@sema-agent/server 7.107.0 → 7.109.0

package/dist/boot/stage-08-reapers.d.ts

@@ -40,6 +40,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;

package/dist/boot/stage-09-leader.d.ts

@@ -76,6 +76,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;

package/dist/boot/stage-10-http-server.d.ts

@@ -76,6 +76,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;

package/dist/boot/stage-10-http-server.js

@@ -26,7 +26,7 @@ import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export async function runStage10(ctx) {
-    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, config, configCenter, consolidationValve, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, noteSessionIncarnation, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, registryJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
+    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, parkCommits, config, configCenter, consolidationValve, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, noteSessionIncarnation, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, registryJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
     const stores = {
         runStore,
         resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
@@ -303,6 +303,8 @@ export async function runStage10(ctx) {
         version: serviceVersion(),
         runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState,
         storeLiveProbe, configCenter,
+        toolApproval,
+        parkCommits,
         deviceHub: deviceLane?.hub,
         retentionLane: retentionLaneStarted,
         releaseRetentionLease: retentionLaneStore !== undefined ? () => retentionLaneStore.release(instanceId) : undefined,

package/dist/brain.js

@@ -8,6 +8,7 @@ import { dispatchBrainLane } from "./model-provider.js";
 import { openaiRouteBaseUrl } from "./model-route-endpoint.js";
 import { catalogEntryFingerprint } from "./config-center/restart-signal.js";
 import { buildDisplaySafeRefusal, buildDisplaySafeUrl } from "./trace/redact.js";
+import { createModelReachBrain } from "./model-unreachable-notice.js";
 function isOffDeploymentRoot(baseUrl, config) {
     if (!baseUrl)
         return false;
@@ -138,7 +139,7 @@ export function createBrain(config, deps = {}) {
             });
         }
     }
-    return brain;
+    return createModelReachBrain(brain);
 }
 export function degradeTargetOf(config) {
     return config.degrade?.reactive ? config.models?.[config.degrade.to] : undefined;

package/dist/capabilities/scenarios.d.ts

@@ -246,8 +246,9 @@ export declare function centerScenarios(deps: ScenarioDeps, specs: CenterScenari
 };
 /**
  * Personalization seam: merge the caller's own skills AFTER the scenario's, with
- * SCENARIO-WINS on a name clash — the security baseline (scenario/center skills) can never be shadowed
- * by user content. Duplicate names within the user list keep the first. Clashes are logged for audit
+ * SCENARIO-WINS on a name clash — the scenario / center skills own the name (they are the deployment's baseline
+ * wording, not an enforcement face: permissions / write gates / hooks do not ride on skills, and a caller may
+ * unload the whole set with `disableSkills`, S-946); user content never shadows them. Duplicate names within the user list keep the first. Clashes are logged for audit
  * (silent drops would make "my skill didn't fire" undebuggable). Input is already shape/size-validated
  * by the HTTP layer (validateUserSkills); this stays pure merge policy.
  */

package/dist/config-catalog.js

@@ -1,10 +1,9 @@
-import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, PERMISSION_MODES } from "@sema-agent/core";
+import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } from "@sema-agent/core";
 import { CENTER_CREDENTIAL_ENV, DOMAIN_SCHEMAS } from "@sema-agent/settings-schema";
 import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS, CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS } from "./center-credential-renewer.js";
 import { THINKING_FORMATS } from "./model-compat.js";
 import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CONFIG_PROVIDER_WORDS, DB_BACKEND_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { webSearchProviderFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
-import { UNATTENDED_PERMISSION_MODE_DEFAULT } from "./unattended-permission-mode.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
@@ -454,7 +453,6 @@ export const CONFIG_CATALOG = [
     r("TRACE_THINKING", "observability", "boolean", "思考轨迹入 durable 事件日志(敏感部署可关;落盘前脱敏)", { staticDefault: "true", danger: DATA, configKey: "traceThinking" }),
     r("TRACE_TOKEN", "observability", "secret", "Task Trace API 只读令牌(fleet 拉轨迹,不授任务/配置权)", { danger: SEC }),
     r("UNATTENDED_APPROVAL_POLICY", "approval", "enum", "无人能答的治理 ask 终局(park=durable 等人;deny=当场拒 —— 自声明无人值守)", { enumValues: ["park", "deny"], staticDefault: "park", danger: SEC, configKey: "unattendedApprovalPolicy" }),
-    r("UNATTENDED_PERMISSION_MODE", "approval", "enum", "无人值守腿(leader worker / leader 修复腿 / run-local:本仓自铸 spec、无调用方可表态、无审批席)的权限模式;写面恒 roots(不随 bypassPermissions 开放);词表外拒启", { enumValues: [...PERMISSION_MODES], staticDefault: UNATTENDED_PERMISSION_MODE_DEFAULT, danger: SEC, configKey: "unattendedPermissionMode" }),
     r("UNREACHED_ASK_TTL_MS", "approval", "number", "零活流铸造的 ask 悬挂窗(ms;[60s,24h] 拒启带界)", { staticDefault: "3600000" }),
     r("USAGE_WINDOWS", "orchestration", "opaque", "部署级治理窗(JSON 数组;滑动窗内跨任务 token/$ 预算,key=principal)", { danger: BILL }),
     r("WEB_SEARCH_API_KEY", "orchestration", "secret", "web search 后端 API 凭据(brave/tavily)", { danger: [...SEC, ...BILL] }),

package/dist/config-center/apply-effective.js

@@ -2,6 +2,7 @@ import { resolveActiveTiers } from "@sema-agent/settings-schema";
 import { modelKeyPoison } from "../key-resolver.js";
 import { applyAutoCompactWindow, buildModelCostKey, findUnmatchableToolNames, formatUnmatchableToolNames, parseAutonomy } from "../config.js";
 import { buildModelCompat, readModelCompat } from "../model-compat.js";
+import { buildModelHeadersKey } from "../model-entry-headers.js";
 import { validateCommandRules } from "../runtime-governance.js";
 import { projectCollabToWorkflows, registerCollabWorkflows } from "../capabilities/collab-workflows.js";
 import { stageLimits } from "./stage-limits.js";
@@ -50,6 +51,7 @@ function toModel(m, envDefaults = {}, logger) {
         ...(compat ? { compat } : {}),
         ...(m.extraBody ? { extraBody: m.extraBody } : {}),
         ...(Array.isArray(m.promptGuidance) && m.promptGuidance.length > 0 ? { promptGuidance: m.promptGuidance.map(String) } : {}),
+        ...buildModelHeadersKey(m.name, m.headers, m.api),
     };
     const explicitAct = m.autoCompactTokens;
     applyAutoCompactWindow(model, typeof explicitAct === "number" ? explicitAct : undefined);

package/dist/config-center/types.d.ts

@@ -82,6 +82,13 @@ export interface CenterModel {
      *  configured sentences parse fine in registry-core but never reach the assembly face ([ref]① 排雷:
      *  the missing leg made every promptGuidance pilot a false control). */
     promptGuidance?: string[];
+    /**
+     * S-931(7.108.0)—— 这条条目发给供应商的**附加请求头**(部署 ↔ 供应商的契约;今天只有 `anthropic-beta`),上 core 的 per-model
+     * 头座 `Model.headers`。类型是 `unknown` 而不是那个结构,理由与 {@link CenterModel.compat} 逐字同:本类型是承载形,判据(闭集白名单 +
+     * 线路 + 值形)与坏形处置的单一属主是 `model-entry-headers.ts`(执法点 = S-704 逐条判据,判不过 ⇒ 条目不可用)。
+     * ⚠️ 两条读腿今天**剥掉**它(settings-schema 6.3.0 `ModelEntry` 无此键;候裁加字段):今天到得了这里的只有绕过读腿的输入。
+     */
+    headers?: unknown;
     enabled?: boolean;
 }
 export type CenterRoleTarget = {

package/dist/config-provider.js

@@ -125,6 +125,7 @@ export function mapToServiceEffective(eff, version) {
                 ...(m.cost !== undefined ? { cost: m.cost } : {}),
                 ...(m.extraBody !== undefined ? { extraBody: m.extraBody } : {}),
                 ...(m.compat !== undefined ? { compat: m.compat } : {}),
+                ...(m.headers !== undefined ? { headers: m.headers } : {}),
                 ...(m.promptGuidance !== undefined ? { promptGuidance: m.promptGuidance } : {}),
                 enabled: m.enabled,
             })),

package/dist/config-types.d.ts

@@ -9,7 +9,7 @@ import type { ReadFaceSource } from "./read-face-posture.js";
 import type { PostureSource } from "./posture-source.js";
 import type { SealedCustodyPoison } from "./key-resolver.js";
 import type { ModelEntryRefusal } from "./model-entry-refusal.js";
-import type { PermissionMode, A2aServerSpec, CompliancePosture, CrossSessionDialogExpiry, CrossSessionInboundSetting, FileHistoryRetentionPolicy, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy, ShellGateDoctrine, WriteProtectedEntry } from "@sema-agent/core";
+import type { A2aServerSpec, CompliancePosture, CrossSessionDialogExpiry, CrossSessionInboundSetting, FileHistoryRetentionPolicy, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy, ShellGateDoctrine, WriteProtectedEntry } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 import type { ElicitationThrottle } from "./elicitation.js";
 import type { QuestionThrottle } from "./question.js";
@@ -1920,13 +1920,6 @@ export interface ServiceConfigFlat {
      *    把批关掉(同腿后续的卡人批不动)、把兄弟连坐成 VOID(裸 `false` = 人拒)。
      */
     unattendedApprovalPolicy: UnattendedApprovalPolicy;
-    /**
-     * S-877 候裁 15 → B(`UNATTENDED_PERMISSION_MODE`)—— 本仓**自铸** spec、无调用方可表态、无审批席的腿(leader worker / leader 修复腿 /
-     * run-local)的 `TaskSpec.permissionMode`。闭集 = core `PERMISSION_MODES`,缺省 `bypassPermissions`(写门 / 形状层 = 7.105.0;写保护经 `createUnattendedWriteProtectionPolicy` 从问改拒;其余六类释放 = 宽化,候裁 18 D),坏值拒启。
-     * 规则 / 三问 / 写面 / 射程外**一处成文** = `src/unattended-permission-mode.ts` 模块头注;唯一读函数 `unattendedPermissionMode(config)`。
-     * 纯部署级:不读任何客户端表态、不参与托管姿态(这些腿不是请求)。
-     */
-    unattendedPermissionMode: PermissionMode;
     /** [ref]① (clay A 案 = workflow 权限全面 CC parity): workflow 子 agent 的默认权限基线与主 LLM 同权(base `{}`)。
      *  安全论证:主 LLM 与子 agent 同 root 同信任域,主 LLM 本就能写这棵树([ref] ask 门照管),单独钳子 agent 的
      *  安全增益≈0(只防绕路不防直路的门不是边界);实测产品代价=[ref]A 死锁。`WORKFLOW_AGENTS_READONLY=true` =
@@ -2113,7 +2106,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "unattendedPermissionMode" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析

package/dist/config.js

@@ -27,7 +27,6 @@ import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 import { allowlistedEnv } from "./server-secret-env.js";
 import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
-import { parseUnattendedPermissionMode } from "./unattended-permission-mode.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
     return (process.env[name] ?? "")
@@ -135,6 +134,7 @@ export const RETIRED_ENVS = [
     ["CONFIG_LKG_DISABLED", "CONFIG_LKG_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: CONFIG_LKG_DISABLED=true is CONFIG_LKG_ENABLED=false (the positive name defaults on)"],
     ["HOST_BG_DISABLED", "HOST_BG_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: HOST_BG_DISABLED=true is HOST_BG_ENABLED=false (the positive name defaults on)"],
     ["HOST_EXEC_SPOOL_DISABLED", "HOST_EXEC_SPOOL_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: HOST_EXEC_SPOOL_DISABLED=true is HOST_EXEC_SPOOL_ENABLED=false (the positive name defaults on)"],
+    ["UNATTENDED_PERMISSION_MODE", "since server 7.109.0 the unattended legs (leader workers and their repair legs, run-local, and their durable resumes) always run permissionMode \"default\" with an approver that answers by ask class: a machine answers only \"ordinary\" asks, and every other class goes to the leg's approver seat (run-local's terminal prompt) or parks / is refused — there is no mode to choose", "removed"],
 ];
 for (const row of RETIRED_ENVS)
     Object.freeze(row);
@@ -1327,8 +1327,6 @@ function unattendedApprovalPolicyEnv() {
 function parseApprovalDomain(ctx) {
     const { postureOn, singleUserTurnkey, infraReady } = ctx;
     const unattendedPolicy = unattendedApprovalPolicyEnv();
-    const unattendedMode = parseUnattendedPermissionMode(process.env.UNATTENDED_PERMISSION_MODE);
-    CONFIG_NOTICES.push({ level: "info", event: "unattended_permission_mode", fields: { value: unattendedMode.value, source: unattendedMode.source } });
     const streamAskWindowMsSource = postureSourceOfNumEnv(process.env.STREAM_ASK_WINDOW_MS, singleUserTurnkey);
     const toolApprovalEnabled = postureOn("TOOL_APPROVAL_ENABLED");
     let streamAskWindowMsEffectiveSource = streamAskWindowMsSource;
@@ -1429,7 +1427,6 @@ function parseApprovalDomain(ctx) {
         streamAskWindowMsSource: streamAskWindowMsEffectiveSource,
         durableApprovalSource: postureSourceOfKnob("DURABLE_APPROVAL"),
         unattendedApprovalPolicy: unattendedPolicy,
-        unattendedPermissionMode: unattendedMode.value,
         approvalTimeoutSec: numEnv("APPROVAL_TIMEOUT_SEC", "0"),
     };
 }
@@ -2299,7 +2296,7 @@ const MODEL_PLANE_GROUP_KEYS = [
 const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "durableApprovalSource", "streamAskWindowMsSource", "directApprovalDoor", "directDoorActive", "resourceSuspend",
-    "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "unattendedPermissionMode", "mcpElicitation",
+    "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
     "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "autoModeClassifierFallback", "autoModeClassifierTimeoutMs", "crossSessionInbound", "crossSessionDialogExpiry",
 ];
 const MEMORY_GROUP_KEYS = [

package/dist/deployment-governance.js

@@ -2,12 +2,13 @@ import { join, posix } from "node:path";
 import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, createTranscriptIntegrityPolicy, err, isAbsoluteForFamily, isProtectedWrite, ok, pathTargetValue, protectivePathTargetOf, } from "@sema-agent/core";
 import { createDurableAskPolicy, hasApprovalListIntent } from "./approval.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
+import { heldRuleName } from "./tool-rule-names.js";
 export function createDurableQuestionGate(live) {
     if (live === undefined)
         return createDurableQuestionPolicy();
     return {
         check(req) {
-            if (req.toolName !== ASK_USER_QUESTION_TOOL_NAME)
+            if (heldRuleName(req, (n) => n === ASK_USER_QUESTION_TOOL_NAME) === undefined)
                 return { action: "allow" };
             return live.hasLiveContext()
                 ? { action: "allow" }

package/dist/fleet-client.d.ts

@@ -102,8 +102,16 @@ export interface FleetClient {
     /** Immediate out-of-cycle announce — call when a self-reported input flips (draining: self-remove from routing FIRST;
      *  roster landed: become routable without waiting a heartbeat; restart signal changed: S-741). */
     announceNow: () => Promise<void>;
-    /** Stop timers + best-effort DELETE deregistration (bounded; never throws). */
-    stop: () => Promise<void>;
+    /**
+     * **路由面**停:停心跳、等在飞公告排空、best-effort DELETE 注销(各请求有界;从不抛)。之后的 `announceNow` 是空操作。
+     * 收尾链在 hardShutdown **起点**调(与 7.107.0 同序 —— 退出中的副本第一时间离开中心的路由表)。
+     */
+    stopRouting: () => Promise<void>;
+    /**
+     * **记账面**停:停用量窗定时器、上报最后一个(可能不满的)用量窗(有界;从不抛;空窗不发)。与路由面无关(不公告的引擎也报用量)。
+     * 收尾链排在**排空等待之后**调(S-929 F12:宽限窗里跑完的腿记下的用量必须进这一窗)。
+     */
+    flushFinalUsage: () => Promise<void>;
 }
 /**
  * Start the worker-side fleet loops. Caller has already gated on the center lane (startFleetClientFromEnv below).

package/dist/fleet-client.js

@@ -161,19 +161,16 @@ export function startFleetClient(opts) {
     hb?.unref?.();
     const uw = opts.usage ? setInterval(() => void flushUsage(), usageWindowMs) : undefined;
     uw?.unref?.();
-    let stopping = false;
-    const stop = async () => {
-        if (stopping)
+    let routingStopping = false;
+    const stopRouting = async () => {
+        if (routingStopping)
             return;
-        stopping = true;
+        routingStopping = true;
         if (hb)
             clearInterval(hb);
-        if (uw)
-            clearInterval(uw);
         while (inFlight !== undefined)
             await inFlight;
         stopped = true;
-        await flushUsage();
         if (!announcing)
             return;
         try {
@@ -182,7 +179,16 @@ export function startFleetClient(opts) {
         catch {
         }
     };
-    return { announceNow, stop };
+    let usageStopping = false;
+    const flushFinalUsage = async () => {
+        if (usageStopping)
+            return;
+        usageStopping = true;
+        if (uw)
+            clearInterval(uw);
+        await flushUsage();
+    };
+    return { announceNow, stopRouting, flushFinalUsage };
 }
 export function startFleetClientFromEnv(cfg, opts) {
     const cc = cfg.configCenter;

package/dist/http/admission.js

@@ -458,8 +458,14 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.field_invalid", "retainBackgroundProcesses must be a boolean");
             return null;
         }
-        if (body.excludeAllTools !== undefined && typeof body.excludeAllTools !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "excludeAllTools must be a boolean");
+        for (const key of ["excludeAllTools", "disableSkills"]) {
+            if (body[key] !== undefined && typeof body[key] !== "boolean") {
+                sendError(res, 400, "request.field_invalid", `${key} must be a boolean`);
+                return null;
+            }
+        }
+        if (body.disableSkills === true && ((body.skills?.length ?? 0) > 0 || (body.agents ?? []).some((a) => (a.skills?.length ?? 0) > 0))) {
+            sendError(res, 400, "request.field_conflict", "disableSkills: true means this run installs no skill at all (not the deployment's, not the request's), so it cannot come with a non-empty skills or agents[].skills — send one or the other");
             return null;
         }
         for (const key of ["excludeTools", "deferTools"]) {

package/dist/http/memory-compliance-failure-reply.d.ts

@@ -0,0 +1,41 @@
+/**
+ * S-930 —— 记忆合规面(抹除 / 出处)上 core **已分类拒**的**唯一** HTTP 映射。两面同调:
+ *  · operator 面 `routes/memory-compliance.ts`(`POST /v1/memory/erase` · `GET /v1/memory/entries/:entryId/provenance`);
+ *  · 会话所有者自助抹除面 `routes/sessions.ts`(`POST /v1/sessions/:id/memory/erase`)。
+ *
+ * ## 病(sdk 车 SH 黑盒实证,S-930)
+ * 修前自助面在路由里自写了一份更窄的分类:只认 `config.memory_erasure_request`(400)与 `memory.target_outside_store`(409),
+ * core 的另外三只 409 与 `ControlPlaneCorruptError` 全落 500 `internal.error` —— 「同一个 requestId 拿去抹另一个会话」这种**调用方自己
+ * 能改**的错被说成服务器坏了。两份分类 = 两个判官,少的那份恒是静默的一份。现在**码与状态**只在这里判一次,两面同读。
+ *
+ * ## 规则(三层,与 operator 面既有层序逐字同序)
+ *  ① core 的**本口专属**码(闭集穷举 `switch`,见 {@link sentCoreCode})—— 码与状态两面同;文案按受众(下一节,一条规则);
+ *  ② `memory.target_outside_store`(core 7.31.1 #1094 跨面 store 状态码)—— 409;
+ *  ③ `ControlPlaneCorruptError` —— typed 500 `internal.memory_control_plane_corrupt`(fail-closed 信号,一码两义见下);
+ *  其余 ⇒ `false`(未分类,调用方发它自己那句 500 且**不回显**内部文本)。
+ *
+ * ## 文案按受众分(码与状态不分)—— **一条规则,三层同施,不按码挑**(F9,7.108.0 合并复审 opus 腿 O-9)
+ * core 原句是写给运维的诊断材料:② ③ 点名**宿主路径**(store 根、链解析到哪 / 控制面账本文件),① 的 `selector_mismatch` 带**首个请求的
+ * 选择子哈希**(`pinned set <selectHash>`,无盐 sha256 —— operator 选择子可字典还原,首个请求未必是这位会话所有者发的):
+ *  · operator 受众 ⇒ 原句上 wire(过了 operator 门,这些材料对这个受众不是泄露);
+ *  · 会话所有者受众 ⇒ **一律**一句固定指路(每码一句,只说「怎么办」),原句整句交 `withheld` 落运维 warn —— 不逐码判断哪句安全
+ *    (逐码挑 = core 改一句文案就可能静默漏出一样新东西)。② ③ 的固定句**两形都真**:
+ *    ② 链先于请求在场 ⇒ 提交点之前拒、什么都没做;提交点之后才换上的链 ⇒ 已删的几条算数、journal 留盘(codex 一审 C1);
+ *    ③ 一码两义 —— 操作前账本读不出 ⇒ 什么都没发生;落定后残留枚举失败 ⇒ 抹除已提交、重放收敛(core 原话)。两句都不许诺零删除,
+ *    都指路「运维修好后用同一个 requestId 重发」(两义下这句都对)。本层**不**嗅 core 文案分辨前后(拿上游自由文本当判别式是第二真源)。
+ */
+import type { ServerResponse } from "node:http";
+/**
+ * 已分类拒 → HTTP 状态的**唯一**码表 = 自铸 wire 值登记处的 `sessionMemoryEraseStatus` 集(F3:wire 变更清单从同一张表 diff,状态改一处、
+ * 清单跟着列)。两面同读(S-930:码与状态只判一次)。键写错 ⇒ tsc 红(索引的是 `as const` 表的键)。
+ */
+/** 读这张映射的受众(闭集)。会话所有者受众必须交一只 `withheld` —— 被换成固定句的 core 原句落到那里(运维材料不许丢)。 */
+export type MemoryComplianceAudience = {
+    readonly kind: "operator";
+} | {
+    readonly kind: "session_owner";
+    readonly withheld: (coreMessage: string) => void;
+};
+/** 按上面三层应答;返回 `true` = 已应答,`false` = 未分类(一个字节都没写,调用方发它自己那句 500 并落它自己的运维 warn)。 */
+export declare function sentMemoryComplianceFailure(res: ServerResponse, err: unknown, audience: MemoryComplianceAudience): boolean;
+//# sourceMappingURL=memory-compliance-failure-reply.d.ts.map

package/dist/http/memory-compliance-failure-reply.js

@@ -0,0 +1,73 @@
+import { ControlPlaneCorruptError } from "@sema-agent/core";
+import { targetOutsideStoreOf } from "../memory-store-refusal.js";
+import { sentMemoryStoreRefusal } from "./memory-store-refusal-reply.js";
+import { sendError } from "./send.js";
+import { assertNever } from "./route-ctx.js";
+function sentCoreCode(res, coreCode, coreMessage, audience) {
+    switch (coreCode) {
+        case "config.memory_erasure_request":
+            sendError(res, 400, "config.memory_erasure_request", textFor(audience, coreMessage, "session memory erasure refused — the erasure request is not valid; correct it and resend"));
+            return true;
+        case "memory.erasure_evidence_unavailable":
+            sendError(res, 409, "memory.erasure_evidence_unavailable", textFor(audience, coreMessage, "session memory erasure refused — this deployment's memory store cannot produce erasure evidence; resend with allowUnevidenced: true to erase without evidence, or ask the operator"));
+            return true;
+        case "memory.erasure_selector_mismatch":
+            sendError(res, 409, "memory.erasure_selector_mismatch", textFor(audience, coreMessage, "session memory erasure refused — this requestId already names a different erasure; resend with a new requestId"));
+            return true;
+        case "memory.erasure_census_incomplete":
+            sendError(res, 409, "memory.erasure_census_incomplete", textFor(audience, coreMessage, "session memory erasure refused — the memory store could not be read completely, so nothing was erased and nothing was recorded; ask the operator to repair it, then resend with the same requestId"));
+            return true;
+        default:
+            return false;
+    }
+}
+function textFor(audience, coreMessage, ownerSentence) {
+    switch (audience.kind) {
+        case "operator":
+            return coreMessage;
+        case "session_owner":
+            audience.withheld(coreMessage);
+            return ownerSentence;
+        default:
+            return assertNever(audience);
+    }
+}
+function codeOf(err) {
+    if (!(err instanceof Error))
+        return undefined;
+    const { code } = err;
+    return typeof code === "string" ? code : undefined;
+}
+export function sentMemoryComplianceFailure(res, err, audience) {
+    const coreCode = codeOf(err);
+    if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err), audience))
+        return true;
+    const outside = targetOutsideStoreOf(err);
+    if (outside !== undefined) {
+        switch (audience.kind) {
+            case "operator":
+                return sentMemoryStoreRefusal(res, err);
+            case "session_owner":
+                audience.withheld(outside.message);
+                sendError(res, 409, "memory.target_outside_store", "session memory erasure refused — a directory in this deployment's memory store leads outside it (a link), so this erasure did not complete (a refusal before its commit point changed nothing; one after it keeps the deletions already made and a journal that finishes the rest once the link is removed); ask the operator to remove the link, then resend with the same requestId");
+                return true;
+            default:
+                return assertNever(audience);
+        }
+    }
+    if (err instanceof ControlPlaneCorruptError) {
+        switch (audience.kind) {
+            case "operator":
+                sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
+                return true;
+            case "session_owner":
+                audience.withheld(err.message);
+                sendError(res, 500, "internal.memory_control_plane_corrupt", "session memory erasure could not be completed — this deployment's memory control plane could not be read cleanly (depending on where it stopped, either nothing was changed or the deletions were already committed and a replay finishes them); ask the operator to repair it, then resend with the same requestId");
+                return true;
+            default:
+                return assertNever(audience);
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=memory-compliance-failure-reply.js.map

package/dist/http/memory-store-refusal-reply.d.ts

@@ -1,9 +1,9 @@
 /**
  * core 7.31.1 #1094 `memory.target_outside_store` 的 **operator 面 HTTP 映射** —— 唯一一处字面量(判据在
  * `src/memory-store-refusal.ts`)。挂在每一个触 store 树的 operator 记忆口的已分类收尾上:
- * `routes/memory-compliance.ts`(出处 / 抹除)· `routes/memory-origin.ts`(外源列表 / 清标;**不含**只读控制面的清标账列表 ——
+ * `routes/memory-compliance.ts`(出处 / 抹除;经 `http/memory-compliance-failure-reply.ts` 的 operator 受众臂)· `routes/memory-origin.ts`(外源列表 / 清标;**不含**只读控制面的清标账列表 ——
  * core 的 wire 表逐字:只碰控制面的面不判,给它挂一条永远收不到的码路径正是附录 A 活触发门要防的形)·
- * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里**(`routes/sessions.ts`:同码、固定文案,见那里的注)。
+ * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里**(S-930 起经 `http/memory-compliance-failure-reply.ts` 的会话所有者受众臂:同码、固定文案)。
  * `POST /v1/admin/memory/consolidation/run` 也不走这里:那口把 core 的**任何**有码拒一律收成 409 `memory.consolidation_refused`
  * (码进文案,附录 A 该行),本码已在那条臂上,不再给它第二个码。
  *

package/dist/http/resume-legs.js

@@ -19,6 +19,7 @@ import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, par
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
+import { withModelReachScope } from "../model-reach-scope.js";
 import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
 import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
@@ -502,7 +503,7 @@ export function createResumeLegs(ctx) {
             await args.onResumeCommitted();
         let unregisterEngineNotice;
         try {
-            result = await withPrincipal(principal, async () => {
+            result = await withModelReachScope(sessionId, () => withPrincipal(principal, async () => {
                 const resumeNotifiedKeys = new NotifiedKeys();
                 if (deps.runStore && taskId) {
                     const rs0 = deps.runStore;
@@ -871,7 +872,7 @@ export function createResumeLegs(ctx) {
                 return await (deps.sendUserFile && taskId
                     ? deps.sendUserFile.runWithContext({ taskId, emit: async (frame) => { const { type, ...rest } = frame; await append(type, rest); } }, withElicitation)
                     : withElicitation());
-            });
+            }));
         }
         catch (e) {
             if (e instanceof CheckpointError) {

package/dist/http/route-ctx.d.ts

@@ -150,9 +150,9 @@ export interface CheckpointCtx {
     /**
      * 🔴 S-877 候裁 18(codex r3 F1)—— 这条会话的 run 是**无人值守腿**铸的(今天唯一的写者 = leader worker 的 durable 块,
      * `leader/wire.ts`),**服务端写、不来自请求体**(`body` 是提交体;本位是它的兄弟键,客户端够不着)。
-     * 续跑家族据此请 `resolveSpec` 带 `unattendedLeg: true`,由它按续跑 Runner 的同名座经 `createUnattendedLeg` / `withUnattendedLeg`
-     * 重挂整条腿(模式 = 旋钮、写面 roots、模式释放写保护时的写保护拒层)—— 拒层是活闭包、进不了 checkpoint,而 core 在 spec 不说
-     * 模式时取 checkpoint 记下的那一个(`seat ?? recorded`),不重挂 = 续跑落 bypass 而拒层缺席。写回口(`DriveResumeArgs.resumeCtx`)
+     * 续跑家族据此请 `resolveSpec` 带 `unattendedLeg: true`,由它经首跑同一只合并口 `withUnattendedLeg` 重挂整条腿(S-934 ①:`default` +
+     * 按类作答的 onAsk)—— onAsk 是活闭包、进不了 checkpoint,而 core 在 spec 不说模式时取 checkpoint 记下的那一个(`seat ?? recorded`),
+     * 不重挂 = 续跑落 checkpoint 记下的旧模式(7.106.0–7.108.0 的行记 `bypassPermissions`)而按类作答缺席。写回口(`DriveResumeArgs.resumeCtx`)
      * 传原 ctx / 其展开 ⇒ 标随行。缺席 = 不是无人值守腿(HTTP 提交腿;7.106.0 前落盘的行 —— 那时这些腿不铸模式,checkpoint 里也没有)。
      */
     unattendedLeg?: true;

package/dist/http/routes/capabilities.js

@@ -138,6 +138,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 taskAgents: deps.config.requirePrincipal !== true,
                 retainBackgroundProcesses: deps.config.requirePrincipal !== true,
                 interactiveTools: true,
+                disableSkills: true,
                 projectContext: cwdHonored(deps.config),
                 callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
                 taskWriteFaceOpen: taskWriteFaceRefusal(deps.config) === undefined && autonomyOverrides(deps.config.autonomy).writeFace !== "roots",

package/dist/http/routes/diagnostics.js

@@ -1,6 +1,7 @@
 import { buildPostureKnobReading } from "../../posture-source.js";
 import { buildReadFaceWiring } from "../../read-face-posture.js";
 import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
+import { readOutboundWiring } from "../../outbound-dispatcher.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isLoopbackAddress, verifiedIdentitySource } from "../principal-gate.js";
@@ -106,6 +107,7 @@ export async function handleDiagnostics(req, res, match, ctx) {
                 writeProtection: deps.writeProtection ?? null,
                 readFace: buildReadFaceWiring(deps.config),
                 executionLane: projectExecutionLaneCapability(deps.config),
+                outbound: readOutboundWiring(),
                 configApply: deps.configApplyState?.() ?? null,
                 mcpRevocations: deps.mcpRevocationState?.() ?? null,
                 serverGates: buildServerWiringGates({

package/dist/http/routes/memory-compliance.js

@@ -1,7 +1,6 @@
 import { z } from "zod";
-import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { erasureInputSmugglesPrototypeKey } from "../../memory-operator-faces.js";
-import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
+import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -11,40 +10,9 @@ const EraseRequestSchema = z.object({
     select: z.record(z.string(), z.unknown()),
     allowUnevidenced: z.boolean().optional(),
 });
-function sentCoreCode(res, coreCode, message) {
-    switch (coreCode) {
-        case "config.memory_erasure_request":
-            sendError(res, 400, "config.memory_erasure_request", message);
-            return true;
-        case "memory.erasure_evidence_unavailable":
-            sendError(res, 409, "memory.erasure_evidence_unavailable", message);
-            return true;
-        case "memory.erasure_selector_mismatch":
-            sendError(res, 409, "memory.erasure_selector_mismatch", message);
-            return true;
-        case "memory.erasure_census_incomplete":
-            sendError(res, 409, "memory.erasure_census_incomplete", message);
-            return true;
-        default:
-            return false;
-    }
-}
-function codeOf(err) {
-    if (!(err instanceof Error))
-        return undefined;
-    const { code } = err;
-    return typeof code === "string" ? code : undefined;
-}
 function sentClassifiedFailure(res, ctx, face, err) {
-    const coreCode = codeOf(err);
-    if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err)))
+    if (sentMemoryComplianceFailure(res, err, { kind: "operator" }))
         return true;
-    if (sentMemoryStoreRefusal(res, err))
-        return true;
-    if (err instanceof ControlPlaneCorruptError) {
-        sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
-        return true;
-    }
     ctx.deps.logger?.warn?.(`memory_compliance_${face}_failed`, { err: String(err) });
     return false;
 }

package/dist/http/routes/memory-origin.d.ts

@@ -114,7 +114,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     baseRev: string;
     origin: {
         at: number;
-        cause?: "static" | "unattributed" | "observed" | "derived" | undefined;
+        cause?: "static" | "observed" | "unattributed" | "derived" | undefined;
         taint: "external";
     };
 };