() => { });
                     }, 45_000);
                     iv.unref?.();
                     void stream.result().then(() => clearInterval(iv), () => clearInterval(iv));
@@ -322,7 +325,7 @@ export function createLeaderRunner(cfg) {
                         }),
                     })),
                     fetchDiff: () => fetchUploadedDiff(getUrl),
-                    spec: { ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec(), objective: `${sub.spec.objective}${uploadStepSuffix(W)}` },
+                    spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec(), objective: `${sub.spec.objective}${uploadStepSuffix(W)}` }, unattendedLeg()),
                 };
             }
             if (!cfg.e2bApiKey)
@@ -337,7 +340,7 @@ export function createLeaderRunner(cfg) {
                 runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
                 diffEnv: env,
                 destroy: () => env.destroy().then(() => { }),
-                spec: { ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() },
+                spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }, unattendedLeg()),
             };
         };
         const provisionIntegrationSandbox = async () => {
@@ -379,6 +382,7 @@ export function createLeaderRunner(cfg) {
         const deps = {
             plan,
             provisionWorker,
+            unattendedLeg: unattendedLeg(),
             provisionIntegrationSandbox,
             push,
             testCmd: body.testCmd,

package/dist/observability/fail-open.d.ts

@@ -25,6 +25,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-297(`http/routes/sessions.ts lastLegMcpFor`,`/mcp` 面板的可选键 `lastLegMcp`):按会话取最近 run 的索引读 / 那条 run 的账本读**抛错或超期** ⇒ 该键缺席,面板本体照常 200。放行的最坏后果=这一屏少一格「上一次真挂上了什么」(壳退回翻账本),不是门、不是权限、不是凭证 —— 而反方向(让附加键的读失败打掉整张面板)会给一口此前零 MCP 配置下根本不碰账本的**既有**读面新加一条挂掉的理由。缺席本就是本键 wire 上的一等状态(消费端必须会读),所以这条兜底不产生任何新的消费端形态;计数让「某台部署的账本一直读不出来」显形。";
     };
+    readonly "server.unattended-leg.mode-releases-protective-asks": {
+        readonly cls: "P-DEBT";
+        readonly note: "S-877 四续 ⑧(候裁 18 D 的已披露残余,`unattended-permission-mode.ts` 的 `createUnattendedLeg`):无人值守腿(leader worker / 修复腿 / run-local / 续跑重挂)的旋钮 `UNATTENDED_PERMISSION_MODE` 缺省 `bypassPermissions` 释放六类保护问(`probe` / `tool_marks_mcp` / `tool_marks_a2a` / `transcript_write` / `rule_unreadable` / `artifact_shared_read`;写保护一类已改拒)—— 7.105.0 这些腿上它们照问、无人答即拒。放行的最坏后果=无人值守的写 / 读 / MCP·A2A 标记工具调用不再被这几道保护问拦下,`rule_unreadable` 是「规则店读不出照放」(安全轴 fail-open 方向)。core 对这几类没有拒座;S-906(core 7.37.0 按类作答)到货后本臂与旋钮一并硬删。计数 = 铸出的这类腿条数,detail = `mode=<词> released=<类…>`。";
+    };
     readonly "server.workflow-park-index.sync-failed": {
         readonly cls: "P-DEBT";
         readonly note: "S-185 车CM(codex r1-F2 [high],验真后登记):workflow 出身 park 的 join 索引(`workflow_agent_session` / local 账本)在**一次成功的 run 写之后**同步失败 ⇒ 该次同步被吞,重试要等这条 run 的**下一次**写。而 park 恰好常常是这条 run 的**最后**一次写(park = run 终局 `failed`)⇒ 那条 park 可能永久 join 不到,`/decide` 结构性退回本批之前的行为(409 `conflict.resume_context_unavailable`)——**方向是 fail-closed**(不误配、不伪造、不放行任何东西),丢的是「人能不能把这条批准送出去」这个能力。归 P 类的理由是它决定**车道选择**(缺行 ⇒ 选中 legacy 腿),归 DEBT 的理由是真正的解要一条**按子代 checkpoint 键的耐久决议回执 + 重启期回填**(与 codex r1-F3 同一件欠账,另车)。计数非零 = 有 park 因此决不掉,运维要按 detail 里的 runId 去查。";
@@ -263,7 +267,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.run-terminal.provider-echo-shaped": {
         readonly cls: "F";
-        readonly note: "S-283(7.105.0,`observability/run-terminal.ts` 的 `admitProviderEcho`,唯一判决口;S-889 起动作与 core #1204 / 7.34.1 源头闸同一条):模型服务商回声、引擎逐字转交的不透明 id(`apiFailure.requestId` / `responseModel`,以及账本孪生 `turn_end.responseModel`、子代通告 `task_notification.apiFailure.requestId` 与 `POST /v1/side-query` 200 体的 `responseModel`;铸点 + 账本汇点两口)越出形状(字符串、长度 1–128、每个码元是可见 ASCII 0x21–0x7E;空串与非串值都在外)⇒ **缺席**(键删掉 / 不铸)。方向是 **fail-closed**(越界字节不上 wire / 不落库 / 不进日志),不截断、不过脱敏器(不透明 id,脱敏会改坏它 —— 与 S-270 structuredOutput 同方向)。放行的最坏后果 = 这枚 id / 模型名在 wire 上缺席(`apiFailure` 留 `{}` = 「provider 故障、无可补充标签」,core 契约原句),运维拿不到它去服务商那边对单;detail 只带座位 / 原长或类型,**不带值**。计数非零 = 这台部署接的端点(或中间网关)在回显越界字节,运维按座位去查那一跳;读面不改写存量行,存量越界行每次回放各计一次。";
+        readonly note: "S-283(7.105.0,`observability/run-terminal.ts` 的 `admitProviderEcho`,唯一判决口;S-889 起动作与 core #1204 源头闸同一条;S-877 / core 7.35.0 起谓词读 core 包根 `isProviderEchoShape`,core brain 写侧先判(越界 ⇒ trace `brain.echo_dropped`)⇒ 真 brain 链上本 tag 零命中,命中只剩存量行与不经 core brain 写侧的 producer):模型服务商回声、引擎逐字转交的不透明 id(`apiFailure.requestId` / `responseModel`,以及账本孪生 `turn_end.responseModel`、子代通告 `task_notification.apiFailure.requestId` 与 `POST /v1/side-query` 200 体的 `responseModel`;铸点 + 账本汇点两口)越出形状(字符串、长度 1–128、每个码元是可见 ASCII 0x21–0x7E;非串值在外)⇒ **缺席**(键删掉 / 不铸)+ 计数;空串 = 服务商什么都没说 ⇒ 缺席、**不计数**(S-877,core `providerEchoReading` 的读法)。方向是 **fail-closed**(越界字节不上 wire / 不落库 / 不进日志),不截断、不过脱敏器(不透明 id,脱敏会改坏它 —— 与 S-270 structuredOutput 同方向)。放行的最坏后果 = 这枚 id / 模型名在 wire 上缺席(`apiFailure` 留 `{}` = 「provider 故障、无可补充标签」,core 契约原句),运维拿不到它去服务商那边对单;detail 只带座位 / 原长或类型,**不带值**。计数非零 = 这台部署接的端点(或中间网关)在回显越界字节,运维按座位去查那一跳;读面不改写存量行,存量越界行每次回放各计一次。";
     };
     readonly "server.run-terminal.redact-capped": {
         readonly cls: "F";

package/dist/observability/fail-open.js

@@ -16,6 +16,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-297(`http/routes/sessions.ts lastLegMcpFor`,`/mcp` 面板的可选键 `lastLegMcp`):按会话取最近 run 的索引读 / 那条 run 的账本读**抛错或超期** ⇒ 该键缺席,面板本体照常 200。放行的最坏后果=这一屏少一格「上一次真挂上了什么」(壳退回翻账本),不是门、不是权限、不是凭证 —— 而反方向(让附加键的读失败打掉整张面板)会给一口此前零 MCP 配置下根本不碰账本的**既有**读面新加一条挂掉的理由。缺席本就是本键 wire 上的一等状态(消费端必须会读),所以这条兜底不产生任何新的消费端形态;计数让「某台部署的账本一直读不出来」显形。",
     },
+    "server.unattended-leg.mode-releases-protective-asks": {
+        cls: "P-DEBT",
+        note: "S-877 四续 ⑧(候裁 18 D 的已披露残余,`unattended-permission-mode.ts` 的 `createUnattendedLeg`):无人值守腿(leader worker / 修复腿 / run-local / 续跑重挂)的旋钮 `UNATTENDED_PERMISSION_MODE` 缺省 `bypassPermissions` 释放六类保护问(`probe` / `tool_marks_mcp` / `tool_marks_a2a` / `transcript_write` / `rule_unreadable` / `artifact_shared_read`;写保护一类已改拒)—— 7.105.0 这些腿上它们照问、无人答即拒。放行的最坏后果=无人值守的写 / 读 / MCP·A2A 标记工具调用不再被这几道保护问拦下,`rule_unreadable` 是「规则店读不出照放」(安全轴 fail-open 方向)。core 对这几类没有拒座;S-906(core 7.37.0 按类作答)到货后本臂与旋钮一并硬删。计数 = 铸出的这类腿条数,detail = `mode=<词> released=<类…>`。",
+    },
     "server.workflow-park-index.sync-failed": {
         cls: "P-DEBT",
         note: "S-185 车CM(codex r1-F2 [high],验真后登记):workflow 出身 park 的 join 索引(`workflow_agent_session` / local 账本)在**一次成功的 run 写之后**同步失败 ⇒ 该次同步被吞,重试要等这条 run 的**下一次**写。而 park 恰好常常是这条 run 的**最后**一次写(park = run 终局 `failed`)⇒ 那条 park 可能永久 join 不到,`/decide` 结构性退回本批之前的行为(409 `conflict.resume_context_unavailable`)——**方向是 fail-closed**(不误配、不伪造、不放行任何东西),丢的是「人能不能把这条批准送出去」这个能力。归 P 类的理由是它决定**车道选择**(缺行 ⇒ 选中 legacy 腿),归 DEBT 的理由是真正的解要一条**按子代 checkpoint 键的耐久决议回执 + 重启期回填**(与 codex r1-F3 同一件欠账,另车)。计数非零 = 有 park 因此决不掉,运维要按 detail 里的 runId 去查。",
@@ -254,7 +258,7 @@ export const FAIL_OPEN_TAGS = {
     },
     "server.run-terminal.provider-echo-shaped": {
         cls: "F",
-        note: "S-283(7.105.0,`observability/run-terminal.ts` 的 `admitProviderEcho`,唯一判决口;S-889 起动作与 core #1204 / 7.34.1 源头闸同一条):模型服务商回声、引擎逐字转交的不透明 id(`apiFailure.requestId` / `responseModel`,以及账本孪生 `turn_end.responseModel`、子代通告 `task_notification.apiFailure.requestId` 与 `POST /v1/side-query` 200 体的 `responseModel`;铸点 + 账本汇点两口)越出形状(字符串、长度 1–128、每个码元是可见 ASCII 0x21–0x7E;空串与非串值都在外)⇒ **缺席**(键删掉 / 不铸)。方向是 **fail-closed**(越界字节不上 wire / 不落库 / 不进日志),不截断、不过脱敏器(不透明 id,脱敏会改坏它 —— 与 S-270 structuredOutput 同方向)。放行的最坏后果 = 这枚 id / 模型名在 wire 上缺席(`apiFailure` 留 `{}` = 「provider 故障、无可补充标签」,core 契约原句),运维拿不到它去服务商那边对单;detail 只带座位 / 原长或类型,**不带值**。计数非零 = 这台部署接的端点(或中间网关)在回显越界字节,运维按座位去查那一跳;读面不改写存量行,存量越界行每次回放各计一次。",
+        note: "S-283(7.105.0,`observability/run-terminal.ts` 的 `admitProviderEcho`,唯一判决口;S-889 起动作与 core #1204 源头闸同一条;S-877 / core 7.35.0 起谓词读 core 包根 `isProviderEchoShape`,core brain 写侧先判(越界 ⇒ trace `brain.echo_dropped`)⇒ 真 brain 链上本 tag 零命中,命中只剩存量行与不经 core brain 写侧的 producer):模型服务商回声、引擎逐字转交的不透明 id(`apiFailure.requestId` / `responseModel`,以及账本孪生 `turn_end.responseModel`、子代通告 `task_notification.apiFailure.requestId` 与 `POST /v1/side-query` 200 体的 `responseModel`;铸点 + 账本汇点两口)越出形状(字符串、长度 1–128、每个码元是可见 ASCII 0x21–0x7E;非串值在外)⇒ **缺席**(键删掉 / 不铸)+ 计数;空串 = 服务商什么都没说 ⇒ 缺席、**不计数**(S-877,core `providerEchoReading` 的读法)。方向是 **fail-closed**(越界字节不上 wire / 不落库 / 不进日志),不截断、不过脱敏器(不透明 id,脱敏会改坏它 —— 与 S-270 structuredOutput 同方向)。放行的最坏后果 = 这枚 id / 模型名在 wire 上缺席(`apiFailure` 留 `{}` = 「provider 故障、无可补充标签」,core 契约原句),运维拿不到它去服务商那边对单;detail 只带座位 / 原长或类型,**不带值**。计数非零 = 这台部署接的端点(或中间网关)在回显越界字节,运维按座位去查那一跳;读面不改写存量行,存量越界行每次回放各计一次。",
     },
     "server.run-terminal.redact-capped": { cls: "F", note: "S-107:终态自由文本(errorMessage/blockedReason/remoteEnvFailures[].message/error 列/done·failed 行)长度 > REDACT_INPUT_CAP(64KB)⇒ 整段换 «redacted:oversized»(fail-closed 取证丢弃,不截断不扫);计数=多少条终态文案被整段丢弃" },
     "server.run-terminal.artifact-capped": { cls: "F", note: "S-107:leader_run 行上的工件字节(salvaged[].patch / candidatePatch.patch / merge.candidatePatch / merge.rej)长度 > ARTIFACT_INPUT_CAP(256KB)⇒ 整份换 «redacted:oversized-artifact»(fail-closed 取证丢弃;原字节仍在 worker 分支/merge 咽喉);计数=多少份工件被整份丢弃" },

package/dist/observability/metrics.js

@@ -215,6 +215,7 @@ export function createMetrics() {
     m.counter("http_requests_total", "HTTP requests by route/method/status");
     m.histogram("http_request_duration_seconds", "HTTP request duration");
     m.counter("rate_limited_total", "Requests rejected by the rate limiter");
+    m.counter("brain_echo_dropped_total", "Provider echo fields (response request-id header / reported model name) the engine's brain dropped at write time for failing the echo shape (visible ASCII, 1-128 chars), by field (requestId|responseModel); non-zero = the endpoint or a gateway in front of it echoes out-of-shape bytes");
     m.counter("mcp_probe_total", `No-run MCP status face outcomes by outcome (${MCP_PROBE_OUTCOMES.join("/")} — see src/capabilities/mcp-probe.ts MCP_PROBE_OUTCOMES; rate_limited has TWO causes: the per-identity fixed window AND the replica-wide in-flight cap, which can refuse caller B because of caller A)`);
     m.counter("tasks_total", "Finished tasks by terminal status");
     m.counter("task_tokens_total", "Total model tokens consumed by tasks");
@@ -296,6 +297,7 @@ export function createMetrics() {
     m.counter("fleet_lease_exhausted_total", "Fleet trace-lease requests rejected because the pool was exhausted");
     m.counter("fleet_lease_auth_error_total", "Fleet trace-lease auth failures");
     m.counter("fleet_lease_fail_open_total", "Fleet trace-lease fail-open grants (lease store unavailable)");
+    m.counter("fleet_lease_fail_closed_total", "Fleet quota-lease refusals because the center was unreachable / 5xx / timed out / answered malformed while FLEET_LEASE_FAIL_CLOSED is in effect (billed submissions answered 503 fleet.lease_unavailable)");
     m.counter("metric_label_overflow_total", "Label values collapsed to 'other' by the cardinality guard, by label");
     m.counter("remote_env_exec_idle_timeout_total", "Remote-env exec idle timeouts, by provider");
     m.counter("remote_env_file_timeout_total", "Remote-env file-op timeouts, by provider");

package/dist/observability/permission-rule-events.d.ts

@@ -4,7 +4,7 @@ export declare const PERMISSION_RULE_EVENT_TABLE: readonly [{
     readonly meaning: "a persisted allow rule authorized the call and nobody was asked";
 }, {
     readonly event: "rule_store_unreadable";
-    readonly meaning: "the rule store failed to read, so the call was adjudicated with ZERO rules (expect an approval storm whose cause is the store, not the model)";
+    readonly meaning: "the rule store failed to read, so the failed partition's rows were SKIPPED for that read (core C-R172: no store card; its allow rows clear nothing and its deny rows protect nothing until a read succeeds — expect extra cards and missing refusals whose cause is the store, not the model)";
 }, {
     readonly event: "read_only_allowed";
     readonly meaning: "the engine's read-only shell verdict cleared an ask that was NOT an operator-written rule (core decisionReason \"read_only\"; an operator-declared ask carries matchedAskRule and is never cleared this way)";

package/dist/observability/permission-rule-events.js

@@ -6,7 +6,7 @@ export const PERMISSION_RULE_EVENT_TABLE = [
     },
     {
         event: "rule_store_unreadable",
-        meaning: "the rule store failed to read, so the call was adjudicated with ZERO rules (expect an approval storm whose cause is the store, not the model)",
+        meaning: "the rule store failed to read, so the failed partition's rows were SKIPPED for that read (core C-R172: no store card; its allow rows clear nothing and its deny rows protect nothing until a read succeeds — expect extra cards and missing refusals whose cause is the store, not the model)",
     },
     {
         event: "read_only_allowed",

package/dist/observability/run-terminal.d.ts

@@ -125,7 +125,44 @@ export declare function redactErrorMessage(raw: string | undefined): string | un
  *    `task_run.error` 那一列 `TEXT(65 535 字节)` 定的,套到这里等于用静默的数据损坏换一次脱敏。
  */
 export declare function redactModelText(raw: string): string;
-/** 回声座上的值留不留:形内 ⇒ `true`(原样留);`undefined` ⇒ `false`(缺席本身,不计数);其余越界 ⇒ `false` + 计数。
+/**
+ * 🔴 **provider 回声字段的形状闸 —— 唯一铸点**(S-283,7.105.0;test [ref] 附带;动作经 S-889 与 core 源头闸归一)。
+ *
+ * **回声字段是什么**:模型服务商(上游模型 API / 中间网关)在响应里给、引擎**逐字转交**的不透明标识 ——
+ * `apiFailure.requestId`(响应头 `request-id` / `x-request-id`,core `brain/errors.js` 的 `readProviderRequestId`)、
+ * `responseModel`(服务商自报的模型名,与账本 `turn_end.responseModel` 是孪生)、工具调用 id(`strandedHumanAnswers[].toolCallId` /
+ * `stats.humanReview.gates[].toolCallId`;core `brain/openai.js` / `brain/anthropic.js` 取 `tc.id` / `cb.id`,只在缺席时
+ * `mintFallbackToolCallId` 自铸兜底)。字节由**部署方接的那个端点**决定,本栈一个都没铸 ⇒ **不可信**。
+ *
+ * 🔴 **本闸只施加在「这个值出现的每一张脸都被覆盖到」的回声上**(codex r1 F1,实测成立的回归后改判):工具调用 id 是
+ * **跨面 join 键** —— 同一枚 id 同时逐字出现在 `tool_start` / `tool_end` / 审批卡等逐帧面上。只在结果面动它 ⇒ 结果面与逐帧面
+ * join 不上。所以它的处置词是 `"provider-join-key"`:信任类仍是 provider 回声,但形状闸只能在**全部面的共同入口**一次施加
+ * (独立一车,已登记为债),本面逐字。`requestId` / `responseModel` 的每一张脸(结果面四处 + 账本孪生 + 子代通告 + `POST /v1/side-query` 200 体的 `responseModel`,
+ * 后者 7.105.0 合并复审 X1 补上 —— `http/routes/side-query.ts` 的 `shapeSideQueryEcho`)本闸都覆盖到了。
+ *
+ * **只做形状校验,不过脱敏器**(本车裁,与 S-270 / clay [ref] ② 的 `structuredOutput` 逐字回声面同一方向):回声值
+ * 语义上是**不透明 id**(工单号 / join 键),脱敏器的值臂会把形似密钥的 id 改坏(`sk-…` 形的 id 整段成 `«redacted:key»`),
+ * 而 id 被改坏 = 下游 join / 支持工单对不上;该防的是**形**(超长串撑爆终局体与日志、控制字符 / 终端转义序列改写
+ * 显示、bidi / 非 ASCII 冒充),不是「里面像不像密钥」。
+ *
+ * 🔴 **形状与动作 = core 源头闸同一条规则**(S-889,主会话裁;core **#1204**,原排 7.34.1、随 7.35.0 到货,包根导出 `PROVIDER_ECHO_SHAPE` +
+ * `isProviderEchoShape(value: string): boolean`,字母表采本仓提出的这一张):
+ *  · **形内** = 字符串、长度 1–128、每个码元都是可见 ASCII(0x21–0x7E;空格、空串与一切控制 / 非 ASCII 码元都在外)⇒ 原样;
+ *  · **越界**(含非串值)⇒ **缺席**(键删掉 / 不铸)+ 计数 `server.run-terminal.provider-echo-shaped`(detail 只带座位与原长 / 类型,
+ *    **不带值**)。不截断、不带记号 —— 首版的「截成 127 + `…`」与 core 的「越界 ⇒ 缺席」是同一个键上两种处置,那一形 7.105.0 不发;
+ *    截断记号、「截过的形是不动点」那套逻辑随之删除(规则变少)。缺席本来就是这几个键在 wire 上的一等状态(`apiFailure` 留下
+ *    `{}` = 「provider 故障、无可补充标签」,core 契约原句),消费端不需要新读法。
+ *  · `undefined` 与**空串** = 缺席本身(服务商什么都没说),不计数、不铸键 —— 空串一臂是 S-877 / core 7.35.0 #1204 的读法
+ *    (`brain/errors.d.ts` 的 `providerEchoReading` 逐字「a non-string or the empty string states nothing (`absent` — no field,
+ *    nothing counted)」;修前本仓把空串算越界计一次)。非串值本仓**照旧计数**:core 那句说的是 brain 读服务商原始响应,本口读的是
+ *    持久行 / 非 core 的 Runner 给的形,一个非串的回声座是坏行,响亮([ref])。
+ * ✅ 谓词 = core 包根导出的 `isProviderEchoShape`(S-877 起换调;本地那两行定义已删 —— 字母表同源,本仓不留第二份)。
+ * 🔴 **core 7.35.0 起 core 的 brain 在写侧先判一次**(`brain/stream-shared.js` `noteResponseModel` / `brain/errors.js`
+ *    `readProviderRequestId`:越界 ⇒ 不写、run 里发 trace `brain.echo_dropped {field}`)⇒ 真 brain 链上越界值到不了本口,本口的
+ *    计数只剩「不经 core brain 写侧」的 producer(存量行、宿主自己的 Brain / 自接 `sideQuery` 席)。
+ * **不进模型上下文**:本仓没有任何一处把这几片回声喂进提示词(它们只上 wire / 落库 / 进日志)——这一闸管的就是那几面。
+ */
+/** 回声座上的值留不留:形内 ⇒ `true`(原样留);`undefined` / 空串 ⇒ `false`(缺席本身,不计数);其余越界 ⇒ `false` + 计数。
  *  调用方按 `false` 删键 / 不铸键 —— 本函数是全部回声座(结果面 / 账本孪生 / 子代通告 / side-query 200 体)的**唯一**判决口。 */
 export declare function admitProviderEcho(value: unknown, seat: string): value is string;
 /** {@link redactTerminalResult} 会碰的全部顶层键 = 现行形里**不是** `"verbatim"` 的行(`"redacted"` ∪ S-283 的

package/dist/observability/run-terminal.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { redactSecrets, normalizeForRedaction } from "../trace/redact.js";
+import { isProviderEchoShape } from "@sema-agent/core";
 import { isModelTextLedgerEventType, isParkLedgerEventType } from "../trace/ledger-events.js";
 import { isUnsuccessfulRunStatus } from "../plugins/store-contracts.js";
 import { sealResultForExit } from "../terminal.js";
@@ -97,12 +98,8 @@ export function redactModelText(raw) {
         return OVERSIZED_REDACTION_PLACEHOLDER;
     }
 }
-const PROVIDER_ECHO_SHAPE = /^[\x21-\x7E]{1,128}$/;
-function isProviderEchoShape(value) {
-    return PROVIDER_ECHO_SHAPE.test(value);
-}
 export function admitProviderEcho(value, seat) {
-    if (value === undefined)
+    if (value === undefined || value === "")
         return false;
     if (typeof value === "string" && isProviderEchoShape(value))
         return true;

package/dist/observability/secret-env-scrub.js

@@ -27,7 +27,7 @@ export const SECRET_ENV_SCRUB_SITES = {
     },
 };
 const SCRUB_COUNTER = "secret_env_scrubbed_total";
-const SCRUB_COUNTER_HELP = "secret env entries not handed on as written (dropped or replaced in place) to a spawned child process, by site/kind/confidence (core scrubSecretEnv rules + server config-catalog secret names + name-list knobs)";
+const SCRUB_COUNTER_HELP = "secret env entries not handed on as written (dropped) to a spawned child process, by site/kind/confidence (core scrubSecretEnv rules + server config-catalog secret names + name-list knobs)";
 const DISCLOSED_CAP = 512;
 const SEP = "=";
 let sink = {};

package/dist/observability/tool-trace.d.ts

@@ -14,6 +14,8 @@ import type { Metrics } from "./metrics.js";
  * 🔴 BREAKING(server 7.64.0,core 7.6.0 提货):标签名 `source` → `deniedBy`,词表从七词
  * (`policy/hook/safety/shellGate/planMode/classifier/org`)换成八词
  * (`policy/hook/org/classifier/plan_mode/compliance/write_protection/ask_resolution`)。仪表盘/告警规则要改。
+ * 🔁 server 7.106.0(S-877 / core 7.34.0 [ref]):`plan_mode` 这个词退役,换成 `mode`(模式自己拒的那一形:`dontAsk` 拒每一只非授权 ask、
+ *    `bypassPermissions` 拒判不出保护的写)—— 标签值原样取 core 的 `isDeniedBy`,按 `deniedBy="plan_mode"` 写的告警规则改 `mode`。
  *
  * 🔴 **第二个计数器 `auto_mode_classifier_deny_cause_total{cause}`(server 7.70.0 生为
  * `auto_mode_classifier_unavailable_total`,core 7.12.0 [ref];**7.72.0 / core 7.14.0 [ref] 改名、换座、换词**,见本段末)**

package/dist/operator-ask.d.ts

@@ -34,6 +34,10 @@
  *  · **问答工具**(`deployment-governance.ts` 的 `AskUserQuestion`)—— core 的谓词把保留问答工具单列豁免。
  */
 import type { PermissionResult } from "@sema-agent/core";
+/** 本文件两只铸点的返回形 = core `PermissionResult` 的 ask 臂(窄型:`authoredBy` 只长在这一臂上)。 */
+export type OperatorAskResult = Extract<PermissionResult, {
+    action: "ask";
+}>;
 /**
  * 铸一条**运维声明产生的** `ask`。
  *
@@ -42,5 +46,29 @@ import type { PermissionResult } from "@sema-agent/core";
  *   request」,所以它既不上 wire、也不进卡,写的必须是**真实的那条声明**而不是一句好看的话。
  * @param message 给人看的那句话(照旧上卡)。
  */
-export declare function operatorAsk(rule: string, message: string): PermissionResult;
+export declare function operatorAsk(rule: string, message: string): OperatorAskResult;
+/**
+ * 🔴 **S-877 候裁 16 —— 运维声明的「恒问人」**(`APPROVAL_NEVER_AUTO` 的「always human」、耐久资源预算耗尽的「human approval required」):
+ * 在 {@link operatorAsk} 之上再盖部署出身 `authoredBy: "deployment"` ⇒ core 类读 `operator_forced`(`ruleClearanceOf`:
+ * 「a deployment-authored ask」进强制门 ⇒ `mandated`)—— bypassPermissions 放不掉、**任何**站着的答案(持久规则、会话授权,
+ * 任何 scope)退不掉,只有**这一次**的应答能答它。
+ *
+ * **为什么现在需要**:修前这两类 ask 挡住会话授权靠的是策略层的**次序**(`createDurableAskPolicy` 先判 neverAuto / 预算耗尽,再查
+ * 豁免探针)。候裁 16 把会话授权的兑现位收到**审批席**(协调器 `standingGrantSettles`,判据 = `standingAnswerMayRetire`),而审批席
+ * 读不到 `matchedAskRule`(core 刻意不上卡)—— 不盖出身,一条 `remember:"session"` 就会在审批席上退役「恒问人」。盖了之后
+ * 席的同一只判据按 `mandated` 挡住它,耐久 `/decide` 腿的可记性(park 行 `mandated` 孪生位)同判 ⇒ 回执 `rememberApplied:false`。
+ * live 腿修前这里本就是个洞(进程内 `allow_session` 授权可退役 neverAuto 卡),随类收掉。
+ *
+ * ⚠️ **只**这两类:普通 `APPROVAL_REQUIRE` 仍只经 {@link operatorAsk}(候裁 8 裁 A —— 用户「本会话放行」退役它们是产品设计,不收紧)。
+ */
+export declare function operatorAlwaysHumanAsk(rule: string, message: string): OperatorAskResult;
+/**
+ * core 部署出身位 `authoredBy:"deployment"` 的**唯一**盖位函数(S-897 起收成一处):给一只**部署自己的声明**产的 ask 盖上出身 ⇒
+ * core 类读 `operator_forced`、`mandated`、不铸 `mandate` 词(表外的门;缺词 = 另有门在)⇒ bypassPermissions 放不掉、站着的答案
+ * 退不掉、壳也不会按单个强制词替人答。三个调用者:{@link operatorAlwaysHumanAsk}(`APPROVAL_NEVER_AUTO` / 预算耗尽)、
+ * 治理层包装(`runtime-governance.ts` 的 `createGovernanceAskMarkingPolicy`)、SUP 路由姿态(`router/route-orchestration.ts`,
+ * 经 {@link operatorAlwaysHumanAsk})。修前前两处各写一份 `{ ...d, authoredBy: "deployment" }`(两个写者),S-897 若再抄就是第三份。
+ * 只作用于 ask 臂(类型上就只收 ask);其余键逐字透传。
+ */
+export declare function withDeploymentAuthorship<A extends OperatorAskResult>(ask: A): A;
 //# sourceMappingURL=operator-ask.d.ts.map

package/dist/operator-ask.js

@@ -1,4 +1,10 @@
 export function operatorAsk(rule, message) {
     return { action: "ask", message, decisionReason: "rule", matchedAskRule: rule };
 }
+export function operatorAlwaysHumanAsk(rule, message) {
+    return withDeploymentAuthorship(operatorAsk(rule, message));
+}
+export function withDeploymentAuthorship(ask) {
+    return { ...ask, authoredBy: "deployment" };
+}
 //# sourceMappingURL=operator-ask.js.map

package/dist/parked-decide.d.ts

@@ -9,7 +9,7 @@
  * 行永 parked、生命周期分叉)。
  */
 import type { HostDecision } from "./host-decision.js";
-import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, QuestionAnswer, ResumeOutcome, TaskRegistry, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
+import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, QuestionAnswer, ResumeOutcome, TaskRegistry, ToolExecuteContext, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
 import type { ParkedReviveSurfaceFactory } from "./parked-revive-surface.js";
 import type { RebuiltInheritedGate } from "./boot/parked-revive-gate.js";
 import { type WorkflowRunParkKey, type WorkflowAgentSessionIndex } from "./orchestration/workflow-agent-session-index.js";
@@ -142,6 +142,19 @@ export interface ParkedDecideDeps {
     rebuildInheritedGate?: (row: BackgroundAgentRecord, identity: {
         principal: string | undefined;
     }) => Promise<RebuiltInheritedGate | undefined>;
+    /**
+     * 🔴 S-877 四续 ⑪ —— 复活子代**自己的**审批席(`ToolExecuteContext.onAsk`:core 的委派工具把它转给子代,子代自己的引擎问 —— 模式写门 /
+     * 形状层 —— 在这里答)。本腿直接调 `execute`,不经 Runner,ctx 由本腿铸;不给 ⇒ 子代自己的问落 subRunner 的 `deps.onAsk`(协调器
+     * `ask()` 的无 ALS 上下文臂,没有会话身份 ⇒ 读不了会话授权 ⇒ 每条非只读命令 / 每次写都再 park,`remember:"session"` 对复活子代无效;
+     * 子代活着时同一问落父的席、带身份、读得到授权 —— 同一个子代两种答案)。生产 = 协调器的窗 0 席 `boundUnattendedAsk`(与 bg run 腿给父任务
+     * 装的同一只):身份 = 行的根会话(与 remember 的授权锚同键 {@link grantRootOf})+ 权威 principal;授权读不中 ⇒ 无人值守政策口(park),
+     * 不放宽。缺席(协调器未装的部署)⇒ ctx 不带座,逐字今天。
+     */
+    approverSeatFor?: (identity: {
+        owner: string | null;
+        taskId: string;
+        sessionId: string;
+    }) => NonNullable<ToolExecuteContext["onAsk"]>;
     warn?: (event: string, fields: Record<string, unknown>) => void;
 }
 export interface ParkedDecideRequest {

package/dist/parked-decide.js

@@ -62,6 +62,9 @@ export async function findParkedAgentForCheckpoint(agentStore, cp) {
     }
     return undefined;
 }
+function grantRootOf(row) {
+    return row.rootSessionId ?? row.parentSessionId;
+}
 function mintReviveArgs(row, knownAgentTypes) {
     return {
         prompt: row.description ?? "resume parked agent",
@@ -148,7 +151,7 @@ function sessionGone(taskId) {
 }
 export async function decideParkedAgent(deps, req, match) {
     const row = match.row;
-    const rememberRoot = req.grantRemember !== undefined ? (row.rootSessionId ?? row.parentSessionId) : undefined;
+    const rememberRoot = req.grantRemember !== undefined ? grantRootOf(row) : undefined;
     if (req.grantRemember !== undefined && rememberRoot === undefined) {
         return { status: 400, body: { error: "remember cannot be applied: this parked agent row carries no root/parent session anchor for the exemption", errorCode: "decide.parked_remember_unsupported", taskId: match.handle } };
     }
@@ -234,9 +237,13 @@ export async function decideParkedAgent(deps, req, match) {
         }
     }
     const outcome = buildParkedResumeOutcome(req);
+    const seatRoot = grantRootOf(row);
     const ctx = {
         toolCallId: `drv-${ticket.claimId}`,
         ...(surface.mountsCallerTool !== undefined ? { mountsCallerTool: surface.mountsCallerTool } : {}),
+        ...(deps.approverSeatFor !== undefined && seatRoot !== undefined
+            ? { onAsk: deps.approverSeatFor({ owner: decodeCheckpointScope(req.scope) ?? null, taskId: match.handle, sessionId: seatRoot }) }
+            : {}),
         reviveClaim: {
             row: { ...ticket.row, parkClaimId: ticket.claimId },
             rev: ticket.reservedRev,