@sema-agent/server 7.114.0 → 7.116.0

package/dist/http/routes/trace-usage.js

@@ -8,6 +8,7 @@ import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_
 import { filterFingerprint } from "../cursor-fingerprint.js";
 import { gatedPrincipal, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 const TOOL_RESULT_LIMIT_CAP = 262_144;
 const TOOL_RESULT_OFFSET_CAP = 2_147_483_646;
 export async function handleTraceUsage(req, res, match, ctx) {
@@ -18,13 +19,15 @@ export async function handleTraceUsage(req, res, match, ctx) {
             sendUnauthorized(res, "operator");
             return;
         }
-        if (!deps.runStore) {
+        const runs = facts.durableRuns(deps);
+        if (!runs.available) {
             sendError(res, 501, "capability.run_store_required", "trace API requires a durable run store (DB_BACKEND=mysql|pg|local)");
             return;
         }
+        const runStore = runs.runStore;
         const q = new URLSearchParams(match.search);
         const sinceSec = Math.min(30 * 86_400, Math.max(60, Number(q.get("sinceSec") ?? 86_400) || 86_400));
-        sendJson(res, 200, { sinceSec, rows: await deps.runStore.sourceSummary(Date.now() - sinceSec * 1000) });
+        sendJson(res, 200, { sinceSec, rows: await runStore.sourceSummary(Date.now() - sinceSec * 1000) });
         return;
     }
     if (match.decl.id === "task-trace-list" ||
@@ -38,15 +41,17 @@ export async function handleTraceUsage(req, res, match, ctx) {
             sendUnauthorized(res, "identity");
             return;
         }
-        if (!deps.runStore) {
+        const runs = facts.durableRuns(deps);
+        if (!runs.available) {
             sendError(res, 501, "capability.run_store_required", "trace API requires a durable run store (DB_BACKEND=mysql|pg|local)");
             return;
         }
+        const runStore = runs.runStore;
         const query = new URLSearchParams(match.search);
         const taskId = match.params.taskId;
         let ownedRun;
         if (taskId && gateOwner !== null) {
-            const run = await deps.runStore.getRun(taskId);
+            const run = await runStore.getRun(taskId);
             if (!run || (run.owner !== null && run.owner !== gateOwner)) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
@@ -55,19 +60,19 @@ export async function handleTraceUsage(req, res, match, ctx) {
         }
         switch (match.decl.id) {
             case "task-trace-list":
-                await handleTaskList(res, deps.runStore, query, gateOwner);
+                await handleTaskList(res, runStore, query, gateOwner);
                 return;
             case "task-trace-turns":
-                await handleTaskTurns(res, deps.runStore, taskId, query);
+                await handleTaskTurns(res, runStore, taskId, query);
                 return;
             case "task-trace-stream":
-                await streamTaskTrace(req, res, deps.runStore, taskId, deps.config.runStaleSec * 1000, match.search);
+                await streamTaskTrace(req, res, runStore, taskId, deps.config.runStaleSec * 1000, match.search);
                 return;
             case "task-trace-artifacts":
-                await handleTaskArtifacts(res, deps.runStore, taskId);
+                await handleTaskArtifacts(res, runStore, taskId);
                 return;
             case "task-tool-result":
-                await handleToolResult(res, deps.toolResultStore, deps.runStore, taskId, ownedRun, safeDecode(match.params.ref), query);
+                await handleToolResult(res, deps.toolResultStore, runStore, taskId, ownedRun, safeDecode(match.params.ref), query);
                 return;
             default:
                 return assertNever(match.decl.id);
@@ -78,10 +83,12 @@ export async function handleTraceUsage(req, res, match, ctx) {
     {
         const sub = match.params.sub;
         {
-            if (!deps.runStore) {
+            const runs = facts.durableRuns(deps);
+            if (!runs.available) {
                 sendError(res, 501, "capability.run_store_required", "usage analytics requires a run store");
                 return;
             }
+            const runStore = runs.runStore;
             const fleetWide = isFleetWide(req);
             const jwtOwner = fleetWide ? undefined : gatedPrincipal(req, deps.config);
             if (!fleetWide && !jwtOwner) {
@@ -104,7 +111,7 @@ export async function handleTraceUsage(req, res, match, ctx) {
             }
             const owner = jwtOwner ?? (q.get("principal") ?? undefined);
             try {
-                const scan = await deps.runStore.usageScan(from, to, owner !== undefined ? { owner } : undefined);
+                const scan = await runStore.usageScan(from, to, owner !== undefined ? { owner } : undefined);
                 const base = { from: new Date(from).toISOString(), to: new Date(to).toISOString(), ...(scan.truncated ? { truncated: true } : {}) };
                 if (sub === "summary") {
                     sendJson(res, 200, { ...base, ...usageSummary(scan.rows) });

package/dist/http/routes/workflows.js

@@ -12,6 +12,7 @@ const journalProjectionMemo = new Map();
 import { sendJson, sendError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export async function handleWorkflows(req, res, match, ctx) {
     const { deps } = ctx;
     const { runSessionAcceptOk } = ctx.helpers;
@@ -21,10 +22,21 @@ export async function handleWorkflows(req, res, match, ctx) {
             sendPrincipalRefusal(res, req, deps.config);
             return;
         }
-        if (!deps.workflowRunStore) {
-            sendError(res, 501, "capability.self_orchestration_required", "workflow runs require self-orchestration (SELF_ORCHESTRATION_ENABLED)");
+        let journalStore;
+        if (match.decl.id === "workflow-journal") {
+            const journalFace = facts.workflowsJournal(deps);
+            if (!journalFace.available) {
+                sendWorkflowsUnavailable(res, journalFace.why);
+                return;
+            }
+            journalStore = journalFace.journal;
+        }
+        const runs = facts.workflowRuns(deps);
+        if (!runs.available) {
+            sendWorkflowsUnavailable(res, runs.why);
             return;
         }
+        const runStore = runs.store;
         const scope = principal ?? "default";
         const wfId = match.params.runId;
         const isStream = match.decl.id === "workflow-stream";
@@ -33,7 +45,7 @@ export async function handleWorkflows(req, res, match, ctx) {
             const statusFilter = q.get("status");
             const limit = Math.min(100, Math.max(1, Number(q.get("limit") ?? 50) || 50));
             const sessionFilter = q.get("session");
-            const sessionRuns = await deps.workflowRunStore.listByScope(scope, {
+            const sessionRuns = await runStore.listByScope(scope, {
                 ...(statusFilter ? { status: statusFilter } : {}),
                 limit,
                 ...(sessionFilter !== null ? { session: sessionFilter } : {}),
@@ -47,7 +59,7 @@ export async function handleWorkflows(req, res, match, ctx) {
             sendJson(res, 200, { workflows: redacted });
             return;
         }
-        const run = await getWorkflowRun(deps.workflowRunStore, wfId, scope);
+        const run = await getWorkflowRun(runStore, wfId, scope);
         if (!run || run.scope !== scope) {
             sendError(res, 404, "not_found.workflow", "workflow not found");
             return;
@@ -55,10 +67,8 @@ export async function handleWorkflows(req, res, match, ctx) {
         if (!runSessionAcceptOk(req, res, { sessionId: run.originatingSessionId ?? null }, match.decl.id === "workflow-journal" ? "workflow.journal" : isStream ? "workflow.stream" : "workflow.detail", "workflow not found"))
             return;
         if (match.decl.id === "workflow-journal") {
-            if (!deps.workflowJournalStore) {
-                sendError(res, 501, "capability.workflow_store_required", "workflow journal requires the journal store (SELF_ORCHESTRATION_ENABLED + a store backend)");
-                return;
-            }
+            if (journalStore === undefined)
+                throw new Error("workflow-journal reached without the workflowsJournal journal witness");
             const jq = new URLSearchParams(match.search);
             const jLimit = Math.min(50, Math.max(1, Number(jq.get("limit") ?? 20) || 20));
             const jOffset = Math.max(0, Number(jq.get("offset") ?? 0) || 0);
@@ -100,7 +110,7 @@ export async function handleWorkflows(req, res, match, ctx) {
                     ...(r.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}),
                 };
             };
-            const js = deps.workflowJournalStore;
+            const js = journalStore;
             let projected;
             if (js.loadPage) {
                 const page = await js.loadPage(wfId, scope, { offset: jOffset, limit: jLimit, maxResultBytes: MAX_ROW_BYTES });
@@ -118,7 +128,7 @@ export async function handleWorkflows(req, res, match, ctx) {
                 });
             }
             else {
-                const entries = await deps.workflowJournalStore.load(wfId, scope);
+                const entries = await journalStore.load(wfId, scope);
                 projected = entries
                     .sort((a, b) => callKeyOrdinal(a.callKey) - callKeyOrdinal(b.callKey))
                     .slice(jOffset, jOffset + jLimit)
@@ -150,8 +160,9 @@ export async function handleWorkflowAgentSteer(req, res, match, ctx) {
     {
         if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
             return;
-        if (!deps.workflowRunStore) {
-            sendError(res, 501, "capability.self_orchestration_required", "workflow runs require self-orchestration (SELF_ORCHESTRATION_ENABLED)");
+        const runs = facts.workflowRuns(deps);
+        if (!runs.available) {
+            sendWorkflowsUnavailable(res, runs.why);
             return;
         }
         const principal = gatedPrincipal(req, deps.config);
@@ -183,7 +194,7 @@ export async function handleWorkflowAgentSteer(req, res, match, ctx) {
         }
         const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
         const ownerScope = principal ?? "default";
-        const wfRun = await getWorkflowRun(deps.workflowRunStore, wfRunId, ownerScope);
+        const wfRun = await getWorkflowRun(runs.store, wfRunId, ownerScope);
         if (!trusted && !wfRun) {
             sendError(res, 404, "not_found.workflow", "workflow not found");
             return;
@@ -389,6 +400,18 @@ async function streamWorkflowRun(req, res, runId, scope) {
     if (!res.writableEnded)
         res.end();
 }
+function sendWorkflowsUnavailable(res, why) {
+    switch (why) {
+        case "workflow_run_store_absent":
+            sendError(res, 501, "capability.self_orchestration_required", "workflow runs require self-orchestration (SELF_ORCHESTRATION_ENABLED)");
+            return;
+        case "workflow_journal_store_absent":
+            sendError(res, 501, "capability.workflow_store_required", "workflow journal requires the journal store (SELF_ORCHESTRATION_ENABLED + a store backend)");
+            return;
+        default:
+            return assertNever(why);
+    }
+}
 export const WORKFLOWS_ROUTES = [
     { id: "workflows-list", path: "/v1/workflows", methods: ["GET"] },
     { id: "workflow-stream", pattern: /^\/v1\/workflows\/(?<runId>[^/]+)\/stream$/, label: "/v1/workflows/:id/$sub", methods: ["GET"] },

package/dist/http/server.js

@@ -23,6 +23,7 @@ import { sendError, sendSessionError, httpErrorCode, msg } from "./send.js";
 import { createRequestGuards } from "./request-guards.js";
 import { createAdmission, MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills } from "./admission.js";
 import { createResumeLegs } from "./resume-legs.js";
+import * as facts from "../capability-facts.js";
 import { createDispatch, hasServiceAuth } from "./dispatch.js";
 import { routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, isProbePath } from "./route-table.js";
 import { createApprovalSweeps } from "./approval-sweeps.js";
@@ -118,7 +119,9 @@ export function createHttpServer(rawDeps) {
             sendError(res, 500, "internal.error", "internal error");
         });
     });
-    deps.deviceHub?.attach(server);
+    const deviceLane = facts.deviceLane(deps);
+    if (deviceLane.available)
+        deviceLane.hub.attach(server);
     function runnerFor(spec) {
         return deps.runnerFor(spec);
     }

package/dist/http/wire-types.d.ts

@@ -301,6 +301,12 @@ export interface TaskRequestBody {
      *  续跑重放逐字重放存量体 ⇒ 同一只写点同判(坏形 defensive:只认 literal `true`)。无租户门(收窄,不跨租户)。
      *  探测位 `GET /v1/capabilities` 的 `disableSkills`(与本键同一个词)。 */
     disableSkills?: boolean;
+    /** core 7.41.0 #1303 —— **人用名字点过的技能**(壳从人敲的 `/name` 解析出来的,按 `SkillSpec.name`),原样交给 core 的
+     *  `TaskSpec.userInvokedSkills`:这些技能的 `allowedTools` / `disallowedTools` 开跑即生效,不出 `Skill` 卡(人自己点的名就是那句表态),
+     *  只管这一次 run(steer 不终止它,下一次 run 不带)。每个名字必须是这一 run 装着的技能(场景出厂 ∪ 本请求 `skills`),否则引擎
+     *  拒启 `config.user_invoked_skill_unknown`(同步腿 400)。值形:非空串数组(受理门 400 `request.field_invalid`);续跑重放逐字重放存量体,
+     *  坏形不挂键。不投递技能正文(正文照旧由 `Skill` 工具 / 调用方负责)。 */
+    userInvokedSkills?: string[];
     /** [ref]② (core 1.314 工具面控制批): roster 真卸载清单(schema 不上 wire,manifest 收窄)。wire 工具名;
      *  tighten-only(core 继承不变量 union 进子 spawn)。数组-of-string fail-loud at submit。 */
     excludeTools?: string[];

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { loadConfig, type ServiceConfig } from "./config.js";
-export { composeExecutionLane, assertExecutionLaneInvariants } from "./boot/execution-lane.js";
+export { composeExecutionLane, assertExecutionLaneInvariants, type ExecutionLaneComposeCtx } from "./boot/execution-lane.js";
 export { createBrain } from "./brain.js";
 export { createSessionStore } from "./plugins/session-store.js";
 export { createStoreBackend, type StoreBackend, type SessionCaptureRecordSource } from "./plugins/store-backend.js";

package/dist/leader/wire.js

@@ -6,6 +6,7 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { Runner, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, delimitUntrusted, hasDestroy, } from "@sema-agent/core";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
+import { buildCheckpointCtx } from "../http/checkpoint-ctx.js";
 import { RemoteContainerExecutionEnv } from "../plugins/remote-env-e2b.js";
 import { E2B_SANDBOX_HOME } from "../execution-lane-caps.js";
 import { createDurableAskPolicy } from "../approval.js";
@@ -267,7 +268,7 @@ export function createLeaderRunner(cfg) {
         const provisionWorker = async (sub) => {
             const sessionId = `leader-${sub.workerId}-${Date.now()}`;
             const durable = cfg.durable?.();
-            const resumeCtx = { body: { objective: sub.spec.objective }, unattendedLeg: true };
+            const resumeCtx = buildCheckpointCtx({ body: { objective: sub.spec.objective }, unattendedLeg: true });
             let durableSpec = {};
             if (durable) {
                 const d = durable;

package/dist/local-data-root.d.ts

@@ -4,7 +4,7 @@
  * 链(第一个非空者胜,空串视作缺席):`LOCAL_DATA_ROOT` → `CONFIG_LOCAL_DIR` → `AGENT_DATA_DIR` → `<home>/.ai-agent`。
  *
  * 为什么是一只**纯函数、env 与 home 都由调用方递入**:本函数有两个读者 —— 服务自己的 `loadConfig`(递 `process.env` / `os.homedir()`)与随包发的运维脚本
- * `scripts/retired-mode-seed-drain-local.mjs`(经 `dist/local-data-root.js` 取同一只函数,缺省数据根不再自抄一份链:抄本只对了一半,
+ * `scripts/drain-check-local.mjs`(经 `dist/local-data-root.js` 取同一只函数,缺省数据根不再自抄一份链:抄本只对了一半,
  * 设了 `AGENT_DATA_DIR` 的部署不带参数跑脚本会读到另一个目录并报「干净」)。纯叶、零反向依赖 ⇒ 脚本引它不会把整个服务装载起来。
  *
  * ⚠️ 与**配置根**(`configLocalRoot`:`CONFIG_LOCAL_DIR` → `AGENT_DATA_DIR` → `~/.ai-agent`,不吃 `LOCAL_DATA_ROOT`)不是同一条链 —— 两根分家的那一形由

package/dist/mcp-content-origin.d.ts

@@ -19,15 +19,8 @@
  * 单向钉挡不住第二种(手滑把 `"local"` 打成 `"locale"` 只会让一个合法声明被静默拒),所以两条都要。
  */
 import type { ToolContentOrigin } from "@sema-agent/core";
-/** 编译期断言:`T` 必须收敛到 `never`(有残余 ⇒ tsc 红)。 */
-type AssertNever<T extends never> = T;
 /** core `ToolContentOrigin` 的执法副本 —— **唯一**一份(见模块头注)。 */
 export declare const CONTENT_ORIGIN_WORDS: readonly ["local", "execution", "external"];
-type ContentOriginWord = (typeof CONTENT_ORIGIN_WORDS)[number];
-type _ContentOriginCovers = AssertNever<Exclude<ToolContentOrigin, ContentOriginWord>>;
-type _ContentOriginNoStray = AssertNever<Exclude<ContentOriginWord, ToolContentOrigin>>;
-/** (占位使用,防 noUnusedLocals;类型别名零运行时。) */
-export type ContentOriginWordTableGuards = [_ContentOriginCovers, _ContentOriginNoStray];
 /**
  * 词表内?—— 两个平面共用的**那一只**谓词。
  *
@@ -38,5 +31,4 @@ export type ContentOriginWordTableGuards = [_ContentOriginCovers, _ContentOrigin
 export declare function isContentOriginWord(v: unknown): v is ToolContentOrigin;
 /** 坏值的**可打印**摘要(进 400 文案 / warn 元数据)——中和 + 截长,绝不把任意长度的调用方输入原样回显。 */
 export declare function describeBadContentOrigin(v: unknown): string;
-export {};
 //# sourceMappingURL=mcp-content-origin.d.ts.map

package/dist/model-entry-refusal.d.ts

@@ -90,13 +90,21 @@ export interface ModelRefusalVerdict {
  * 名 → 码,**值只码**(拒因事实里的上游 id / provider 词 / 坏字段键 / 出路句都不上 wire —— `entry_invalid` 行是没人验过的行,id / provider
  * 可能就是坏行原样;句子是给本机运维的散文,不是契约)。**名筛在这里、只在这里**:键过 settings-schema `isReportableRefusalName`(唯一判据,
  * import 不复制;6.3.0 起 = 标识符白名单 ∧ 无密钥形 ∧ 无 URL userinfo)—— 秘密形 / 空串 / `__proto__` / 不是标识符的串这类出不了门的名不进键、
- * 不计数;引擎内部的判决不受影响(本机日志的写名行为与基线同)。
+ * 不计数;引擎内部的判决不受影响;本机日志 / 拒因句里的写名同样先问这一只(S-805,{@link disclosableRefusalName}:不可披露的名只写码)。
  * 逐条空且无组拒 ⇒ `undefined`(键缺席:「没有」只有一种拼法)。
  */
 export declare function buildModelRefusalsSignal(v: ModelRefusalVerdict | undefined): ModelRefusalsSignal | undefined;
+/**
+ * 一个被拒条目名的**日志字段**:可披露 ⇒ `{ [key]: name }`;不可披露 ⇒ `{ [`${key}NameWithheld`]: true }`(缺 `key` 不是无声的:读日志的人知道是被扣下、
+ * 不是漏写)。**所有**把被拒条目名写进结构化日志字段的站点调这一只(`refusalWarnFields` / `apply-effective.ts` 的角色与档位绑定 warn、缺省悬空 warn),
+ * 不各写一份 `isReportableRefusalName` 判断。
+ */
+export declare function refusedNameLogField(key: string, name: string): Record<string, unknown>;
+/** 一串被拒条目名的日志字段(`sema_registry_models` 行的 `unavailable`):只列可披露的名,被扣下的名**只数个数**(`<key>NamesWithheld`,0 个时键缺席)。 */
+export declare function refusedNamesLogFields(key: string, names: readonly string[]): Record<string, unknown>;
 /** 成因 → 它那一条 warn 的事件名(**穷举**)。两个名字是票面点名的既有/新事件,运维的告警规则按名挂。 */
 export declare function refusalEventOf(reason: ModelEntryRefusalReason): "sema_registry_model_no_brain" | "sema_registry_model_entry_invalid";
-/** warn 字段(不含值):`field` = 第一处坏字段(告警规则最常按它分组),`fields` = 全部。 */
+/** warn 字段(不含值):`field` = 第一处坏字段(告警规则最常按它分组),`fields` = 全部。S-805:`model` 只在名可披露时写。 */
 export declare function refusalWarnFields(name: string, r: ModelEntryRefusal): Record<string, unknown>;
 /**
  * 一次**显式选择**命中了不可用条目时的拒因句(HTTP `request.model_unavailable` 的 `error`、run-local 的 stderr、

package/dist/model-entry-refusal.js

@@ -94,6 +94,22 @@ export function buildModelRefusalsSignal(v) {
         return undefined;
     return v.plane === undefined ? { entries } : { entries, plane: v.plane };
 }
+function disclosableRefusalName(name) {
+    return isReportableRefusalName(name) ? name : undefined;
+}
+export function refusedNameLogField(key, name) {
+    const shown = disclosableRefusalName(name);
+    return shown !== undefined ? { [key]: shown } : { [`${key}NameWithheld`]: true };
+}
+export function refusedNamesLogFields(key, names) {
+    const shown = names.filter((n) => disclosableRefusalName(n) !== undefined);
+    const withheld = names.length - shown.length;
+    return { [key]: shown, ...(withheld > 0 ? { [`${key}NamesWithheld`]: withheld } : {}) };
+}
+function nameSlot(name) {
+    const shown = disclosableRefusalName(name);
+    return shown === undefined ? "(name withheld)" : `"${shown}"`;
+}
 export function refusalEventOf(reason) {
     switch (reason) {
         case "no_brain":
@@ -104,7 +120,7 @@ export function refusalEventOf(reason) {
 }
 export function refusalWarnFields(name, r) {
     return {
-        model: name,
+        ...refusedNameLogField("model", name),
         provider: r.provider,
         code: r.code,
         ...(r.fields.length > 0 ? { field: r.fields[0], fields: [...r.fields] } : {}),
@@ -118,7 +134,7 @@ export function modelUnavailableMessage(field, requested, name, r) {
 export function defaultModelRefusal(view, leg) {
     if (Object.hasOwn(view.models, DEFAULT_MODEL_REF) && view.models[DEFAULT_MODEL_REF] !== undefined)
         return undefined;
-    const refused = Object.entries(view.modelRefusals).map(([n, r]) => `"${n}" [${r.code}]`);
+    const refused = Object.entries(view.modelRefusals).map(([n, r]) => `${nameSlot(n)} [${r.code}]`);
     const unavailable = refused.length > 0 ? ` (every enabled catalog entry is unavailable on this host: ${refused.join(", ")})` : "";
     switch (leg) {
         case "env":
@@ -163,7 +179,7 @@ export function refusedNameMintedRefusal(view) {
     const minted = mintedRefusedNames(view);
     if (minted.length === 0)
         return undefined;
-    const pairs = minted.map((m) => `"${m.name}" [${m.code}] → "${m.target}" (${m.via})`);
+    const pairs = minted.map((m) => `${nameSlot(m.name)} [${m.code}] → ${nameSlot(m.target)} (${m.via})`);
     return (`unavailable catalog entries would be re-minted onto other entries by the tier/alias expansion [${REFUSED_NAME_MINTED_CODE}]: ${pairs.join(", ")} — ` +
         "an explicit pick of that name (or a role bound to it) would silently run on the other entry's endpoint and account; " +
         "rename the unavailable entry, fix it (see its own warn), or rebind / drop the tier binding that mints the name.");

package/dist/namespaced-rule-name.d.ts

@@ -0,0 +1,54 @@
+/**
+ * 协议规则名(`mcp__…` / `a2a__…`)够不够得着一只挂载工具 —— **一只**判官 + **一只**句子。调它的面(点名,不是「每个面」):
+ *  · 运维四表与中心下发的同名表、请求 `settings.permissions.{allow,ask,deny}`(经 `config.ts` 的 `unmatchableToolNamesRefusal`);
+ *  · 会话规则写口两腿与 SQL 会话规则店的写口(经 `session-policy-wire.ts`);
+ *  · 技能的两只清单 `allowedTools` / `disallowedTools`,两处受理口:顶层 `skills[]`(`http/admission.ts` 的 `validateUserSkills`)与子代
+ *    `agents[].skills[]`(`spec-fields.ts` 的 `validateTaskAgents`),经 `spec-fields.ts` 的 `unreachableSkillToolListEntryOf`。
+ * **不调它的面**(如实,未接):`/v1/rules` 的持久规则写口与 `cc-import` 导入口(`http/routes/rules.ts`)、子代的工具名表 `agents[].allowTools` /
+ * `denyTools`(`spec-fields.ts` 只判形与条数)。在这两处写铸不出的服务器段仍被收下、永不命中。
+ * 规则文本里「工具名那一段」怎么取也只有一种读法:{@link ruleEntryToolName}(配置表与技能清单同读)。
+ *
+ * 规则:一条协议规则名够得着挂载工具 ⇔
+ *  ① 分得出对端段 —— 三段名(`ns.parse` 认得:首段为对端、余段非空)取 `parse().peer`;两段覆盖形 `<ns>__<peer>`(core `isNamespacedCoveringRuleName`
+ *     认、`ns.parse` 不认)取前缀之后的整段;两者都不是(`mcp__` / `mcp__srv__` / `mcp____x`)= **缺段**;
+ *  ② 对端段是引擎**自铸**的那一段:`mintNamespacePrefix(ns, peer) === ns.prefix + peer + "__"`。引擎铸注册名时归一对端段(字符表外换 `_`、超长截断加摘要、
+ *     折连串下划线、去尾下划线),而规则匹配对对端段逐字比(覆盖形 `namespacedRuleNameCovers`,精确名整串比)—— 铸不出的对端段一只工具都匹配不到。
+ *     服务器段里带 `*`(`mcp__*`、`mcp__git*__x`)是同一个「够不着」,但出路不同:那是在写通配,而服务器名不支持通配 —— 给一条铸名写法
+ *     (`mcp__<摘要>__*`)没人照做得了 ⇒ 判词单列 `wildcard_peer`,句子说实话(写具体的服务器名)。
+ * 判据不看规则是覆盖形还是精确名:两种形的对端段命运相同。精确名的**工具段**归一不在这里判(包根没有导出工具段的铸法,不手抄)。
+ *
+ * core 下一版(7.42.0)的规则名判官会自己给这个判词;到货那天本仓这只对照整只退役(连同会话规则写口这一问的码由 `request.field_invalid` 归回
+ * `rules.legacy_tool_name`)。
+ */
+import { type ProtocolNamespace } from "@sema-agent/core";
+/**
+ * 一条**规则文本**里的工具名那一段(判官与旧名判据的主语)= core 包根 `parsePermissionRule` 的 `toolName`,原样 —— 引擎的技能编译器
+ * (`compileSkillGrant`)与规则编译器读条目用的就是这一只:`Bash(npm:*)` ⇒ `Bash`;`mcp__srv(*)` / `mcp__srv()` / 带首尾空格的 `mcp__srv ` ⇒ 光杆名 `mcp__srv`。
+ * 配置表的规则编译器消费者与技能的两只清单读同一只。不在这里另写解析、不回落整串:修前用 `parseRuleText`(只认 `工具(内容)` 形,光杆名解析不出就回落整串),
+ * 整串带着 `(*)` / 尾空格进判官 ⇒ 合法条目被判「铸不出」(修复验证轮 gpt-6 腿)。条目若是引擎文法本身就拒的形(配置表上 MCP 规则带括号:
+ * `unsupported.mcp_paren`),拒由引擎的文法那一问说(配置表的判据链里它排在本判官之前),本判官不抢答。
+ */
+export declare function ruleEntryToolName(entry: string): string;
+/** 一条协议规则名够不着任何挂载工具的判词(闭集)。 */
+export type UnreachableNamespacedRuleName = 
+/** 分不出对端段:光杆前缀、对端段为空、或分隔符之后工具段为空。 */
+{
+    readonly kind: "incomplete";
+    readonly ns: ProtocolNamespace;
+}
+/** 对端段不是引擎自铸的那一段;`minted` = 引擎为这样一个对端名铸出的注册名前缀(`mintNamespacePrefix` 的返回值,原样)。 */
+ | {
+    readonly kind: "unminted_peer";
+    readonly ns: ProtocolNamespace;
+    readonly minted: string;
+}
+/** 对端段里带 `*`:写的是通配,而服务器 / 对端名不支持通配(规则对这一段逐字比)。 */
+ | {
+    readonly kind: "wildcard_peer";
+    readonly ns: ProtocolNamespace;
+};
+/** 判官:不是协议名、或够得着 ⇒ `undefined`;否则给判词。纯字符串运算,不做 I/O。 */
+export declare function unreachableNamespacedRuleNameOf(name: string): UnreachableNamespacedRuleName | undefined;
+/** 判词 → 句子(「为什么永远匹配不到 + 怎么写」;不复述条目本身 —— 调用方的句子已点名它)。闭集穷尽:判词加一种 ⇒ 编译红。 */
+export declare function describeUnreachableNamespacedRuleName(v: UnreachableNamespacedRuleName): string;
+//# sourceMappingURL=namespaced-rule-name.d.ts.map

package/dist/namespaced-rule-name.js

@@ -0,0 +1,33 @@
+import { isNamespacedCoveringRuleName, mintNamespacePrefix, parsePermissionRule, protocolOf } from "@sema-agent/core";
+export function ruleEntryToolName(entry) {
+    return parsePermissionRule(entry).toolName;
+}
+export function unreachableNamespacedRuleNameOf(name) {
+    const ns = protocolOf(name);
+    if (ns === undefined)
+        return undefined;
+    const peer = ns.parse(name)?.peer ?? (isNamespacedCoveringRuleName(name) ? name.slice(ns.prefix.length) : undefined);
+    if (peer === undefined)
+        return { kind: "incomplete", ns };
+    if (peer.includes("*"))
+        return { kind: "wildcard_peer", ns };
+    const minted = mintNamespacePrefix(ns, peer);
+    return minted === `${ns.prefix}${peer}__` ? undefined : { kind: "unminted_peer", ns, minted };
+}
+export function describeUnreachableNamespacedRuleName(v) {
+    switch (v.kind) {
+        case "incomplete":
+            return `incomplete ${v.ns.id} name — the live form is ${v.ns.prefix}<server>__<tool>, or ${v.ns.prefix}<server> / ${v.ns.prefix}<server>__* to cover every tool on that server`;
+        case "wildcard_peer":
+            return `the ${v.ns.id} server segment does not take a wildcard — a rule compares the server segment literally, so the entry matches nothing; write the concrete server name: ${v.ns.prefix}<server>__* to cover every tool on that server, or ${v.ns.prefix}<server>__<tool>`;
+        case "unminted_peer":
+            return (`the engine never mints this server segment as written — a server configured under that name has its tools registered as ${v.minted}<tool>, ` +
+                `and a rule compares the server segment literally (no wildcard, no normalization), so the entry matches nothing; if that is the configured name, ` +
+                `write ${v.minted}* to cover every tool on that server, or ${v.minted}<tool>`);
+        default: {
+            const unhandled = v;
+            throw new Error(`unhandled namespaced rule name verdict: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+//# sourceMappingURL=namespaced-rule-name.js.map

package/dist/observability/corrupt-read-seat.d.ts

@@ -43,9 +43,10 @@ export declare function createCorruptReadFailOpenSeat(tag: FailOpenTag, leg?: (i
  *
  * ## 逐命中响亮不降级
  * 这一座里有安全轴的脸(session-policy),所以每命中一行 warn 保留(降成「每进程一次」是降级,S-990 的裁定);**在此之上**,认出的脸另记账:
- *  · session-policy 脸 ⇒ `P-DEBT` tag(`server.session-policy.corrupt-read-fail-open`)—— 计数逐次 + 探针行 + 一次性 warn。core 7.39.2 起按键读拒,
- *    但枚举 / 别的会话抹除 / 数据根重绑三张脸仍按「无规则」(会话规则只许收紧 ⇒ 丢的恰是收紧);座上分不出读法 ⇒ 这一脸每一发都计(含已拒的按键读)。
- *    别的会话抹除的常见形 core **不披露** ⇒ 这一形座上数不到,只能在 CENSUS / CHANGELOG 披露。放行是 core 的裁定、本仓不包层(源头修复纪律),所以**只登债、不改放行**;
+ *  · session-policy 脸 ⇒ `P-DEBT` tag(`server.session-policy.corrupt-read-fail-open`)—— 计数逐次 + 探针行 + 一次性 warn。core 7.39.2 起按键读拒;
+ *    core 7.41.0 #1309 起本会话的枚举拒、别的会话的抹除不动它、重绑带走它 —— 但只对**有归属**的坏行(行里的 `__sid`,否则同名高水位标记的 `__sid`);
+ *    无归属的坏行仍按「无规则」(会话规则只许收紧 ⇒ 丢的恰是收紧);座上分不出读法 ⇒ 这一脸每一发都计(含已拒的)。
+ *    抹除扫走无归属坏行那一形 core 是否披露、座上数不数得到,本车未亲核(未闭环,收车档登)。放行是 core 的裁定、本仓不包层(源头修复纪律),所以**只登债、不改放行**;
  *  · 其余脸 ⇒ 不计(见 {@link DurableAbsenceFace})。
  * 记账**先于** warn:记账是总函数,warn 可能抛(core 的 guard 会吞掉那个抛),一次日志故障不许吃掉计数。
  *

package/dist/observability/corrupt-read-seat.js

@@ -86,9 +86,10 @@ export function createDurableAbsenceSeat(warn, root, thirdFace) {
 }
 function buildDurableAbsenceNote(thirdFace) {
     return ("a durable read hit unreadable bytes (never a plain ENOENT). " +
-        "Consequence depends on which store read it: session-policy = a keyed read (a task's session rules, GET/PUT .../policy) was REFUSED " +
-        "(the run fails with code \"corrupt\"), but enumeration (session sync export), another session's erase sweep and a data-root rebind still " +
-        "read that row as NO RULES — fix or delete the named file (deleting it means no session rules); session repo = a listing silently " +
+        "Consequence depends on which store read it: session-policy = a keyed read and this session's enumeration (a task's session rules, " +
+        "GET/PUT .../policy, the session sync export) were REFUSED (code \"corrupt\"); another session's erase keeps the row and a data-root rebind carries it, " +
+        "but a damaged row nothing on disk attributes to a session (no session id in its bytes and no high-water mark beside it) is still omitted from listings, " +
+        "swept by any session's erase when it is not JSON and left behind by a rebind, i.e. read as NO RULES — fix or delete the named file (deleting it means no session rules); session repo = a listing silently " +
         `omitted rows; ${thirdFace}. Inspect the named path before deciding.`);
 }
 const RULE_LANE_REMEDY = "the permission-rule lane is fail-closed until a person inspects the file (moving it aside restarts the lane with an empty log)";

package/dist/observability/fail-open.d.ts

@@ -1,13 +1,10 @@
 import type { Logger } from "./logger.js";
 import type { Metrics } from "./metrics.js";
-/** 登记项:`cls` 是判据表的分类(见模块头——只有这两类允许走本封装),`note` 说清"放行的最坏后果"。 */
-export interface FailOpenTagEntry {
-    /** `F`=纯体验/缓存回退,放行最坏后果只是"难看/不够好";`P-DEBT`=保护型欠账,方向明知不对、显式记债。 */
-    readonly cls: "F" | "P-DEBT";
-    /** 这条兜底放行了什么、最坏后果是什么。写给未来读遥测的人,不写来历。 */
-    readonly note: string;
-}
-/** 闭集 tag 词表。形=`<repo>.<domain>.<site>`(跨仓同形,便于三仓遥测并表)。 */
+/**
+ * 闭集 tag 词表。形=`<repo>.<domain>.<site>`(跨仓同形,便于三仓遥测并表)。
+ * 每项 `{ cls, note }`:`cls` 是判据表的分类(见模块头——只有这两类允许走本封装):`F`=纯体验/缓存回退,放行最坏后果只是"难看/不够好";
+ * `P-DEBT`=保护型欠账,方向明知不对、显式记债。`note` 说清这条兜底放行了什么、最坏后果是什么(写给未来读遥测的人,不写来历)。
+ */
 export declare const FAIL_OPEN_TAGS: {
     readonly "server.approval-ask-journal.compaction-failed": {
         readonly cls: "F";
@@ -371,7 +368,11 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.session-policy.corrupt-read-fail-open": {
         readonly cls: "P-DEBT";
-        readonly note: "S-999(`observability/corrupt-read-seat.ts` 的 `createDurableAbsenceSeat`,`file_store_corrupt_read` 那只多脸座里认出的 **session-policy 脸**;local 车道,HTTP 服务的 local 腿与 run-local 同铸点):会话规则文件(数据根 `session-policy/` 下的行文件)坏了。core 7.39.2(#1299,本仓请托)起**按键读**(任务装规则、`GET` / `PUT /v1/sessions/:id/policy`)拒 —— `SessionPolicyError` 码 `corrupt`;但 core 包内 CHANGELOG 自陈另三张脸仍把坏行读成「无规则」:① `listBySession` 跳过坏行(会话同步导出读它 ⇒ 导出里没有这位 principal 的规则,目标端按无规则跑);② 别的会话的 `deleteBySession` 把撕尾行一并扫掉(常见形**不披露**),此后按键读得 ENOENT = 无规则;③ 数据根重绑把撕尾行留在旧键下。会话规则**只许收紧** ⇒ 丢的恰是调用方加的收紧(部署策略 / hooks / shell 门仍在)。方向 = fail-open,**明知不对**;SQL 孪生(`plugins/session-policy-store-sql.ts`)对同形响亮抛(CENSUS 第 81 行 P 终态)。归 P 类的理由是它决定权限门读到的规则层;归 DEBT 的理由是放行是 **core 的裁定**,源头修复纪律下本仓不包层,只让债在遥测里显形:计数逐次 + 探针行(`kind` / `path` / `sessionId` / `principal` / `reason`)+ 一次性 warn;逐命中 warn(`file_store_corrupt_read`)原样保留。⚠️ **如实全记**:座上分不出是哪一只读法披露的(载荷不带读法),所以这一脸的每一发都计 —— 含已被拒的按键读(那一发本身是 fail-closed);② 的常见形 core 不披露,座上**数不到**。**出路 = core 把三张脸也改成拒,届时撤本 tag**。计数非零 = 有会话的规则文件坏了:运维按探针里的 `sessionId` / `path` 去修(删文件即放弃那层规则,删前先看 `reason`)。认脸判据见 `durableAbsenceFaceOf`(披露路径落在本数据根的 `session-policy/` 之下);认不出的脸不计。7.114.0 合流时车 UY 曾以「core 已修」整只撤掉本 tag,修复轮恢复(那次删除未发版)。";
+        readonly note: "S-999(`observability/corrupt-read-seat.ts` 的 `createDurableAbsenceSeat`,`file_store_corrupt_read` 那只多脸座里认出的 **session-policy 脸**;local 车道,HTTP 服务的 local 腿与 run-local 同铸点):会话规则文件(数据根 `session-policy/` 下的行文件)坏了。core 7.39.2(#1299,本仓请托)起**按键读**(任务装规则、`GET` / `PUT /v1/sessions/:id/policy`)拒 —— `SessionPolicyError` 码 `corrupt`;core 7.41.0(#1309)起另三张脸对**有归属**的坏行(行里的 `__sid`,否则同名高水位标记的 `__sid`)也收紧了:① 本会话的 `listBySession` 拒(`corrupt`;会话同步导出 `GET /v1/sessions/:id/sync/manifest` 转 500 `corrupt`);② 别的会话的 `deleteBySession` 不动它;③ 数据根重绑带走它(新键上按键读照拒)。**仍按「无规则」的只剩无归属的坏行**(行里读不出 `__sid`、同名高水位标记也不在;core 包内 CHANGELOG 逐字「keeps its old fate」):枚举略过并披露、它「根本不是 JSON」时被任一会话的抹除扫掉(此后按键读得 ENOENT = 无规则)、重绑留在旧键下 —— 钉 `test/corrupt-read-f-seats-s990.test.ts` 的 🚧「S-1016 残余」格。会话规则**只许收紧** ⇒ 丢的恰是调用方加的收紧(部署策略 / hooks / shell 门仍在)。方向 = fail-open,**明知不对**;SQL 孪生(`plugins/session-policy-store-sql.ts`)对同形响亮抛(CENSUS 第 81 行 P 终态)。归 P 类的理由是它决定权限门读到的规则层;归 DEBT 的理由是放行是 **core 的裁定**,源头修复纪律下本仓不包层,只让债在遥测里显形:计数逐次 + 探针行(`kind` / `path` / `sessionId` / `principal` / `reason`)+ 一次性 warn;逐命中 warn(`file_store_corrupt_read`)原样保留。⚠️ **如实全记**:座上分不出是哪一只读法披露的(载荷不带读法),所以这一脸的每一发都计 —— 含已被拒的按键读与枚举(那些发本身是 fail-closed);抹除扫走无归属坏行那一形座上数不数得到未亲核。**出路 = core 把无归属行也改成拒,届时撤本 tag**(7.116.0 读不出能撤 ⇒ 照实留着)。计数非零 = 有会话的规则文件坏了:运维按探针里的 `sessionId` / `path` 去修(删文件即放弃那层规则,删前先看 `reason`)。认脸判据见 `durableAbsenceFaceOf`(披露路径落在本数据根的 `session-policy/` 之下);认不出的脸不计。7.114.0 合流时车 UY 曾以「core 已修」整只撤掉本 tag,修复轮恢复(那次删除未发版)。";
+    };
+    readonly "server.approval-crash-convergence.cause-unreadable": {
+        readonly cls: "F";
+        readonly note: "7.116.0 修复轮(`approval-crash-convergence.ts` 的 `convergeCrashedAsksAtBoot`;local 车道启动收敛):前世留下的一条 `STREAM_PENDING` 问行,它的卡信封(`card_json`)读不出 ⇒ 读不出 wire `approvalId`、无从向审计账要成因词 ⇒ 成因**回落**成 `crashed_before_park`。行照样收 VOID(决断口照样 410 —— 可决性 fail-closed,不受影响);最坏后果 = 一张其实是被有序关停截断的卡,在 410 体的 `deniedReason` 上说成「进程崩了」(`crashConverged` 读面若有它的审计组,那里的成因仍按审计账判,两处可能不同词)。计数非零 = 问账里有读不出卡信封的行(位腐 / 手改 / 版本错位),去看探针 detail 点名的 askId。读数另在启动日志 `approval_ask_audit_crash_converged` 的 `causeUnreadable` 格单列。";
     };
     readonly "server.outbound.connect-observer-threw": {
         readonly cls: "F";

package/dist/observability/fail-open.js

@@ -341,7 +341,11 @@ export const FAIL_OPEN_TAGS = {
     },
     "server.session-policy.corrupt-read-fail-open": {
         cls: "P-DEBT",
-        note: "S-999(`observability/corrupt-read-seat.ts` 的 `createDurableAbsenceSeat`,`file_store_corrupt_read` 那只多脸座里认出的 **session-policy 脸**;local 车道,HTTP 服务的 local 腿与 run-local 同铸点):会话规则文件(数据根 `session-policy/` 下的行文件)坏了。core 7.39.2(#1299,本仓请托)起**按键读**(任务装规则、`GET` / `PUT /v1/sessions/:id/policy`)拒 —— `SessionPolicyError` 码 `corrupt`;但 core 包内 CHANGELOG 自陈另三张脸仍把坏行读成「无规则」:① `listBySession` 跳过坏行(会话同步导出读它 ⇒ 导出里没有这位 principal 的规则,目标端按无规则跑);② 别的会话的 `deleteBySession` 把撕尾行一并扫掉(常见形**不披露**),此后按键读得 ENOENT = 无规则;③ 数据根重绑把撕尾行留在旧键下。会话规则**只许收紧** ⇒ 丢的恰是调用方加的收紧(部署策略 / hooks / shell 门仍在)。方向 = fail-open,**明知不对**;SQL 孪生(`plugins/session-policy-store-sql.ts`)对同形响亮抛(CENSUS 第 81 行 P 终态)。归 P 类的理由是它决定权限门读到的规则层;归 DEBT 的理由是放行是 **core 的裁定**,源头修复纪律下本仓不包层,只让债在遥测里显形:计数逐次 + 探针行(`kind` / `path` / `sessionId` / `principal` / `reason`)+ 一次性 warn;逐命中 warn(`file_store_corrupt_read`)原样保留。⚠️ **如实全记**:座上分不出是哪一只读法披露的(载荷不带读法),所以这一脸的每一发都计 —— 含已被拒的按键读(那一发本身是 fail-closed);② 的常见形 core 不披露,座上**数不到**。**出路 = core 把三张脸也改成拒,届时撤本 tag**。计数非零 = 有会话的规则文件坏了:运维按探针里的 `sessionId` / `path` 去修(删文件即放弃那层规则,删前先看 `reason`)。认脸判据见 `durableAbsenceFaceOf`(披露路径落在本数据根的 `session-policy/` 之下);认不出的脸不计。7.114.0 合流时车 UY 曾以「core 已修」整只撤掉本 tag,修复轮恢复(那次删除未发版)。",
+        note: "S-999(`observability/corrupt-read-seat.ts` 的 `createDurableAbsenceSeat`,`file_store_corrupt_read` 那只多脸座里认出的 **session-policy 脸**;local 车道,HTTP 服务的 local 腿与 run-local 同铸点):会话规则文件(数据根 `session-policy/` 下的行文件)坏了。core 7.39.2(#1299,本仓请托)起**按键读**(任务装规则、`GET` / `PUT /v1/sessions/:id/policy`)拒 —— `SessionPolicyError` 码 `corrupt`;core 7.41.0(#1309)起另三张脸对**有归属**的坏行(行里的 `__sid`,否则同名高水位标记的 `__sid`)也收紧了:① 本会话的 `listBySession` 拒(`corrupt`;会话同步导出 `GET /v1/sessions/:id/sync/manifest` 转 500 `corrupt`);② 别的会话的 `deleteBySession` 不动它;③ 数据根重绑带走它(新键上按键读照拒)。**仍按「无规则」的只剩无归属的坏行**(行里读不出 `__sid`、同名高水位标记也不在;core 包内 CHANGELOG 逐字「keeps its old fate」):枚举略过并披露、它「根本不是 JSON」时被任一会话的抹除扫掉(此后按键读得 ENOENT = 无规则)、重绑留在旧键下 —— 钉 `test/corrupt-read-f-seats-s990.test.ts` 的 🚧「S-1016 残余」格。会话规则**只许收紧** ⇒ 丢的恰是调用方加的收紧(部署策略 / hooks / shell 门仍在)。方向 = fail-open,**明知不对**;SQL 孪生(`plugins/session-policy-store-sql.ts`)对同形响亮抛(CENSUS 第 81 行 P 终态)。归 P 类的理由是它决定权限门读到的规则层;归 DEBT 的理由是放行是 **core 的裁定**,源头修复纪律下本仓不包层,只让债在遥测里显形:计数逐次 + 探针行(`kind` / `path` / `sessionId` / `principal` / `reason`)+ 一次性 warn;逐命中 warn(`file_store_corrupt_read`)原样保留。⚠️ **如实全记**:座上分不出是哪一只读法披露的(载荷不带读法),所以这一脸的每一发都计 —— 含已被拒的按键读与枚举(那些发本身是 fail-closed);抹除扫走无归属坏行那一形座上数不数得到未亲核。**出路 = core 把无归属行也改成拒,届时撤本 tag**(7.116.0 读不出能撤 ⇒ 照实留着)。计数非零 = 有会话的规则文件坏了:运维按探针里的 `sessionId` / `path` 去修(删文件即放弃那层规则,删前先看 `reason`)。认脸判据见 `durableAbsenceFaceOf`(披露路径落在本数据根的 `session-policy/` 之下);认不出的脸不计。7.114.0 合流时车 UY 曾以「core 已修」整只撤掉本 tag,修复轮恢复(那次删除未发版)。",
+    },
+    "server.approval-crash-convergence.cause-unreadable": {
+        cls: "F",
+        note: "7.116.0 修复轮(`approval-crash-convergence.ts` 的 `convergeCrashedAsksAtBoot`;local 车道启动收敛):前世留下的一条 `STREAM_PENDING` 问行,它的卡信封(`card_json`)读不出 ⇒ 读不出 wire `approvalId`、无从向审计账要成因词 ⇒ 成因**回落**成 `crashed_before_park`。行照样收 VOID(决断口照样 410 —— 可决性 fail-closed,不受影响);最坏后果 = 一张其实是被有序关停截断的卡,在 410 体的 `deniedReason` 上说成「进程崩了」(`crashConverged` 读面若有它的审计组,那里的成因仍按审计账判,两处可能不同词)。计数非零 = 问账里有读不出卡信封的行(位腐 / 手改 / 版本错位),去看探针 detail 点名的 askId。读数另在启动日志 `approval_ask_audit_crash_converged` 的 `causeUnreadable` 格单列。",
     },
     "server.outbound.connect-observer-threw": {
         cls: "F",

package/dist/observability/permission-rule-events.d.ts

@@ -8,6 +8,9 @@ export declare const PERMISSION_RULE_EVENT_TABLE: readonly [{
 }, {
     readonly event: "read_only_allowed";
     readonly meaning: "the engine's read-only shell verdict cleared an ask that was NOT an operator-written rule (core decisionReason \"read_only\"; an operator-declared ask carries matchedAskRule and is never cleared this way)";
+}, {
+    readonly event: "skill_allowed";
+    readonly meaning: "an activated skill's allowed-tools list cleared the ask for the rest of that run (core decisionReason \"skill\"; today only a skill the request itself carried can do this — this deployment's own skills carry no lists; it clears only the unstated / ordinary questions a persisted allow rule may clear, never a deny / ask rule, an operator list, a governance or shell-floor question, or a mandated one)";
 }];
 /** 词表里的一个词(闭集)。 */
 export type PermissionRuleEventWord = (typeof PERMISSION_RULE_EVENT_TABLE)[number]["event"];

package/dist/observability/permission-rule-events.js

@@ -12,6 +12,10 @@ export const PERMISSION_RULE_EVENT_TABLE = [
         event: "read_only_allowed",
         meaning: "the engine's read-only shell verdict cleared an ask that was NOT an operator-written rule (core decisionReason \"read_only\"; an operator-declared ask carries matchedAskRule and is never cleared this way)",
     },
+    {
+        event: "skill_allowed",
+        meaning: "an activated skill's allowed-tools list cleared the ask for the rest of that run (core decisionReason \"skill\"; today only a skill the request itself carried can do this — this deployment's own skills carry no lists; it clears only the unstated / ordinary questions a persisted allow rule may clear, never a deny / ask rule, an operator list, a governance or shell-floor question, or a mandated one)",
+    },
 ];
 const PERMISSION_RULE_EVENT_KINDS = new Set(PERMISSION_RULE_EVENT_TABLE.map((r) => `${PERMISSION_TRACE_PREFIX}${r.event}`));
 export function isPermissionRuleEventKind(kind) {