@sema-agent/server 7.11.0 → 7.13.0

package/dist/adoption/runner.js

@@ -23,8 +23,10 @@
 import { randomUUID } from "node:crypto";
 import { ADOPTION_PHASE, adoptionLockName, } from "../plugins/adoption-log-sql.js";
 import { policyKeyFor } from "../plugins/session-policy-store-sql.js";
+import { buildRuleOwnerKey } from "../plugins/permission-rule-store-sql.js";
+import { withAdoptionQuiesce } from "./quiesce.js";
 import { AFFECTED_CONFIG_TEMPLATES, MEMORY_SCOPE_MAX_CHARS, NOT_MIGRATED_BY_DESIGN, REBIND_LEGS, buildVerbatimPair, rewriteMemoryScope, } from "./plan.js";
-import { buildBlobScanSql, buildBlobWriteSql, buildConflictProbeSql, buildMemoryScopeScanSql, buildResidualCountSql, buildRebindSql, buildSessionPolicyRewriteSql, buildSessionPolicyScanSql, } from "./sql.js";
+import { buildBlobScanSql, buildBlobWriteSql, buildConflictProbeSql, buildMemoryScopeScanSql, buildResidualCountSql, buildRebindSql, buildRuleOwnerRekeySql, buildSessionPolicyRewriteSql, buildSessionPolicyScanSql, } from "./sql.js";
 import { AdoptionConfigsSchema, AdoptionLegsSchema, AdoptionReceiptSchema, AdoptionRejectDetailSchema, AdoptionReportSchema, } from "./wire.js";
 import { formatUserScope, encodeScopeSegment } from "@sema-agent/core";
 /** MySQL `ER_DUP_ENTRY` / PG `unique_violation` —— 跨轴组合冲突的最后一道 fail-closed 门。 */
@@ -42,6 +44,18 @@ function msgOf(e) {
 async function resolveValuePairs(exec, dialect, leg, fromPrincipal, toPrincipal) {
     if (leg.encoding === "verbatim")
         return [buildVerbatimPair(fromPrincipal, toPrincipal)];
+    // 规则桶键:恒一对,**算**出来而不是扫出来(原像里只有 principal,没有逐行变量)。
+    // 🔴 这一支同时服务 preflight 的冲突探针与 `countResidual` 的残留计数 —— 少了它,那两处会拿**明文**
+    // principal 去比 `owner_key`,而那个谓词在这张表上永远匹配不到任何一行:preflight 恒说「无冲突」、
+    // 残留恒报 0(A-010.16 / A-010.22 点名的正是后者)。
+    if (leg.encoding === "rule-owner-key") {
+        return [
+            {
+                from: buildRuleOwnerKey({ kind: "principal", principal: fromPrincipal }),
+                to: buildRuleOwnerKey({ kind: "principal", principal: toPrincipal }),
+            },
+        ];
+    }
     const seg = encodeScopeSegment(fromPrincipal);
     const projHead = `proj:${seg}/`;
     const userProjHead = `userproj:${seg}/`;
@@ -183,6 +197,15 @@ export function createAdoptionRunner(deps) {
                 out.push({ store: leg.leg, action: leg.action, rows });
                 continue;
             }
+            if (leg.kind === "rule-owner-rekey") {
+                // 一对键算一次(见 buildRuleOwnerRekeySql 的注),一条等值 UPDATE 走完;`principal` 明文列同改。
+                const [pair] = await resolveValuePairs(exec, dialect, leg, fromPrincipal, toPrincipal);
+                if (pair === undefined)
+                    throw new Error(`runLegs: leg ${leg.leg} resolved no identity pair`);
+                const res = await exec.query(buildRuleOwnerRekeySql(dialect, leg), [pair.to, toPrincipal, pair.from]);
+                out.push({ store: leg.leg, action: leg.action, rows: res.affected });
+                continue;
+            }
             const pairs = await resolveValuePairs(exec, dialect, leg, fromPrincipal, toPrincipal);
             let rows = 0;
             for (const pair of pairs) {
@@ -230,11 +253,26 @@ export function createAdoptionRunner(deps) {
                 slot.blob = leg;
             else {
                 slot.match.add(leg.matchColumn);
-                if (leg.encoding === "memory-scope")
-                    slot.memoryLeg = leg;
+                // 🔴 A-010.16(验真后修):这里此前只认 `memory-scope` 一种**非明文**编码,别的编码一律
+                // 落到下面那条 `[{ from: fromPrincipal, … }]` 兜底 —— 也就是拿**明文 principal** 去比一根存
+                // 派生键的列。对 `permission_rule.owner_key`(sha256 原像里带身份)那个谓词**永远匹配不到
+                // 任何一行**,于是残留计数在这张表上结构性恒 0:回执一边说「adopted」、一边把一整桶还挂在
+                // 旧身份名下的活规则报成「零残留」。判据改成**编码非 verbatim 即需解析**,新编码天然进对臂。
+                if (leg.encoding !== "verbatim")
+                    slot.codedLeg = leg;
             }
             byTable.set(leg.table, slot);
         }
+        // 🔴 一张表内**混编码**会让下面那条「一条 COUNT + 一个值对」的形悄悄算错(OR 起来的每一列都会被
+        // 绑上同一个值,而它们的编码不同 ⇒ 至少一列的谓词恒假)。今天没有这样的表;真出现时必须响亮拦下,
+        // 而不是报一个偏小的残留数(偏小 = 说「没落下」,正是本条要消灭的谎)。
+        for (const [table, slot] of byTable) {
+            const encodings = new Set(REBIND_LEGS.filter((l) => l.table === table && l.kind !== "blob-rewrite").map((l) => l.encoding));
+            if (encodings.size > 1) {
+                throw new Error(`adoption: table ${table} carries identity axes in more than one encoding (${[...encodings].sort().join(", ")}) — the residual count binds ONE value pair across the OR'd columns, so it would silently under-report. Split the count per encoding before adding such a leg.`);
+            }
+            void slot;
+        }
         let n = 0;
         for (const [table, slot] of byTable) {
             if (slot.blob !== undefined) {
@@ -252,8 +290,8 @@ export function createAdoptionRunner(deps) {
             // 普通表:一条 COUNT,谓词是该表全部身份轴的并。memory 族的值对逐对各来一次(不同 scope 键 =
             // 不同的行集合,不会重复计数同一行)。
             const cols = [...slot.match];
-            const pairs = slot.memoryLeg !== undefined
-                ? await resolveValuePairs(exec, dialect, slot.memoryLeg, fromPrincipal, toPrincipal)
+            const pairs = slot.codedLeg !== undefined
+                ? await resolveValuePairs(exec, dialect, slot.codedLeg, fromPrincipal, toPrincipal)
                 : [{ from: fromPrincipal, to: toPrincipal }];
             for (const pair of pairs) {
                 const res = await exec.query(buildResidualCountSql(dialect, table, cols), cols.map(() => pair.from));
@@ -421,7 +459,27 @@ export function createAdoptionRunner(deps) {
             return 1;
         }
     }
+    /**
+     * 🔴 A-010.18:**唯一**的静默闸挂点。三条入口(`start` / `get` 的在飞续跑 / boot 的 `resumeInFlight`)
+     * 全部经由本函数动数据,所以闸挂在这里一处就覆盖全部会写被迁表的路径 —— 挂在 `start` 上会漏掉后两条,
+     * 而那两条恰恰是「没人按重试、副本自己续跑」的场景,与维护 tick 撞车的概率并不更低。
+     * 闸的语义、为什么让开**整轮** tick、以及它只挡本副本这条射程边界,逐字见 `adoption/quiesce.ts`。
+     */
     async function driveUnderLock(row, sweep) {
+        return withAdoptionQuiesce(() => driveUnderLockInner(row, sweep), {
+            // 排空没等到 ⇒ **响亮**(codex R1 [high] 的第二半):等不到不等于可以装作等到了。这条 warn 是
+            // 运维判断「那次收编期间有没有腿在跟它抢同一批行」的唯一读数。
+            onDrainTimeout: (reading) => deps.logger?.warn?.("adoption_maintenance_drain_timeout", {
+                adoptionId: row.adoptionId,
+                pendingLegs: reading.pending,
+                note: "the adoption arc stopped waiting for this replica's already-airborne maintenance legs to land. " +
+                    "New ticks are held off for the arc's duration, but a leg that was ALREADY running may still write a " +
+                    "table this arc rebinds (the approval reconciler is the sharp one). design/183 I1 (stop the engine " +
+                    "first) remains the operator premise; this reading says the in-process half could not fully cover it.",
+            }),
+        });
+    }
+    async function driveUnderLockInner(row, sweep) {
         const out = await store.withLock(adoptionLockName(row.fromPrincipal), 
         // 🔴 **拿到锁之后重读**(codex R2-F3):`row` 是排队**之前**读到的快照,而排队期间别的副本可能已经
         // 把这条弧推完或拒掉了。拿旧快照进状态机 = 按一个已经不成立的世界做决定(实测可达的形:一条已被

package/dist/adoption/sql.d.ts

@@ -65,6 +65,21 @@ export declare function buildBlobScanSql(dialect: SqlDialect, leg: RebindLegSpec
  * (行数可能仍报 1,故回执的行数按「**内容真变了**才计」在调用侧收窄)。
  */
 export declare function buildBlobWriteSql(dialect: SqlDialect, leg: RebindLegSpec): string;
+/**
+ * 规则桶的**整桶改键**(A-010.16)。参数序:`[newOwnerKey, toPrincipal, oldOwnerKey]`。
+ *
+ * `owner_key = sha256("principal:" + principal)` —— 身份在**键的 hash 原像**里,与 session_policy
+ * 同族。差别在于这把键**不含逐行变量**(session_policy 的原像里还有 session_id),所以不必逐行扫出来
+ * 重算:一对 (旧键, 新键) 算一次,一条等值 UPDATE 走完全表。
+ *
+ * `principal` 列跟着同改:它是 owner_key 的**明文原像列**(店按前者寻址、`GET /v1/rules` 的回执与运维
+ * 的 `WHERE principal = …` 排查按后者读)。只改一列,库里就有两份互相矛盾的身份说法。
+ *
+ * 幂等性来自谓词:重跑时旧桶键已经不在库里 ⇒ 零行匹配 ⇒ 零行变化。
+ * `owner_kind = 'local-owner'` 的那只桶天然不受影响 —— 它的 owner_key 是 `sha256("local-owner")`,
+ * 与任何 principal 派生的键都不相等,所以**匹配不到**(不需要额外的 owner_kind 谓词来护住它)。
+ */
+export declare function buildRuleOwnerRekeySql(dialect: SqlDialect, leg: RebindLegSpec): string;
 /** session_policy 重键腿的扫描:拿到 from 侧每一行的 `(policy_key, session_id)`。参数序:`[fromPrincipal]`。 */
 export declare function buildSessionPolicyScanSql(dialect: SqlDialect): string;
 /**

package/dist/adoption/sql.js

@@ -90,6 +90,24 @@ export function buildBlobWriteSql(dialect, leg) {
     // —— 收编那时已经报 adopted。推进 rev 才让那些「站在过去」的写者按 OCC 的本意输掉并重试。
     return `UPDATE ${leg.table} SET ${blob.column} = ${ph(dialect, 1)}, ${blob.revColumn} = ${blob.revColumn} + 1 WHERE ${where} AND ${blob.revColumn} = ${ph(dialect, blob.pk.length + 2)}`;
 }
+/**
+ * 规则桶的**整桶改键**(A-010.16)。参数序:`[newOwnerKey, toPrincipal, oldOwnerKey]`。
+ *
+ * `owner_key = sha256("principal:" + principal)` —— 身份在**键的 hash 原像**里,与 session_policy
+ * 同族。差别在于这把键**不含逐行变量**(session_policy 的原像里还有 session_id),所以不必逐行扫出来
+ * 重算:一对 (旧键, 新键) 算一次,一条等值 UPDATE 走完全表。
+ *
+ * `principal` 列跟着同改:它是 owner_key 的**明文原像列**(店按前者寻址、`GET /v1/rules` 的回执与运维
+ * 的 `WHERE principal = …` 排查按后者读)。只改一列,库里就有两份互相矛盾的身份说法。
+ *
+ * 幂等性来自谓词:重跑时旧桶键已经不在库里 ⇒ 零行匹配 ⇒ 零行变化。
+ * `owner_kind = 'local-owner'` 的那只桶天然不受影响 —— 它的 owner_key 是 `sha256("local-owner")`,
+ * 与任何 principal 派生的键都不相等,所以**匹配不到**(不需要额外的 owner_kind 谓词来护住它)。
+ */
+export function buildRuleOwnerRekeySql(dialect, leg) {
+    return (`UPDATE ${leg.table} SET owner_key = ${ph(dialect, 1)}, principal = ${ph(dialect, 2)}` +
+        ` WHERE owner_key = ${ph(dialect, 3)}`);
+}
 /** session_policy 重键腿的扫描:拿到 from 侧每一行的 `(policy_key, session_id)`。参数序:`[fromPrincipal]`。 */
 export function buildSessionPolicyScanSql(dialect) {
     return `SELECT policy_key, session_id FROM session_policy WHERE principal = ${ph(dialect, 1)}`;

package/dist/adoption/wire.d.ts

@@ -68,7 +68,7 @@ export type AdoptionConfigEntry = z.infer<typeof AdoptionConfigEntrySchema>;
  * 🔴 这是**冻结的闭集**(下游按成员名写正向断言)。改名/删员 = wire 破坏;新增 = 新行为面,要先过三问。
  * 判据形见 183 §10.5:「按设计不迁」与「漏了没迁」在黑盒上必须可分,所以它是**正向声明**而不是沉默。
  */
-export declare const NOT_MIGRATED_FACES: readonly ["usage-window", "cost-quota", "rate-limit", "approval-exemption-grantor", "approval-ask-decision-actor", "image-bake-requested-by"];
+export declare const NOT_MIGRATED_FACES: readonly ["usage-window", "cost-quota", "rate-limit", "approval-exemption-grantor", "approval-ask-decision-actor", "image-bake-requested-by", "permission-rule-approval-history", "permission-rule-import-ticket"];
 export type NotMigratedFace = (typeof NOT_MIGRATED_FACES)[number];
 export declare const AdoptionNotMigratedSchema: z.ZodObject<{
     face: z.ZodEnum<{
@@ -78,6 +78,8 @@ export declare const AdoptionNotMigratedSchema: z.ZodObject<{
         "approval-exemption-grantor": "approval-exemption-grantor";
         "approval-ask-decision-actor": "approval-ask-decision-actor";
         "image-bake-requested-by": "image-bake-requested-by";
+        "permission-rule-approval-history": "permission-rule-approval-history";
+        "permission-rule-import-ticket": "permission-rule-import-ticket";
     }>;
     ruling: z.ZodEnum<{
         D1: "D1";
@@ -124,6 +126,8 @@ export declare const AdoptionReportSchema: z.ZodObject<{
             "approval-exemption-grantor": "approval-exemption-grantor";
             "approval-ask-decision-actor": "approval-ask-decision-actor";
             "image-bake-requested-by": "image-bake-requested-by";
+            "permission-rule-approval-history": "permission-rule-approval-history";
+            "permission-rule-import-ticket": "permission-rule-import-ticket";
         }>;
         ruling: z.ZodEnum<{
             D1: "D1";
@@ -183,6 +187,8 @@ export declare const AdoptionReceiptSchema: z.ZodObject<{
                 "approval-exemption-grantor": "approval-exemption-grantor";
                 "approval-ask-decision-actor": "approval-ask-decision-actor";
                 "image-bake-requested-by": "image-bake-requested-by";
+                "permission-rule-approval-history": "permission-rule-approval-history";
+                "permission-rule-import-ticket": "permission-rule-import-ticket";
             }>;
             ruling: z.ZodEnum<{
                 D1: "D1";

package/dist/adoption/wire.js

@@ -64,6 +64,12 @@ export const NOT_MIGRATED_FACES = [
     "approval-exemption-grantor",
     "approval-ask-decision-actor",
     "image-bake-requested-by",
+    // A-010.22(台账 P1)—— 规则店族此前对回执**零表态**:`permission_rule` 那只**活桶**现在真迁了
+    // (`permission_rule#owner_key` 腿),但同族另外两张表按 D2/D1 刻意不迁,而「刻意不迁」与「漏了没迁」
+    // 在黑盒上必须可分(§10.5)。少了这两员,运维读到的回执是:`notMigratedByDesign` 里没有规则店的影子、
+    // `residualSourceRows` 又把它们数成 0 —— 一份「什么都没落下」的**假声明**。
+    "permission-rule-approval-history",
+    "permission-rule-import-ticket",
 ];
 export const AdoptionNotMigratedSchema = z
     .object({

package/dist/approval-card.d.ts

@@ -50,6 +50,7 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         requiresRealApproval: z.ZodBoolean;
     }, z.core.$strict>;
     governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
+    persistedRuleShadowed: z.ZodOptional<z.ZodString>;
     ruleSuggestions: z.ZodOptional<z.ZodArray<z.ZodObject<{
         rule: z.ZodString;
         match: z.ZodEnum<{
@@ -89,6 +90,7 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             requiresRealApproval: z.ZodBoolean;
         }, z.core.$strict>;
         governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
+        persistedRuleShadowed: z.ZodOptional<z.ZodString>;
         ruleSuggestions: z.ZodOptional<z.ZodArray<z.ZodObject<{
             rule: z.ZodString;
             match: z.ZodEnum<{
@@ -132,6 +134,9 @@ export interface ApprovalCardSource {
     /** [2942]/[2943]:治理来源标 —— 与 wire 帧**同一份素材**(`ToolApprovalFrame` 结构上满足本接口),
      *  于是 live 帧 / `card_json` / 重放帧三面同源,不是三处各判一遍。 */
     governanceForced?: true;
+    /** #144(core 5.25.0):被越级的持久规则原文 —— **已 redactSecrets**(发帧点做,本模块只 clip)。
+     *  与 wire 帧**同一份素材**(`ToolApprovalFrame` 结构上满足本接口)⇒ live 帧 / `card_json` / 重放帧三面同源。 */
+    persistedRuleShadowed?: string;
     /** #154 车二:引擎铸的规则候选(**只在规则店装配时**由发帧点填;语义与在场性契约见
      *  `ApprovalCardSchema.ruleSuggestions`)。与 wire 帧**同一份素材** ⇒ live 帧 / `card_json` / 重放帧
      *  三面同源。 */

package/dist/approval-card.js

@@ -79,6 +79,24 @@ export const ApprovalCardSchema = z
      * park(fail-safe),回滚窗结束即自愈。
      */
     governanceForced: z.literal(true).optional(),
+    /**
+     * #144(core 5.25.0 [3438]/[3443],**ADDITIVE**):这次 ask **命中了**一条用户的持久 allow 规则,
+     * 但规则**清不掉**它 —— 值 = 那条被越级的规则**原文**(语义、消音边界与「缺席 ≠ 没有规则」的
+     * 硬条款逐字见 `tool-approval.ts` 的 `ToolApprovalFrame.persistedRuleShadowed`)。
+     *
+     * 放在**卡的顶层**、与 `governanceForced` 并列而不是塞进 `risk`:`risk` 是引擎对这次**操作**的风险
+     * 判定,这一格讲的是「你那条规则怎么了」——两件事。与 `governanceForced` 也**刻意分列**:那个说
+     * 「门是运维下的」,这个说「有一条你的规则在场但被越级」,两者可以同时在场也可以各自单独在场
+     * (governance 是不可消音的三个来源之一,doctrine `always` 与工具自带 egress/irreversible mark 是另两个)。
+     *
+     * 值域 = **用户内容族**(规则原文是人写的文本,core 侧已过 `inlineUntrusted` 200 cap):
+     * 写侧在**上游**(`tool-approval.ts` 发帧点)过 `redactSecrets` 再交进来,本层只截长(`clip`)。
+     * UNTRUSTED-for-display,同 `message`/`args` 待遇。
+     *
+     * 回滚窗代价与 `governanceForced` **逐字同族**(见上一段那条 ⚠️):`.strict()` 下旧二进制读不动带本键的
+     * 新行 ⇒ 重放跳过 + 幂等重入走 park(fail-safe),`schemaVersion` 不动。
+     */
+    persistedRuleShadowed: z.string().max(MAX_RULE_TEXT_CHARS).optional(),
     /**
      * #154 车二(core 5.18.0 design/179):引擎为这次 ask 铸的**规则候选**(`Bash(git status)` 精确 /
      * `Bash(git status:*)` 词界前缀)—— 呈卡面据它渲「不再询问」。
@@ -183,6 +201,7 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
     const toolCallId = clip(source.toolCallId, MAX_IDENT);
     const sourceTaskId = clip(source.sourceTaskId, MAX_IDENT);
     const sourceAgentName = clip(source.sourceAgentName, MAX_AGENT_NAME);
+    const shadowedRule = clip(source.persistedRuleShadowed, MAX_RULE_TEXT_CHARS);
     return {
         toolName: clip(source.toolName, MAX_IDENT) ?? "",
         message: clip(source.message, MAX_MESSAGE) ?? "",
@@ -195,6 +214,9 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
         },
         // [2942]/[2943]:只在为真时投影(`=== true` 严判:非布尔真值不得把一张普通卡染成治理卡)。
         ...(source.governanceForced === true ? { governanceForced: true } : {}),
+        // #144:被越级的规则原文。**空串不投**(core 的四个 mint 点只在真有命中规则时带这个键 ⇒ 空串不是
+        // 「有一条空规则」而是坏值;投一个空串会让壳渲一行「你的规则 ⟨⟩ 仍在」)。截长同 `message` 待遇。
+        ...(shadowedRule !== undefined && shadowedRule !== "" ? { persistedRuleShadowed: shadowedRule } : {}),
         // #154 车二:候选**逐字**投影(空数组 ⇒ 不投键 —— 「没有候选」与「本部署不供候选」在卡面上都读作
         // 「本卡无此选项」,铸一个空数组只会让消费端多一条无意义的分支)。拷贝一份:卡不与调用方共享可变引用。
         ...(source.ruleSuggestions !== undefined && source.ruleSuggestions.length > 0

package/dist/auth-keys.d.ts

@@ -15,9 +15,31 @@ export interface ApprovalHmacKey {
     key: string;
     status?: "active" | "retiring";
 }
+/**
+ * #210(黑板 [3425]③「坏值禁静默回默认」)—— 一条**被丢弃**的 key-set 条目的诊断。
+ *
+ * 为什么两个解析器要新长一个必填出口:它们的 fail-closed 方向是对的(坏形 ⇒ `[]` ⇒ 门关着),但**丢弃
+ * 本身此前零留痕**。真场景:轮换新钥时手滑把 `key` 写成 `secret`,这一条被 `filter` 悄悄滤掉,进程照常
+ * 起、旧钥还在、验签照常过 —— 直到旧钥退役那天,全部审批回决在生产上一起开始 401,而配置早在几周前就
+ * 已经坏了。诊断出口让「我加的那把钥没进来」在 boot 当场可见。
+ *
+ * `index` 是**原数组下标**(operator 拿它直接定位是 JSON 里第几条);`"-"` = 整体形坏(不是数组 / 不是
+ * JSON),没有可指的条目。`reason` 只说**缺陷字段名**,永不带值 —— HMAC 的 `key` 是对称密钥,诊断行会
+ * 进日志。
+ */
+export interface KeySetRejection {
+    index: number | "-";
+    reason: string;
+}
+/**
+ * 诊断出口**必填**(不是 `onReject?:`)。可选回调 = 「没人接就等于错误蒸发」,正是本仓 #191 静默降级
+ * 门数的 SHAPE B;这两条钥又都在凭据轴上,所以由**类型**逼每个调用点当场表态,而不是靠人记得去接。
+ */
+export type OnKeySetRejection = (rejection: KeySetRejection) => void;
 /** Parse APPROVAL_HMAC_KEYS — a sema-registry-managed, rotating key-SET, as a JSON array of {kid,key,status}.
- *  Empty / unset / unparseable ⇒ `[]` ⇒ HMAC verification is OFF (D-G inactive; back-compat, BFF-only door). */
-export declare function parseApprovalHmacKeys(raw: string | undefined): ApprovalHmacKey[];
+ *  Empty / unset / unparseable ⇒ `[]` ⇒ HMAC verification is OFF (D-G inactive; back-compat, BFF-only door).
+ *  fail-closed 语义与改前**逐字相同**;新增的只有 `onReject`(#210:每一条被丢弃的条目都要说出来)。 */
+export declare function parseApprovalHmacKeys(raw: string | undefined, onReject: OnKeySetRejection): ApprovalHmacKey[];
 /** One issuer public key in the rotating principal JWKS (mirror of the HMAC key-set rotation discipline). The
  *  `alg` is PINNED per key — the JWT header's alg MUST match it, killing alg-confusion (`none`, HS-with-the-pubkey).
  *  `key` is a PEM (SPKI) public key. PUBLIC, non-secret. */
@@ -28,6 +50,8 @@ export interface PrincipalJwtKey {
     status?: "active" | "retiring";
 }
 /** Parse PRINCIPAL_JWT_PUBKEYS — a JSON array of {kid,alg,key,status}. Empty/unset/malformed ⇒ [] ⇒ no trust
- *  anchor ⇒ the direct door cannot open (D-G inactive). Each entry must have kid + a pinned alg + a PEM key. */
-export declare function parsePrincipalJwks(raw: string | undefined): PrincipalJwtKey[];
+ *  anchor ⇒ the direct door cannot open (D-G inactive). Each entry must have kid + a pinned alg + a PEM key.
+ *  #210: fail-closed 语义逐字不变,但每条被丢弃的条目经 `onReject` 报出(序号 + 缺陷字段名,不带值)——
+ *  这里的 key 是**公**钥,但 reason 仍只说字段名,与 HMAC 那条同形(两个出口的口径不该分岔)。 */
+export declare function parsePrincipalJwks(raw: string | undefined, onReject: OnKeySetRejection): PrincipalJwtKey[];
 //# sourceMappingURL=auth-keys.d.ts.map

package/dist/auth-keys.js

@@ -8,37 +8,82 @@
  * (verifyApprovalHmac / verifyPrincipalJwt) stay in ./approval-hmac.ts and ./principal-jwt.ts; consumers import these four names from HERE ([2354] 兼容面全清).
  */
 /** Parse APPROVAL_HMAC_KEYS — a sema-registry-managed, rotating key-SET, as a JSON array of {kid,key,status}.
- *  Empty / unset / unparseable ⇒ `[]` ⇒ HMAC verification is OFF (D-G inactive; back-compat, BFF-only door). */
-export function parseApprovalHmacKeys(raw) {
+ *  Empty / unset / unparseable ⇒ `[]` ⇒ HMAC verification is OFF (D-G inactive; back-compat, BFF-only door).
+ *  fail-closed 语义与改前**逐字相同**;新增的只有 `onReject`(#210:每一条被丢弃的条目都要说出来)。 */
+export function parseApprovalHmacKeys(raw, onReject) {
     if (!raw)
         return [];
+    let v;
     try {
-        const v = JSON.parse(raw);
-        if (!Array.isArray(v))
-            return [];
-        return v.filter((k) => !!k && typeof k.kid === "string" && typeof k.key === "string");
+        v = JSON.parse(raw);
     }
     catch {
+        // ⚠️ 解析器自带的 message **不能**转述:V8 的 `JSON.parse` 报错里嵌了输入片段
+        // (`Unexpected token 'T', "TOP_SECRET"... is not valid JSON`),而这条 env 的内容就是对称密钥 ——
+        // 把它写进 boot 日志等于把密钥前缀印出来。只说「不是合法 JSON」,定位靠 env 名本身。
+        onReject({ index: "-", reason: "not valid JSON (value withheld: this env holds secrets)" });
         return [];
     }
+    if (!Array.isArray(v)) {
+        onReject({ index: "-", reason: "not a JSON array of {kid,key,status} entries" });
+        return [];
+    }
+    const out = [];
+    v.forEach((raw, i) => {
+        const e = raw;
+        if (!e || typeof e !== "object") {
+            onReject({ index: i, reason: "entry is not an object" });
+            return;
+        }
+        const bad = ["kid", "key"].filter((f) => typeof e[f] !== "string");
+        if (bad.length > 0)
+            onReject({ index: i, reason: `missing/non-string field(s): ${bad.join(", ")}` });
+        else
+            out.push(e);
+    });
+    return out;
 }
 /** Parse PRINCIPAL_JWT_PUBKEYS — a JSON array of {kid,alg,key,status}. Empty/unset/malformed ⇒ [] ⇒ no trust
- *  anchor ⇒ the direct door cannot open (D-G inactive). Each entry must have kid + a pinned alg + a PEM key. */
-export function parsePrincipalJwks(raw) {
+ *  anchor ⇒ the direct door cannot open (D-G inactive). Each entry must have kid + a pinned alg + a PEM key.
+ *  #210: fail-closed 语义逐字不变,但每条被丢弃的条目经 `onReject` 报出(序号 + 缺陷字段名,不带值)——
+ *  这里的 key 是**公**钥,但 reason 仍只说字段名,与 HMAC 那条同形(两个出口的口径不该分岔)。 */
+export function parsePrincipalJwks(raw, onReject) {
     if (!raw)
         return [];
     const ALGS = new Set(["EdDSA", "RS256", "ES256"]);
+    let v;
     try {
-        const v = JSON.parse(raw);
-        if (!Array.isArray(v))
-            return [];
-        return v.filter((k) => {
-            const e = k;
-            return !!e && typeof e.kid === "string" && typeof e.key === "string" && typeof e.alg === "string" && ALGS.has(e.alg);
-        });
+        v = JSON.parse(raw);
     }
     catch {
+        // 同 parseApprovalHmacKeys:不转述 V8 的 message(它嵌输入片段)。这一口装的是**公**钥,但两个出口
+        // 的口径不该分岔 —— 一个「视情况才脱敏」的规矩,迟早会在错的那一侧被抄走。
+        onReject({ index: "-", reason: "not valid JSON (value withheld)" });
+        return [];
+    }
+    if (!Array.isArray(v)) {
+        onReject({ index: "-", reason: "not a JSON array of {kid,alg,key,status} entries" });
         return [];
     }
+    const out = [];
+    v.forEach((row, i) => {
+        const e = row;
+        if (!e || typeof e !== "object") {
+            onReject({ index: i, reason: "entry is not an object" });
+            return;
+        }
+        const bad = ["kid", "key"].filter((f) => typeof e[f] !== "string");
+        // alg 单列:缺席与「不在闭集」是两种手滑,但都必须点名 `alg` —— 运维看到字段名才知道去改哪一格
+        // (alg-confusion 防线就挂在这条钉上,静默滤掉等于防线自己消失了没人知道)。
+        if (typeof e.alg !== "string")
+            bad.push("alg");
+        else if (!ALGS.has(e.alg))
+            bad.push(`alg (must be one of: ${[...ALGS].join(", ")})`);
+        if (bad.length > 0)
+            onReject({ index: i, reason: `missing/invalid field(s): ${bad.join(", ")}` });
+        else
+            out.push(e);
+    });
+    return out;
 }
 //# sourceMappingURL=auth-keys.js.map

package/dist/boot/parked-revive-gate.d.ts

@@ -1,4 +1,4 @@
-import { type BackgroundAgentRecord, type ToolExecuteContext } from "@sema-agent/core";
+import { type BackgroundAgentRecord, type RunnerDeps, type ToolExecuteContext } from "@sema-agent/core";
 import type { ServiceConfig } from "../config.js";
 import type { RunnerDepsOnAsk } from "./runner-deps.js";
 import { type ApprovalBaselineConfigView, type DeploymentGovernanceConfigView, type LiveQuestionFace } from "../deployment-governance.js";
@@ -46,6 +46,20 @@ export interface ParkedReviveGateDeps {
      */
     readonly approverSeat: RunnerDepsOnAsk | undefined;
     readonly approvalExemptionStore: ApprovalExemptionProbe | undefined;
+    /**
+     * A-010.1 —— core `RunnerDeps.runtimeCapsResolver` 的**同一只**(main.ts 的 `runtimeCapsResolver`,
+     * 单一属主同 `boot/runtime-caps.ts`)。重建条目的第三位决议链元数据 `autoModeArmed` 的唯一判据是
+     * per-principal 的 `RuntimeCaps.autoMode`,而它只有 center 解得出 —— 见 {@link autoModePostureOf}。
+     * 缺席(无 center 的部署 / dry-run)⇒ core 侧 `runtimeCaps` 也恒 undefined ⇒ 该位在 park 时也从不置位,
+     * 两侧同为「不供」,逐字零行为差。
+     *
+     * 类型从 **core 的载体位**推导(同 `boot/runner-deps.ts:94` 的先例,理由同 {@link RebuiltInheritedGate}:
+     * 手抄一个等价签名会让 core 改这条 seam 的那天变成静默漂移而不是编译期事件)。
+     */
+    readonly resolveRuntimeCaps?: RunnerDeps["runtimeCapsResolver"];
+    /** `RunnerDeps.autoMode` 分类器面(信任门半场)在不在场 —— core 的武装条件是
+     *  `runtimeCaps.autoMode === true` **∧** 这一面在场,两个半场缺一不武装(prepare-task 原式)。 */
+    readonly autoModeSeatMounted?: boolean;
     readonly logger: {
         info(event: string, fields?: Record<string, unknown>): void;
         warn(event: string, fields?: Record<string, unknown>): void;
@@ -97,6 +111,8 @@ export type RebuiltParentConstraint = NonNullable<RebuiltInheritedGate["parentCo
  * 时点语义(成文进 docs/ASSISTANT-WIRE-CONTRACT.md,免运维当 bug 报):
  *  · toolPolicy 轴 = **当前** config(与 resume 重折一致,收紧与放松都被兑现——放松是一次显式运维动作);
  *  · shellGate 轴 = core 取 max(live, park 时 seed)—— 收紧兑现、放松**不**兑现(fail-safe)。
+ *  · `autoModeArmed` 轴(A-010.1)= 按**当前** per-principal entitlement 现解(见 {@link autoModePostureOf});
+ *    与 toolPolicy 轴同族:挂起期间权益被撤/被授 ⇒ 摘要对不上 ⇒ core pre-CAS 响亮拒,不静默换姿势跑。
  *  · `onAsk` 轴 = 部署的活体审批席(`deps.approverSeat`),**在场即供**:park 时那一层冻的就是它。
  *    席位缺席的部署上不供,而**这不等于 auto-deny**(codex R3-中1 验真纠正):此形恒带
  *    `durableMandate`(见 {@link mandatePostureOf}),继承层判 `ask` 时 core 只要还看得见 checkpoint 店
@@ -107,5 +123,5 @@ export type RebuiltParentConstraint = NonNullable<RebuiltInheritedGate["parentCo
  *    ask 门、scratchpad 豁免……整类)park 时未持久化 ⇒ 重建不出。§2.3 已披露的残余,机制面有特征化钉
  *    (test/parked-revive-e2e.test.ts);真 settings→park→赎回的端到端钉未建(候件,随收口件一起)。
  */
-export declare function createParkedReviveInheritedGate(deps: ParkedReviveGateDeps): (row: BackgroundAgentRecord) => RebuiltInheritedGate;
+export declare function createParkedReviveInheritedGate(deps: ParkedReviveGateDeps): (row: BackgroundAgentRecord) => Promise<RebuiltInheritedGate>;
 //# sourceMappingURL=parked-revive-gate.d.ts.map