@sema-agent/server 7.114.0 → 7.116.0

package/dist/http/admission.js

@@ -5,13 +5,13 @@ import { HttpError } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
-import { selfOrchestrationDenial } from "../task-workflow.js";
-import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
-import { deadToolMatcherIssue, parseHooksConfig } from "../hooks/hook-runner.js";
+import * as facts from "../capability-facts.js";
+import { buildDeadToolMatcherRefusal, deadToolMatcherIssue, parseHooksConfig } from "../hooks/hook-runner.js";
 import { judgeRequestWebSearch } from "../plugins/web-search.js";
-import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
+import { describeUnreachableSkillToolListEntry, normalizeApproachNotice, skillToolListOk, unknownTaskAgentModelRef, unreachableSkillToolListEntryOf, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS, MAX_CWD_CHARS } from "../task-cwd.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
+import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
 import { resolveDevicePlacementIntent } from "./device-placement.js";
 import { sendError, httpErrorCode } from "./send.js";
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
@@ -33,9 +33,19 @@ export function validateUserSkills(skills) {
             return `skill.content must be a non-empty string of at most ${MAX_SKILL_CONTENT_CHARS} characters (the engine rejects skills over this size outright at load time)`;
         if (s["baseDir"] !== undefined && !isValidCwd(s["baseDir"]))
             return `skill.baseDir must be an absolute path string of at most ${MAX_CWD_CHARS} characters with no ".." segment and no NUL byte (it is not resolved or read here — the engine only substitutes it into the skill's own text)`;
+        if (skillCarriesRetiredManifest(s))
+            return SKILL_MANIFEST_RETIRED;
+        for (const key of ["allowedTools", "disallowedTools"]) {
+            if (s[key] !== undefined && !skillToolListOk(s[key]))
+                return `skill.${key} must be an array of strings (permission-rule spellings: a tool name, mcp__<server> / mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**))`;
+        }
+        const unreachable = unreachableSkillToolListEntryOf(s);
+        if (unreachable !== undefined)
+            return describeUnreachableSkillToolListEntry(unreachable);
     }
     return null;
 }
+export const SKILL_MANIFEST_RETIRED = "skill.manifest was retired in core 7.41.0 — a skill's tools are its allowedTools / disallowedTools now (an allow-rule and a deny-rule source for the run the skill is activated in, never a fence); move manifest.allowTools to allowedTools. To fence tools use deny rules (settings.permissions.deny) or a delegated agent's allowTools; to fence write paths use the session rules' allowDirs";
 const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024;
 function mentionableNames(config, catalog) {
@@ -202,7 +212,8 @@ export function createAdmission(ctx) {
                 }
                 const deadMatcher = deadToolMatcherIssue(hooksParsed.config, taskHooksHonored(deps.config) ? "regex" : "literal");
                 if (deadMatcher !== undefined) {
-                    sendError(res, 400, "request.field_invalid", deadMatcher);
+                    const refusal = buildDeadToolMatcherRefusal(deadMatcher);
+                    sendError(res, 400, "request.field_invalid", refusal.message, { field: refusal.field, detail: refusal.detail });
                     return null;
                 }
             }
@@ -360,10 +371,10 @@ export function createAdmission(ctx) {
             return null;
         }
         {
-            const denial = selfOrchestrationDenial({ selfOrchestrationEnabled: deps.config.selfOrchestrationEnabled, requirePrincipal: deps.config.requirePrincipal }, centerEntitlementSourceWired(deps.config));
+            const admission = facts.selfOrchestrationAdmission(deps);
             const wantsSelfOrchestration = body.selfOrchestration === true
                 || parseTaskSettings(body.settings).settings?.ultracode === true;
-            if (denial !== null && wantsSelfOrchestration) {
+            if (!admission.available && wantsSelfOrchestration) {
                 sendError(res, 501, "capability.self_orchestration_required", "self-orchestration is enabled on this worker (SELF_ORCHESTRATION_ENABLED) but it is multi-tenant (REQUIRE_PRINCIPAL) and wires NO per-principal entitlement source, so the engine's allowWorkflows gate — which is tighten-only, meaning an absent resolver leaves it UNGATED — is fail-closed for every principal: no request can ever get the workflow engine here (GET /v1/capabilities reports workflows:false with workflowsGate.denial \"entitlement_resolver_absent\"). Wire a config center (SEMA_REGISTRY_URL + token, not dry-run) to gate it per principal, or set SELF_ORCHESTRATION_ENABLED=false — the honest posture for a worker that cannot grant it. To submit this task without the workflow engine, drop selfOrchestration / settings.ultracode; ultracode's other half (the max thinking tier) is available as reasoningEffort: \"max\"");
                 return null;
             }
@@ -420,6 +431,10 @@ export function createAdmission(ctx) {
                 sendError(res, 400, "request.field_invalid", "limits.budgetStreamCancel is not caller-settable here — the engine default applies (armed whenever a cost budget is present); remove it");
                 return null;
             }
+            if (l.brainCallGuardrailMs !== undefined) {
+                sendError(res, 400, "request.field_invalid", "limits.brainCallGuardrailMs is not caller-settable here — the engine's default wall on a single brain call applies (one hour); remove it");
+                return null;
+            }
             for (const k of ["maxWalltimeMs", "maxOutputTokens", "maxTurns"]) {
                 const v = l[k];
                 if (v !== undefined && (typeof v !== "number" || !Number.isInteger(v) || v < 1)) {
@@ -473,6 +488,13 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.field_conflict", "disableSkills: true means this run installs no skill at all (not the deployment's, not the request's), so it cannot come with a non-empty skills or agents[].skills — send one or the other");
             return null;
         }
+        {
+            const v = body.userInvokedSkills;
+            if (v !== undefined && (!Array.isArray(v) || v.some((n) => typeof n !== "string" || n.length === 0))) {
+                sendError(res, 400, "request.field_invalid", "userInvokedSkills must be an array of non-empty skill-name strings (each one a skill this run carries)");
+                return null;
+            }
+        }
         for (const key of ["excludeTools", "deferTools"]) {
             const v = body[key];
             if (v !== undefined && (!Array.isArray(v) || v.some((n) => typeof n !== "string" || n.length === 0))) {

package/dist/http/approval-sweeps.js

@@ -7,6 +7,8 @@ import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import { hasServiceAuth } from "./dispatch.js";
 import { gatedPrincipal } from "./principal-gate.js";
 import { readinessOf, billableRefusalOf } from "./readiness.js";
+import { readResumeCtx } from "./resume-ctx-read.js";
+import { allowListReadingUnstated } from "./checkpoint-ctx.js";
 const BLOCKED_SCALAR_KEYS = ["errorCode", "blockedBy", "field", "reason", "count", "cap", "index"];
 function blockedScalars(body) {
     const out = {};
@@ -64,17 +66,35 @@ export function createApprovalSweeps(ctx) {
                 return false;
             }
         };
+        const allowListUnservable = async (sessionId) => {
+            const read = await readResumeCtx(cs.getCtx(sessionId));
+            if (read.kind === "corrupt")
+                return false;
+            return read.kind === "ok" && allowListReadingUnstated(read.ctx);
+        };
         let parkedSkipped = 0;
+        const allowListSkipped = [];
         for (const { sessionId } of expired) {
             if (await isParkedOwned(sessionId)) {
                 parkedSkipped += 1;
                 continue;
             }
+            if (await allowListUnservable(sessionId)) {
+                allowListSkipped.push(sessionId);
+                continue;
+            }
             await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", { decidedBy: "sla_timeout" }).then((r) => { if (r.status >= 400)
                 deps.logger?.warn?.("deny_sweep_resume_blocked", { sessionId, status: r.status, ...blockedScalars(r.body) }); }, (e) => deps.logger?.warn?.("deny_sweep_resume_failed", { sessionId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) }));
         }
         if (parkedSkipped > 0)
             deps.logger?.info?.("deny_sweep_parked_skipped", { count: parkedSkipped });
+        if (allowListSkipped.length > 0) {
+            deps.logger?.warn?.("deny_sweep_allow_list_reading_skipped", {
+                count: allowListSkipped.length,
+                sessionIds: allowListSkipped,
+                note: "these expired approvals belong to tasks suspended by a server version that read settings.permissions.allow as a whitelist; this version does not replay them, so the SLA deny cannot be delivered. They stay suspended (session lock held) until the reaper collects them at their terminal time — cancel them (POST /v1/runs/:id/cancel) to release the sessions now",
+            });
+        }
     }
     async function redeemParkedAsk(req) {
         const cs = deps.checkpointStore;

package/dist/http/checkpoint-ctx.d.ts

@@ -0,0 +1,68 @@
+/**
+ * 续跑重建输入(`checkpoint_ctx` 的行体,{@link CheckpointCtx})的**写形**,以及持久化体里 `settings.permissions.allow` 的**读法记号** —— S-1034(7.115.0)。
+ *
+ * ## 病
+ * 7.115.0 把 `settings.permissions.allow` 从「名单」(名单外的工具一律拒)改成「allow 规则」(命中 = 带理由的放行,未命中 = 不表态、照常判)。
+ * 续跑家族重建 spec 时把**持久化的提交体**原样重放进 `resolveSpec`(`resume-legs.ts` 的 `resolveResumeSpec`)——
+ * 一条在 ≤7.114.0 上停驻、体里带非空 `allow` 的行,升级后续跑就被按新读法读:名单外的工具不再被拒。持久面上的静默语义翻转(放宽方向)。
+ * 坏形 `allow`(`Task` / `mcp__figma` / `Bash(npm:*)` …)的旧行则每次续跑都 409、SLA 拒扫腿逐拍重试直到收割 —— 一张本来放不开任何门的停驻被砖化。
+ *
+ * ## 规则(一条;持久数据的「响亮拒 + 一次性迁移」,零双读)
+ * 续跑重放持久化体之前问一句:**体里的 `allow` 在生效(非空数组)而本行没有「按表态读」的记号 ⇒ 拒**。
+ * 行留停驻、字节不动(拒发生在认领之前,run 行、卡、ctx 一个字节都不写);出路 = 作为新任务重提,这条任务若还停驻着先取消(`task_done` 唤醒停驻与 workflow 宿主那条腿没有可取消的 run)。
+ * **没有**「按旧名单语义继续读」的臂:那是第二种读法,正是本规则要消灭的东西。
+ *  · 记号 = ≥7.115.0 写下的行在体里带非空 `allow` 时,ctx 上的 `permissionsAllowReading: "statement"`(闭集一词)。
+ *    写点 = 每一次**新的**持久化写({@link buildCheckpointCtx} 是它们的唯一构造口);续跑腿的写回传的是读进来的那只 ctx(或其展开),记号随行,不重新判。
+ *  · 体里没有 `allow`(或空数组 —— 7.114.0 的名单判据 `acceptedRuleList` 对空数组同样读成「没有名单」)的行不写记号、不受本规则影响。
+ *
+ * ## 判据与 7.114.0 的关系(如实)
+ * 7.114.0 只在三桶整体合法时才读名单;判据这里只看「`allow` 是非空数组」,比 7.114.0 的「名单生效」宽一格(坏桶的行 7.114.0 也不读名单)——
+ * 方向 = 多拒,不会漏拒;而坏桶的体当年就被 fresh 受理门拒在门外,盘上本不该有。
+ *
+ * ## 何时删(一次性迁移,不是长期双读)
+ * 本判据、拒臂、记号写点与 `CheckpointCtx.permissionsAllowReading` 一起删,删除条件 = 所有 ≤7.114.0 停驻的行都已结束或被收割
+ * (停驻行的终局时刻 = 落盘起 `TERMINAL_BACKSTOP_MS`,见 `plugins/checkpoint-store-sql.ts`)之后的那个版本。删的时候记号的读者一起删:
+ * 届时盘上不会再有没记号却带 `allow` 的行,而有记号的行读不读它都一样。
+ */
+import type { CheckpointCtx } from "./route-ctx.js";
+import type { TaskRequestBody } from "./wire-types.js";
+/** 读法记号的闭集(一词):这一行体里的 `settings.permissions.allow` 是按「allow 规则(表态)」写下、也该按它读的。 */
+export declare const PERMISSIONS_ALLOW_READINGS: readonly ["statement"];
+export type PermissionsAllowReading = (typeof PERMISSIONS_ALLOW_READINGS)[number];
+/**
+ * 体里的 `settings.permissions.allow` 是否**在生效**:非空数组(与 7.114.0 名单判据 `acceptedRuleList` 同一个「在」——空数组 = 没有)。
+ * 入参是持久化的 JSON(可能来自任何旧版本),逐层判形,不信型面。
+ */
+export declare function bodyCarriesAllowList(body: TaskRequestBody): boolean;
+/**
+ * 一次**新的**持久化写的 ctx(提交腿 / `POST /v1/runs` 族 / leader worker)—— 写记号的唯一口。
+ *
+ * 调用方是「本进程刚按表态读过这份体」的写点:fresh 提交(受理门按 7.115.0 读过 `allow`),或已经过了续跑拒臂的重放腿
+ * (`startFreshHostTurn` 把宿主的存量体交给 `POST /v1/runs` 同一条链 —— 它在那之前调过 `resolveResumeSpecOrBlocked`,没记号却带 `allow` 的体到不了这里)。
+ * 续跑腿的**写回**不经本函数:它传读进来的 ctx(或其展开),记号随行;在写回口重新判会把一条没记号的旧行「洗」成新行。
+ */
+export declare function buildCheckpointCtx(fields: {
+    body: TaskRequestBody;
+    memoryScope?: string | undefined;
+    unattendedLeg?: true;
+}): CheckpointCtx;
+/**
+ * 本行能否被按 7.115.0 的读法重放:体里 `allow` 在生效而行上没有记号 ⇒ **不能**(`true` = 拒)。
+ * 记号的值不在闭集里(手改 / 将来的写者)⇒ 同样拒:认不得的记号不是证据。
+ */
+export declare function allowListReadingUnstated(ctx: CheckpointCtx): boolean;
+/**
+ * 拒的答复 —— 码与落点照「退役 mode-seed 行」的先例(`checkpoint.unsupported_version`,409,`retriable:true` = 那张卡仍 pending;**不是**「原样重试会成功」)。
+ * 拒在认领之前,所以没有 `taskId`(行没抢到就不造键)。句子说原因(这条任务停在 `allow` 还是名单的版本上)与出路(作为新任务重提,仍停驻的先取消;要「只许这些工具」用会话规则 `toolAllow` / 每请求 `excludeTools`)。
+ *
+ * 🔴 形是给冻结门看的(`api-error-text-freeze` 的 resume 家族收集器):`status: <三位数>, body: { error: "<整句双引号字面>", errorCode: "<码>"`,中间只许有空白。
+ */
+export declare function allowListReadingRefusal(): {
+    status: number;
+    body: {
+        error: string;
+        errorCode: string;
+        retriable: true;
+    };
+};
+//# sourceMappingURL=checkpoint-ctx.d.ts.map

package/dist/http/checkpoint-ctx.js

@@ -0,0 +1,36 @@
+export const PERMISSIONS_ALLOW_READINGS = ["statement"];
+export function bodyCarriesAllowList(body) {
+    const settings = body?.settings;
+    if (settings === null || typeof settings !== "object" || Array.isArray(settings))
+        return false;
+    const permissions = settings["permissions"];
+    if (permissions === null || typeof permissions !== "object" || Array.isArray(permissions))
+        return false;
+    const allow = permissions["allow"];
+    return Array.isArray(allow) && allow.length > 0;
+}
+export function buildCheckpointCtx(fields) {
+    return {
+        body: fields.body,
+        ...(fields.memoryScope !== undefined ? { memoryScope: fields.memoryScope } : {}),
+        ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
+        ...(bodyCarriesAllowList(fields.body) ? { permissionsAllowReading: "statement" } : {}),
+    };
+}
+export function allowListReadingUnstated(ctx) {
+    if (!bodyCarriesAllowList(ctx.body))
+        return false;
+    const reading = ctx.permissionsAllowReading;
+    return !(typeof reading === "string" && PERMISSIONS_ALLOW_READINGS.includes(reading));
+}
+export function allowListReadingRefusal() {
+    return {
+        status: 409,
+        body: {
+            error: "this task was suspended by an earlier server version, which read settings.permissions.allow as a whitelist (every tool not on the list was refused); this version reads that list as a statement that the named tools are allowed, not as a whitelist, so continuing would give the task more tools than it was submitted with. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel). To allow only certain tools, use the session rules' toolAllow (PUT /v1/sessions/:id/policy) or the request's excludeTools.",
+            errorCode: "checkpoint.unsupported_version",
+            retriable: true,
+        },
+    };
+}
+//# sourceMappingURL=checkpoint-ctx.js.map

package/dist/http/durable-run-leg.js

@@ -8,6 +8,7 @@ import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
+import { buildCheckpointCtx } from "./checkpoint-ctx.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
@@ -31,7 +32,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
     commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
     if (deps.checkpointStore) {
-        await deps.checkpointStore.putCtx(sessionId, { body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope });
+        await deps.checkpointStore.putCtx(sessionId, buildCheckpointCtx({ body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope }));
     }
     const anchorOwner = args.prepared.auth?.principal ?? null;
     const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);

package/dist/http/principal-gate.d.ts

@@ -92,6 +92,9 @@ export declare function runOwnerReadable(principal: string | undefined, owner: s
  *  and two more hand-inlined copies sat in approvals-assistant — a future hardening of this judgment would have
  *  missed them. All call sites now consume THIS function; do not re-introduce a sibling. */
 export declare function explicitOperatorOk(principal: string | undefined, operatorPrincipals: readonly string[]): boolean;
+/** operator 面族在「名单为空」这一形上的**唯一**拒发口:事实 `operatorLane`(`capability-facts.ts`)为假 ⇒ 这一面对任何
+ *  身份都打不通 = 这台部署上不可用 ⇒ 501,不是鉴权拒(403 只留给「名单非空而你不在名单上」)。能力位读的是同一只事实。 */
+export declare function sendOperatorPrincipalsRequired(res: ServerResponse): void;
 /** May `principal` act as an OPERATOR on the F4 approval queue? Empty `operatorPrincipals` = legacy
  *  behavior (the shared service token IS the operator boundary → everyone authenticated is an operator).
  *  Otherwise only listed principals are operators. */

package/dist/http/principal-gate.js

@@ -95,6 +95,9 @@ export function runOwnerReadable(principal, owner, config) {
 export function explicitOperatorOk(principal, operatorPrincipals) {
     return operatorPrincipals.length > 0 && principal !== undefined && operatorPrincipals.includes(principal);
 }
+export function sendOperatorPrincipalsRequired(res) {
+    sendError(res, 501, "capability.operator_principals_required", "this endpoint is operator-only and OPERATOR_PRINCIPALS is empty, so no caller can be an operator on this deployment; configure OPERATOR_PRINCIPALS to enable it");
+}
 export function isOperator(principal, operatorPrincipals) {
     if (operatorPrincipals.length === 0)
         return true;

package/dist/http/resume-legs.js

@@ -42,6 +42,7 @@ import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
+import { allowListReadingRefusal, allowListReadingUnstated } from "./checkpoint-ctx.js";
 import { httpErrorCode } from "./send.js";
 function isCheckpointReopenedFailure(r) {
     const code = failureCodeOf(r.terminal);
@@ -65,6 +66,7 @@ const WORKER_SWAP_REDEEMABLE = {
     read_face_damaged: false,
     read_face_forged: false,
     write_face_damaged: false,
+    skill_grants_damaged: false,
     constraint_chain_missing: false,
 };
 function checkpointRowRedeemableElsewhere(reason) {
@@ -120,13 +122,21 @@ export function checkpointErrorDisposition(e) {
 const CHECKPOINT_ERROR_FIELD_ROLE = {
     boundCallId: "binding",
     boundInputHash: "binding",
+    boundGrantDigest: "regrant",
     answer: "answer",
     hostDecision: "outcome_cell",
     approver: "outcome_cell",
     taskConfig: "config",
     inheritedGate: "config",
 };
-const NON_BINDING_INVALID_OUTCOME_FIELDS = new Set(Object.keys(CHECKPOINT_ERROR_FIELD_ROLE).filter((f) => CHECKPOINT_ERROR_FIELD_ROLE[f] === "outcome_cell"));
+const ROLE_MINTS_RESUME_OUTCOME_INVALID = {
+    binding: false,
+    answer: false,
+    outcome_cell: true,
+    regrant: true,
+    config: false,
+};
+const NON_BINDING_INVALID_OUTCOME_FIELDS = new Set(Object.keys(CHECKPOINT_ERROR_FIELD_ROLE).filter((f) => ROLE_MINTS_RESUME_OUTCOME_INVALID[CHECKPOINT_ERROR_FIELD_ROLE[f]]));
 function notResumableAnswer() {
     return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
 }
@@ -398,7 +408,13 @@ export function createResumeLegs(ctx) {
         });
         return { spec, engineNotices };
     };
+    const refuseAllowListReading = (sessionId) => {
+        deps.logger?.warn?.("resume_refused_allow_list_reading", { sessionId, note: "this session's stored request carries settings.permissions.allow written by a server that read it as a whitelist; it is not replayed under the current reading — the task stays suspended until someone cancels it" });
+        return allowListReadingRefusal();
+    };
     const resolveResumeSpecOrBlocked = async (ctx, req, auth) => {
+        if (allowListReadingUnstated(ctx))
+            return { ok: false, answer: refuseAllowListReading(auth.sessionId) };
         try {
             const { spec, engineNotices } = await resolveResumeSpec(ctx, req, auth);
             return { ok: true, spec, engineNotices };
@@ -1332,6 +1348,8 @@ export function createResumeLegs(ctx) {
             return refuse(resumeCtxCorruptAnswer(ctxRead.where));
         if (ctxRead.kind === "absent")
             return refuse({ status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } });
+        if (allowListReadingUnstated(ctxRead.ctx))
+            return refuse(refuseAllowListReading(sessionId));
         return { ok: true, prepared: { sessionId, token, cp, ctx: ctxRead.ctx } };
     }
     async function drivePlanReview(prepared, decision, editedPlan, reason, req, acceptEarly, permissionModeAfter) {

package/dist/http/retired-skill-manifest.d.ts

@@ -0,0 +1,23 @@
+/**
+ * 技能上已退役的 `manifest` 键 —— 「一条技能还带它」的**唯一判据**(core 7.41.0 起 `SkillSpec.manifest` 退役,零别名)。
+ *
+ * 两个读者,同一句话:
+ *  · 提交口的顶层技能门(`admission.ts` 的 `validateUserSkills`):带它(任何值)⇒ 点名拒;
+ *  · 随包排空脚本(`scripts/drain-check-local.mjs` 的 `retired-skill-manifest` 判据,经脚本隔壁的编译产物 `dist/http/retired-skill-manifest.js` 取):
+ *    升级前停驻、持久化的提交体里仍带它的行,升级后续跑会被引擎按名拒(顶层 `skills[]`)或丢掉那只子代定义(`agents[].skills[]`),运维升级前要能数出来。
+ *
+ * 「带」= 键在场、值是什么都算(`null` / 空对象同样是「我带了 manifest」)—— 与引擎的退役键表读法同形(`RETIRED_TASK_SPEC_KEYS["skills[].manifest"]`:`at !== undefined`)。
+ * 入参是持久化的 JSON(可能来自任何旧版本),逐层判形,不信型面。
+ *
+ * 🔴 本模块**零运行期 import**(随包脚本要在没有服务其余部分的位置加载它,与 `checkpoint-ctx.js` 同一姿势)—— 往里加 import 要先想想脚本那一头。
+ */
+/** 一条技能(提交体 `skills[]` / `agents[].skills[]` 的元素)是否还带退役的 `manifest` 键。 */
+export declare function skillCarriesRetiredManifest(skill: unknown): boolean;
+/** 持久化体里哪一层带着它:顶层 `skills[]`,或某只子代定义的 `agents[].skills[]`。 */
+export type RetiredSkillManifestLayer = "skills" | "agents.skills";
+/**
+ * 一份提交体(持久化的 JSON)里有没有技能还带 `manifest`,有则说是哪一层(两层都有 ⇒ 取顶层,先说引擎会响亮拒的那一层);都没有 ⇒ `undefined`。
+ * 顶层不是数组 / 子代不是对象 / 子代的 `skills` 不是数组 ⇒ 该处不算(受理门从不放进这种形;盘上若有也不是「带 manifest」)。
+ */
+export declare function retiredSkillManifestLayerOf(body: unknown): RetiredSkillManifestLayer | undefined;
+//# sourceMappingURL=retired-skill-manifest.d.ts.map

package/dist/http/retired-skill-manifest.js

@@ -0,0 +1,22 @@
+export function skillCarriesRetiredManifest(skill) {
+    return skill !== null && typeof skill === "object" && !Array.isArray(skill) && Object.hasOwn(skill, "manifest");
+}
+const isArray = (v) => Array.isArray(v);
+export function retiredSkillManifestLayerOf(body) {
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return undefined;
+    const { skills, agents } = body;
+    if (isArray(skills) && skills.some(skillCarriesRetiredManifest))
+        return "skills";
+    if (isArray(agents)) {
+        for (const agent of agents) {
+            if (agent === null || typeof agent !== "object" || Array.isArray(agent))
+                continue;
+            const own = agent.skills;
+            if (isArray(own) && own.some(skillCarriesRetiredManifest))
+                return "agents.skills";
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=retired-skill-manifest.js.map

package/dist/http/route-ctx.d.ts

@@ -161,6 +161,13 @@ export interface CheckpointCtx {
      * 传原 ctx / 其展开 ⇒ 标随行。缺席 = 不是无人值守腿(HTTP 提交腿;7.106.0 前落盘的行 —— 那时这些腿不铸模式,checkpoint 里也没有)。
      */
     unattendedLeg?: true;
+    /**
+     * 🔴 S-1034(7.115.0)—— 体里 `settings.permissions.allow` 的**读法记号**:在场 = 这一行是 ≥7.115.0 写下的、体里带非空 `allow`,
+     * 它按「allow 规则(表态)」写、也按它读。**服务端写、不来自请求体**(与 {@link unattendedLeg} 同为 `body` 的兄弟键)。
+     * 缺席而体里带非空 `allow` = ≤7.114.0 停驻的行(那时 `allow` 是名单)⇒ 续跑腿响亮拒、行字节不动(规则与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注)。
+     * 写点只有 `buildCheckpointCtx`(同模块;新的持久化写);续跑腿的写回传原 ctx / 其展开 ⇒ 记号随行。体里没有 `allow` 的行不写它。
+     */
+    permissionsAllowReading?: import("./checkpoint-ctx.js").PermissionsAllowReading;
 }
 /** B4①(命名化):`driveResumeIntoRunLog` 的入参形(resume 家族共用)——原为 9 成员内联匿名对象。 */
 export interface DriveResumeArgs {

package/dist/http/route-table.d.ts

@@ -84,8 +84,9 @@ export interface RouteRow {
      *  `test/route-shape-roster.test.ts` 层E 的能力位词干也取自这里 —— 域的身份是声明出来的,
      *  不是从函数名反推的。函数真名与它的一致性由 `route-order-freeze` 自检格钉住。 */
     readonly label: string;
-    /** **挂载条件**(只有真有条件的行才写):缺席 = 恒挂载。域头的合取式就是挂载条件 —— 阀门没开 ⇒
-     *  请求落到分派器尾的全局 404(**诚实缺席,不是 501**;判据全文在各域模块头注)。 */
+    /** **挂载条件**(只有真有条件的行才写):缺席 = 恒挂载。今天只剩 diagnostics 一行(它没有能力位,缺席形只出现在测试夹具)。
+     *  「这台部署上不可用」的面**不**用它:那些面恒挂载、域头按能力事实(`src/capability-facts.ts`)答 501,与能力位同一只函数
+     *  —— 未挂载落全局 404 会让「这台没有这一面」与「URL 写错了」同码,也违背契约「false ⇒ 501」。 */
     readonly enabled?: (deps: FlatServiceDeps) => boolean;
 }
 export declare const ROUTES: readonly RouteRow[];

package/dist/http/route-table.js

@@ -52,9 +52,9 @@ export const ROUTES = [
     row({ handler: handleRunMemoryCapture, decls: RUN_MEMORY_CAPTURE_ROUTES, position: "post-credential", label: "run-memory-capture" }),
     row({ handler: handleMcpReconnect, decls: MCP_RECONNECT_ROUTES, position: "post-credential", label: "mcp-reconnect" }),
     row({ handler: handleBackground, decls: BACKGROUND_ROUTES, position: "post-credential", label: "background" }),
-    row({ handler: handleLeader, decls: LEADER_ROUTES, position: "post-credential", label: "leader", enabled: (deps) => Boolean(deps.leaderEndpoint) }),
+    row({ handler: handleLeader, decls: LEADER_ROUTES, position: "post-credential", label: "leader" }),
     row({ handler: handleImages, decls: IMAGES_ROUTES, position: "post-credential", label: "images" }),
-    row({ handler: handleApprovalsAssistant, decls: APPROVALS_ASSISTANT_ROUTES, position: "post-credential", label: "approvals-assistant", enabled: (deps) => Boolean(deps.checkpointStore) }),
+    row({ handler: handleApprovalsAssistant, decls: APPROVALS_ASSISTANT_ROUTES, position: "post-credential", label: "approvals-assistant" }),
     row({ handler: handleObservability, decls: OBSERVABILITY_ROUTES, position: "post-credential", label: "observability" }),
     row({ handler: handleDiagnostics, decls: DIAGNOSTICS_ROUTES, position: "post-credential", label: "diagnostics", enabled: (deps) => Boolean(deps.staticWiring) }),
     row({ handler: handleAdoption, decls: ADOPTION_ROUTES, position: "post-credential", label: "adoption" }),
@@ -62,15 +62,15 @@ export const ROUTES = [
     row({ handler: handleAdminDrain, decls: ADMIN_DRAIN_ROUTES, position: "post-credential", label: "admin-drain" }),
     row({ handler: handleDevices, decls: DEVICES_ROUTES, position: "post-credential", label: "devices" }),
     row({ handler: handleAdminConfigRefresh, decls: ADMIN_CONFIG_REFRESH_ROUTES, position: "post-credential", label: "admin-config-refresh" }),
-    row({ handler: handleConfigCatalog, decls: CONFIG_CATALOG_ROUTES, position: "post-credential", label: "config-catalog", enabled: (deps) => deps.config.configCatalogEnabled === true }),
+    row({ handler: handleConfigCatalog, decls: CONFIG_CATALOG_ROUTES, position: "post-credential", label: "config-catalog" }),
     row({ handler: handleMemoryOptOut, decls: MEMORY_OPTOUT_ROUTES, position: "post-credential", label: "memory-opt-out" }),
     row({ handler: handleMemoryPolicy, decls: MEMORY_POLICY_ROUTES, position: "post-credential", label: "memory-policy" }),
     row({ handler: handleMemoryBundle, decls: MEMORY_BUNDLE_ROUTES, position: "post-credential", label: "memory-bundle" }),
     row({ handler: handleMemoryCompliance, decls: MEMORY_COMPLIANCE_ROUTES, position: "post-credential", label: "memory-compliance" }),
     row({ handler: handleMemoryOrigin, decls: MEMORY_ORIGIN_ROUTES, position: "post-credential", label: "memory-origin" }),
-    row({ handler: handleMemoryConsolidation, decls: MEMORY_CONSOLIDATION_ROUTES, position: "post-credential", label: "memory-consolidation", enabled: (deps) => Boolean(deps.memoryConsolidation) }),
+    row({ handler: handleMemoryConsolidation, decls: MEMORY_CONSOLIDATION_ROUTES, position: "post-credential", label: "memory-consolidation" }),
     row({ handler: handleRules, decls: RULES_ROUTES, position: "post-credential", label: "rules" }),
-    row({ handler: handleSharedMemory, decls: SHARED_MEMORY_ROUTES, position: "post-credential", label: "shared-memory", enabled: (deps) => Boolean(deps.sharedMemoryStore) && Boolean(deps.orgMemoryDirectory) }),
+    row({ handler: handleSharedMemory, decls: SHARED_MEMORY_ROUTES, position: "post-credential", label: "shared-memory" }),
     row({ handler: handleSessionsList, decls: SESSIONS_LIST_ROUTES, position: "post-credential", label: "sessions-list" }),
     row({ handler: handleAgentRoster, decls: AGENT_ROSTER_ROUTES, position: "post-credential", label: "agent-roster" }),
     row({ handler: handleSessions, decls: SESSIONS_ROUTES, position: "post-credential", label: "sessions" }),

package/dist/http/routes/a2a-serve.d.ts

@@ -1,5 +1,5 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { type A2ATaskState } from "@sema-agent/core";
+import type { A2ATaskState } from "@sema-agent/core";
 import type { A2aServeConfig } from "../../config-types.js";
 import { type RunRecord } from "../../plugins/store-contracts.js";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
@@ -69,8 +69,6 @@ export declare function a2aStateForRun(run: Pick<RunRecord, "status" | "errorCod
  * `capabilities.a2aServe` 的子串,好让 `route-shape-roster` 层E 如实认出它们。
  */
 export declare function handleA2a(req: IncomingMessage, res: ServerResponse, match: RouteMatch<A2aRpcRouteId>, ctx: RouteCtx): Promise<void>;
-/** 九词闭集的对外可见锚(测试用它证明我们只发闭集词;也让「加一个自造词」在这里就被看见)。 */
-export declare const A2A_SERVE_TASK_STATES: readonly A2ATaskState[];
 export declare const A2A_SERVE_ROUTES: readonly [{
     readonly id: "a2a-agent-card";
     readonly path: "/.well-known/agent-card.json";

package/dist/http/routes/a2a-serve.js

@@ -1,7 +1,6 @@
 import { persistedPlaneOf } from "../../terminal.js";
 import { createHash } from "node:crypto";
 import { memoRedactedRead, redactErrorMessage } from "../../observability/run-terminal.js";
-import { A2A_TASK_STATES } from "@sema-agent/core";
 import { isParkedRunStatus, isTerminalRunStatus } from "../../plugins/store-contracts.js";
 import { HttpError } from "../../security.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
@@ -9,6 +8,7 @@ import { sendJson, sendError } from "../send.js";
 import { readinessOf, billableRefusalOf, sendBillableRefusal } from "../readiness.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 import { createDurableRun } from "./runs.js";
 export const A2A_PROTOCOL_VERSION = "1.0";
 export const A2A_VERSION_HEADER = "a2a-version";
@@ -26,13 +26,13 @@ export async function handleA2aServe(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
         case "a2a-agent-card": {
-            const serve = deps.config.a2aServe;
-            if (!serve) {
+            const peer = facts.a2aServe(deps);
+            if (!peer.available) {
                 sendError(res, 404, "not_found.route", "not found");
                 return;
             }
             res.setHeader(A2A_VERSION_HEADER, A2A_PROTOCOL_VERSION);
-            sendJson(res, 200, buildAgentCard(serve));
+            sendJson(res, 200, buildAgentCard(peer.serve));
             return;
         }
         default:
@@ -45,10 +45,8 @@ const JSONRPC_METHOD_NOT_FOUND = -32601;
 const JSONRPC_INVALID_PARAMS = -32602;
 const JSONRPC_INTERNAL_ERROR = -32603;
 const A2A_TASK_NOT_FOUND = -32001;
-const A2A_UNSUPPORTED_OPERATION = -32004;
 const A2A_CONTENT_TYPE_NOT_SUPPORTED = -32005;
 export const A2A_TASK_NOT_FOUND_MESSAGE = "task not found";
-const A2A_NO_RUN_STORE_MESSAGE = "this deployment has no durable run store, so A2A tasks cannot be created or polled (set DB_BACKEND=mysql|pg|local)";
 const A2A_STATE_BY_RUN_STATUS = {
     running: "working",
     completed: "completed",
@@ -189,11 +187,8 @@ function readBlocking(params) {
 function isStaleRun(run, runStaleSec) {
     return run.status === "running" && Date.now() - new Date(run.updatedAt).getTime() > runStaleSec * 1000;
 }
-async function waitForRun(ctx, res, taskId, budgetMs) {
+async function waitForRun(ctx, store, res, taskId, budgetMs) {
     const { deps } = ctx;
-    const store = deps.runStore;
-    if (!store)
-        return null;
     const deadline = Date.now() + budgetMs;
     let last = null;
     for (;;) {
@@ -220,7 +215,7 @@ async function waitForRun(ctx, res, taskId, budgetMs) {
         });
     }
 }
-async function handleMessageSend({ req, res, ctx, params, serve }) {
+async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
     const { deps } = ctx;
     const { rateLimited, quotaExceeded } = ctx.helpers;
     const message = asRecord(params.message, "params.message");
@@ -233,8 +228,6 @@ async function handleMessageSend({ req, res, ctx, params, serve }) {
     const skillId = skill?.id;
     const scenario = skill?.scenario;
     const blocking = readBlocking(params);
-    if (!deps.runStore)
-        throw new RpcError(A2A_UNSUPPORTED_OPERATION, A2A_NO_RUN_STORE_MESSAGE);
     const idemScope = `${ctx.req.source ?? ""}\x1f${gatedPrincipal(req, deps.config) ?? ""}`;
     const fingerprint = createHash("sha256")
         .update(messageId).update("\x1f")
@@ -249,7 +242,7 @@ async function handleMessageSend({ req, res, ctx, params, serve }) {
         ...(contextId !== undefined ? { sessionId: contextId } : {}),
         ...(scenario !== undefined ? { scenario } : {}),
     };
-    const replay = await deps.runStore.getRun(body.taskId).catch(() => undefined);
+    const replay = await runStore.getRun(body.taskId).catch(() => undefined);
     if (replay && (replay.owner === null || replay.owner === gatedPrincipal(req, deps.config))) {
         return taskFromRun(replay, isStaleRun(replay, deps.config.runStaleSec));
     }
@@ -281,7 +274,7 @@ async function handleMessageSend({ req, res, ctx, params, serve }) {
     }
     const taskId = receiptBody.taskId;
     const sessionId = receiptBody.sessionId;
-    const run = await waitForRun(ctx, res, taskId, blocking ? serve.blockingWaitMs : 0);
+    const run = await waitForRun(ctx, runStore, res, taskId, blocking ? serve.blockingWaitMs : 0);
     if (run)
         return taskFromRun(run, isStaleRun(run, deps.config.runStaleSec));
     return {
@@ -299,12 +292,10 @@ function durableIdempotencyTaskId(scope, messageId) {
     const hex = b.toString("hex");
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
-async function handleTasksGet({ req, ctx, params }) {
+async function handleTasksGet({ req, ctx, params, runStore }) {
     const { deps } = ctx;
     const id = asNonEmptyString(params.id, "params.id", MAX_TASK_ID_CHARS);
-    if (!deps.runStore)
-        throw new RpcError(A2A_UNSUPPORTED_OPERATION, A2A_NO_RUN_STORE_MESSAGE);
-    const run = await deps.runStore.getRun(id);
+    const run = await runStore.getRun(id);
     if (!run)
         throw new RpcError(A2A_TASK_NOT_FOUND, A2A_TASK_NOT_FOUND_MESSAGE);
     if (run.owner !== null && gatedPrincipal(req, deps.config) !== run.owner)
@@ -323,11 +314,12 @@ export async function handleA2a(req, res, match, ctx) {
         default:
             return assertNever(match.decl.id);
     }
-    const serve = deps.config.a2aServe;
-    if (!serve) {
+    const peer = facts.a2aServe(deps);
+    if (!peer.available) {
         sendError(res, 404, "not_found.route", "not found");
         return;
     }
+    const { serve, runStore } = peer;
     const requestedVersion = req.headers[A2A_VERSION_HEADER];
     res.setHeader(A2A_VERSION_HEADER, A2A_PROTOCOL_VERSION);
     if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
@@ -373,7 +365,7 @@ export async function handleA2a(req, res, match, ctx) {
     }
     deps.logger?.debug?.("a2a_serve_rpc", { method, ...(typeof requestedVersion === "string" ? { requestedVersion: requestedVersion.slice(0, 32) } : {}) });
     try {
-        const result = await handler({ req, res, ctx, params: params, serve });
+        const result = await handler({ req, res, ctx, params: params, serve, runStore });
         if (result === undefined) {
             deps.metrics?.inc("a2a_serve_rpc_total", { method, outcome: "refused" });
             return;
@@ -396,7 +388,6 @@ export async function handleA2a(req, res, match, ctx) {
 function sendRpc(res, body) {
     sendJson(res, 200, body);
 }
-export const A2A_SERVE_TASK_STATES = A2A_TASK_STATES;
 export const A2A_SERVE_ROUTES = [
     { id: "a2a-agent-card", path: "/.well-known/agent-card.json", methods: ["GET"] },
 ];

package/dist/http/routes/admin-config-refresh.js

@@ -1,8 +1,9 @@
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
+import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
 export const ADMIN_CONFIG_REFRESH_PATH = "/v1/admin/config/refresh";
-const OPERATOR_ONLY_MESSAGE = "config refresh is operator-only: the caller principal is not in OPERATOR_PRINCIPALS (an empty list means NO one is an operator — configure it to enable this endpoint)";
+const OPERATOR_ONLY_MESSAGE = "config refresh is operator-only: the caller principal is not in OPERATOR_PRINCIPALS";
 export async function handleAdminConfigRefresh(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
@@ -12,6 +13,10 @@ export async function handleAdminConfigRefresh(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
+            if (!facts.operatorLane(deps).available) {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
             if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
                 sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
                 return;