@sema-agent/server 7.114.0 → 7.116.0

package/dist/http/routes/config-catalog.d.ts

@@ -6,17 +6,16 @@
  * 人肉汇编必然漂移。目录本体(逐键登记 + 实算)在 `src/config-catalog.ts`(D1 双向对账门钉住完备性),
  * 本文件只做门与投影。
  *
- * 门序 = `POST /v1/admin/config/refresh` 逐字同族(operator lane):身份 → 授权 → 应答;billable=false,
+ * 门序 = operator 面口径:身份 → 能力(事实 `configCatalog`,501)→ 授权 → 应答;billable=false,
  * 刻意不吃 drain / roster-pending 两道 503(排障读面在停机窗里恰恰要打得通)。
  *
  * 🔴 鉴权 = `explicitOperatorOk`(空名单=谁都不是)——设计稿 §0.5 点名**禁** `isOperator` 那个
  * 「空名单=人人都是」的 fail-open 谓词:本面是部署事实外泄口(env 在场性/后端形态/限额值),
  * 单用户形也不放宽。
  *
- * 🔴 旋钮 `CONFIG_CATALOG_ENABLED=false` ⇒ **本域不认领**(装配器尾部 404 `not_found.route`)——
- * 与 memory-consolidation 阀门同判:旋钮没开是一句运维表态(合规部署不想让部署事实上 wire),
- * 不是部署能力缺失,404 的动作是「去把旋钮打开」,501 会指去一条修不好的路。能力位 `configCatalog`
- * 与本判据同源(capabilities.ts,两项合取)。
+ * 🔴 旋钮 `CONFIG_CATALOG_ENABLED=false` / operator 名单空 ⇒ 501(事实 `configCatalog`,与能力位同一只函数):
+ * 旋钮关 = `feature.config_catalog_disabled`(合规部署不想让部署事实上 wire 的表态;「去开旋钮」由码与句承担),
+ * 名单空 = `capability.operator_principals_required`。HTTP 上「这台部署上不可用」只有 501 一种答。
  *
  * 🔴 secret 纪律:值的裁剪在 catalog 构建层(secret=在场位、opaque=在场位+长度、url=剥 userinfo),
  * 本文件不再碰值 —— 一处裁剪,机器钉 = test/config-catalog.test.ts 的响应体 canary 扫描格。

package/dist/http/routes/config-catalog.js

@@ -1,11 +1,12 @@
 import { DOMAINS } from "@sema-agent/settings-schema";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 import { buildRetiredEnvWire, configKnobTable } from "../../config.js";
 import { buildConfigCatalog } from "../../config-catalog.js";
 export const CONFIG_CATALOG_PATH = "/v1/config/catalog";
-const OPERATOR_ONLY_MESSAGE = "the config catalog is operator-only: the caller principal is not in OPERATOR_PRINCIPALS (an empty list means NO one is an operator — configure it to enable this endpoint)";
+const OPERATOR_ONLY_MESSAGE = "the config catalog is operator-only: the caller principal is not in OPERATOR_PRINCIPALS";
 export async function handleConfigCatalog(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
@@ -15,6 +16,19 @@ export async function handleConfigCatalog(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
+            const fact = facts.configCatalog(deps);
+            if (!fact.available) {
+                switch (fact.why) {
+                    case "config_catalog_disabled":
+                        sendError(res, 501, "feature.config_catalog_disabled", "the config catalog is switched off on this deployment (CONFIG_CATALOG_ENABLED=false)");
+                        return;
+                    case "operator_principals_empty":
+                        sendOperatorPrincipalsRequired(res);
+                        return;
+                    default:
+                        return assertNever(fact.why);
+                }
+            }
             if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
                 sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
                 return;

package/dist/http/routes/devices.js

@@ -1,6 +1,7 @@
 import { sendError, sendJson } from "../send.js";
 import { explicitOperatorOk, gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 import { DEVICE_PLATFORM_OS, DEVICE_PUBKEY_MAX_BYTES, DEVICE_TEXT_LIMITS, assertDeviceIdShape, assertDevicePubkeyShape, assertRootSessionIdShape, sameDeviceOwner, } from "../../device-store.js";
 import { DEFAULT_ENROLL_TOKEN_TTL_SEC } from "../../device-enrollment.js";
 import { deviceOwnerDomainOf } from "../device-placement.js";
@@ -133,13 +134,22 @@ export async function handleDevices(req, res, match, ctx) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
-    const store = deps.deviceStore;
-    const hub = deps.deviceHub;
-    const enrollment = deps.deviceEnrollment;
-    if (!store || !hub || !enrollment) {
-        sendError(res, 501, "capability.device_lane_required", DEVICE_LANE_REQUIRED_MESSAGE);
-        return;
+    const lane = facts.deviceManagement(deps);
+    if (!lane.available) {
+        switch (lane.why) {
+            case "device_hub_absent":
+            case "device_store_absent":
+            case "device_enrollment_absent":
+                sendError(res, 501, "capability.device_lane_required", DEVICE_LANE_REQUIRED_MESSAGE);
+                return;
+            case "run_store_absent":
+                sendError(res, 501, "capability.run_store_required", "device rebind needs the run store to judge the no-active-run door (a durable, cross-replica criterion) — this deployment has no run store wired");
+                return;
+            default:
+                return assertNever(lane.why);
+        }
     }
+    const { store, hub, enrollment, runStore } = lane;
     const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
     const domain = deviceOwnerDomainOf(req, deps.config);
     if (match.decl.id === "devices-list") {
@@ -293,11 +303,7 @@ export async function handleDevices(req, res, match, ctx) {
         sendDeviceNotFound(res);
         return;
     }
-    if (!deps.runStore) {
-        sendError(res, 501, "capability.run_store_required", "device rebind needs the run store to judge the no-active-run door (a durable, cross-replica criterion) — this deployment has no run store wired");
-        return;
-    }
-    const activeTaskId = await deps.runStore.getActiveTaskId(rootSessionId);
+    const activeTaskId = await runStore.getActiveTaskId(rootSessionId);
     if (activeTaskId) {
         sendError(res, 409, "device.rebind_active_run", "this session has a non-terminal run — rebinding now would leave in-flight work addressed at another workspace; cancel the run (or let it finish), then retry", { activeTaskId });
         return;

package/dist/http/routes/diagnostics.d.ts

@@ -32,6 +32,9 @@ export interface ServerWiringGates {
     streamAskWindowMs: PostureKnobReading<number>;
     sessionAutoTitle: PostureKnobReading<boolean>;
     checkpointStore: boolean;
+    /** 7.115.0:运维的 allow 规则(`APPROVAL_GRANT`)原样 —— 空表 = 旋钮未设。规则名是工具名不是秘密,所以本面给全名单(条数 = 长度);
+     *  本位**只**在运维面(operator-only,门在路由上),不进 `/v1/capabilities` 的客户端能力位:它说的是部署替谁表了态,不是调用方能用什么。 */
+    approvalGrant: readonly string[];
 }
 /** `buildServerWiringGates` 的入参 = 三个谓词各自的**真输入**(不接受已算好的布尔:那样这里读到的就
  *  不再是装配现场的事实,而是别处算完可能已漂的复述)。 */
@@ -49,6 +52,8 @@ export interface ServerWiringGateInput {
     streamAskWindowMsSource: PostureSource;
     sessionAutoTitle: boolean;
     sessionAutoTitleSource: PostureSource;
+    /** 7.115.0:`config.approvalGrant` 本身(读面不重算)。 */
+    approvalGrant: readonly string[];
 }
 /** 纯数据产物(`build*`):三个门的当前读数。`streamApproval` 走**单一谓词**
  *  `resolveStreamApprovalGate` —— 与 `/v1/capabilities` 的 `streamApproval` 位、与回决口的 501 门同一个

package/dist/http/routes/diagnostics.js

@@ -4,7 +4,8 @@ import { projectExecutionLaneCapability } from "../../capabilities/execution-lan
 import { readOutboundWiring } from "../../outbound-dispatcher.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, isLoopbackAddress, verifiedIdentitySource } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, isLoopbackAddress, sendOperatorPrincipalsRequired, verifiedIdentitySource } from "../principal-gate.js";
+import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
 export function buildServerWiringGates(input) {
     const gate = resolveStreamApprovalGate({
@@ -35,6 +36,7 @@ export function buildServerWiringGates(input) {
             postureMeaning: "this knob has no posture arm — its default is the same on every deployment shape",
         }),
         checkpointStore: input.checkpointStore !== undefined,
+        approvalGrant: [...input.approvalGrant],
     };
 }
 export function buildStaticWiringAudit(facts) {
@@ -86,6 +88,10 @@ export async function handleDiagnostics(req, res, match, ctx) {
     switch (match.decl.id) {
         case "diagnostics-wiring": {
             if (deps.config.operatorPrincipals.length > 0 || deps.config.requirePrincipal) {
+                if (!facts.operatorLane(deps).available) {
+                    sendOperatorPrincipalsRequired(res);
+                    return;
+                }
                 const principal = gatedPrincipal(req, deps.config);
                 if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
                     sendError(res, 403, "auth.operator_only", "wiring diagnostics are operator-only on a multi-tenant worker");
@@ -121,6 +127,7 @@ export async function handleDiagnostics(req, res, match, ctx) {
                     streamAskWindowMsSource: deps.config.streamAskWindowMsSource,
                     sessionAutoTitle: deps.config.sessionAutoTitle === true,
                     sessionAutoTitleSource: deps.config.sessionAutoTitleSource,
+                    approvalGrant: deps.config.approvalGrant,
                 }),
             });
             return;

package/dist/http/routes/fleet.js

@@ -4,12 +4,14 @@ import { taskNotificationFoldKey } from "../../orchestration/workflow-completion
 import { sendJson, sendError, sseHeaders } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export async function handleFleet(req, res, match, ctx) {
     const { deps } = ctx;
     const { sessionOwnerScope } = ctx.helpers;
     switch (match.decl.id) {
         case "fleet-stream": {
-            if (!deps.fleetBus) {
+            const fleet = facts.fleetStream(deps);
+            if (!fleet.available) {
                 sendError(res, 501, "capability.self_orchestration_required", "fleet stream requires self-orchestration / fleet wiring");
                 return;
             }
@@ -22,7 +24,7 @@ export async function handleFleet(req, res, match, ctx) {
             const fleetParams = new URLSearchParams(match.search);
             const callerSession = fleetParams.get("session");
             const observeOnly = fleetParams.get("observe") === "1";
-            await streamFleet(req, res, deps.fleetBus, fleetWide ? null : (principal ?? "default"), callerSession || null, observeOnly ? undefined : deps.workflowCompletionInbox, { store: deps.workflowRunStore, scope: fleetWide ? null : (principal ?? "default"), pullScope: principal ?? "default", ready: deps.fleetRecoveryDone });
+            await streamFleet(req, res, fleet.fleetBus, fleetWide ? null : (principal ?? "default"), callerSession || null, observeOnly ? undefined : deps.workflowCompletionInbox, { store: deps.workflowRunStore, scope: fleetWide ? null : (principal ?? "default"), pullScope: principal ?? "default", ready: deps.fleetRecoveryDone });
             return;
         }
         default:

package/dist/http/routes/images.js

@@ -5,9 +5,10 @@ import { manifestToIndexEntry } from "../../images/manifest.js";
 import { validateBake, buildBakeArgv } from "../../images/bake-validate.js";
 import { streamSseLog } from "../sse-log.js";
 import { sendJson, sendError } from "../send.js";
-import { headerStr, safeEqual, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+import { headerStr, safeEqual, gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export function createImagesLocal(deps) {
     return { bakeSubmitLimiter: new RateLimiter(deps.config.imageBakes?.submitRateMax ?? 0, (deps.config.imageBakes?.submitRateWindowSec ?? 60) * 1000) };
 }
@@ -50,9 +51,14 @@ export async function handleImages(req, res, match, ctx) {
         const principal = gatedPrincipal(req, deps.config);
         const operators = deps.config.operatorPrincipals;
         const isExplicitOperator = explicitOperatorOk(principal, operators);
+        const operatorLane = facts.operatorLane(deps);
         const cfg = deps.config.imageBakes;
         const isRunner = source !== undefined && source !== null && source === cfg.runnerPrincipal;
         if (match.decl.id === "image-bake-submit") {
+            if (!operatorLane.available) {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
             if (!isExplicitOperator) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
@@ -124,6 +130,10 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-bake-events") {
+            if (!operatorLane.available) {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
             if (!isExplicitOperator) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
@@ -142,6 +152,10 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-bake-cancel") {
+            if (!operatorLane.available) {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
             if (!isExplicitOperator) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
@@ -250,6 +264,10 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-bake-detail") {
+            if (!operatorLane.available) {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
             if (!isExplicitOperator) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
@@ -269,8 +287,9 @@ export async function handleImages(req, res, match, ctx) {
         }
         return assertNever(match.decl.id);
     }
-    if (deps.imageIndex && isIndexRouteId(match.decl.id)) {
-        const idx = deps.imageIndex;
+    const pool = facts.imagePool(deps);
+    if (pool.available && isIndexRouteId(match.decl.id)) {
+        const idx = pool.imageIndex;
         const principal = gatedPrincipal(req, deps.config);
         const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
         const viewer = { operator, tenantId: principal ?? null };
@@ -322,6 +341,10 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-register") {
+            if (!facts.operatorLane(deps).available) {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
             if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
@@ -397,6 +420,10 @@ export async function handleImages(req, res, match, ctx) {
         return assertNever(match.decl.id);
     }
     {
+        if (!pool.available) {
+            sendError(res, 501, "capability.image_index_required", "the sandbox-image-pool requires a SQL store backend (DB_BACKEND=mysql|pg) — the local backend wires no image index");
+            return;
+        }
         sendError(res, 501, "capability.image_index_required", "the sandbox-image-pool requires a SQL store backend (DB_BACKEND=mysql|pg) — the local backend wires no image index");
         return;
     }

package/dist/http/routes/leader.js

@@ -1,6 +1,7 @@
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, headerStr, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export const LEADER_SUBMIT_PATH = "/v1/leader";
 export async function handleLeader(req, res, match, ctx) {
     switch (match.decl.id) {
@@ -12,7 +13,12 @@ export async function handleLeader(req, res, match, ctx) {
     }
     const { deps } = ctx;
     const { readJson, rateLimited, quotaExceeded, leaseDenied, usageWindowDenied } = ctx.helpers;
-    const endpoint = deps.leaderEndpoint;
+    const lane = facts.leaderLane(deps);
+    if (!lane.available) {
+        sendError(res, 501, "capability.leader_endpoint_required", "this orchestration endpoint is not available on this deployment: nothing is wired to serve it here");
+        return;
+    }
+    const endpoint = lane.endpoint;
     if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
         sendPrincipalRefusal(res, req, deps.config);
         return;

package/dist/http/routes/mcp-reconnect.js

@@ -5,6 +5,7 @@ import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import {} from "../route-ctx.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 const BodySchema = z.object({ server: z.string().min(1).max(190) }).strict();
 const NEUTRALIZED_TEXT_MAX = 200;
 const humanText = (s) => redactSecrets(s).slice(0, NEUTRALIZED_TEXT_MAX);
@@ -56,10 +57,20 @@ export async function handleMcpReconnect(req, res, match, ctx) {
         case "mcp-reconnect": {
             if (ctx.helpers.rateLimited(req, res))
                 return;
-            if (!deps.runStore) {
-                sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg|local)");
-                return;
+            const fact = facts.mcpReconnect(deps);
+            if (!fact.available) {
+                switch (fact.why) {
+                    case "run_store_absent":
+                        sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg|local)");
+                        return;
+                    case "session_owner_face_absent":
+                        sendError(res, 501, "capability.session_ownership_required", "the MCP re-dial verb requires the session-ownership face (sessionStorage.ownerOf)");
+                        return;
+                    default:
+                        return assertNever(fact.why);
+                }
             }
+            const { runStore, sessionStorage } = fact;
             const principal = gatedPrincipal(req, deps.config);
             if (deps.config.requirePrincipal && principal === undefined) {
                 sendPrincipalRefusal(res, req, deps.config);
@@ -76,11 +87,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            if (!deps.sessionStorage?.ownerOf) {
-                sendError(res, 501, "capability.session_ownership_required", "the MCP re-dial verb requires the session-ownership face (sessionStorage.ownerOf)");
-                return;
-            }
-            const owner = await deps.sessionStorage.ownerOf(sessionId);
+            const owner = await sessionStorage.ownerOf(sessionId);
             if (owner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
@@ -88,7 +95,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
             const isOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
             if (!isOperator && !ctx.helpers.runOwnerOk(req, res, owner, "session"))
                 return;
-            const activeTaskId = await deps.runStore.getActiveTaskId(sessionId);
+            const activeTaskId = await runStore.getActiveTaskId(sessionId);
             const live = activeTaskId === undefined ? undefined : ctx.registry.steerableRuns.get(activeTaskId);
             if (live) {
                 try {
@@ -113,7 +120,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                     }
                 }
             }
-            const run = activeTaskId === undefined ? undefined : await deps.runStore.getRun(activeTaskId);
+            const run = activeTaskId === undefined ? undefined : await runStore.getRun(activeTaskId);
             if (run && isParkedRunStatus(run.status)) {
                 sendError(res, 409, "steering.not_running", "run is waiting on a pending decision — the MCP re-dial verb needs a live turn; a resumed continuation dials every declared server afresh (the re-dial applies to the current turn only and is not persisted), so resume this run first — a re-dial cannot be queued behind the decision");
                 return;

package/dist/http/routes/memory-bundle.js

@@ -2,8 +2,9 @@ import { z } from "zod";
 import { sendJson, sendError } from "../send.js";
 import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
 import { buildOriginFencedBundle, readOriginAware } from "../../memory-origin-fence.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export const MEMORY_BUNDLE_EXPORT_PATH = "/v1/memory/export";
 export const MEMORY_BUNDLE_IMPORT_PATH = "/v1/memory/import";
 const ExportRequestSchema = z.object({ scopes: z.array(z.string().min(1)).min(1) });
@@ -67,16 +68,29 @@ export async function handleMemoryBundle(req, res, match, ctx) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
+    const fact = facts.memoryBundle(deps);
+    if (!fact.available && fact.why === "operator_principals_empty") {
+        sendOperatorPrincipalsRequired(res);
+        return;
+    }
     if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
         sendError(res, 403, "auth.operator_only", "memory governance bundles are an operator-only deployment action");
         return;
     }
-    const engineExport = deps.memoryBundleExport;
-    const engineImport = deps.memoryBundleImport;
-    if (engineExport === undefined || engineImport === undefined) {
-        sendError(res, 501, "capability.memory_engine_required", "memory governance bundles are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend implements the v2-c bundle composite (exportSnapshotOf / importBundleCommit); the file memory backend does, the pg/tidb memory backends do not");
-        return;
+    if (!fact.available) {
+        switch (fact.why) {
+            case "memory_bundle_faces_absent":
+                sendError(res, 501, "capability.memory_engine_required", "memory governance bundles are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend implements the v2-c bundle composite (exportSnapshotOf / importBundleCommit); the file memory backend does, the pg/tidb memory backends do not");
+                return;
+            case "operator_principals_empty":
+                sendOperatorPrincipalsRequired(res);
+                return;
+            default:
+                return assertNever(fact.why);
+        }
     }
+    const engineExport = fact.exportScopes;
+    const engineImport = fact.importBundle;
     const raw = await ctx.helpers.readJson(req);
     switch (match.decl.id) {
         case "memory-bundle-export": {

package/dist/http/routes/memory-compliance.js

@@ -2,8 +2,9 @@ import { z } from "zod";
 import { erasureInputSmugglesPrototypeKey } from "../../memory-operator-faces.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export const MEMORY_ERASE_PATH = "/v1/memory/erase";
 const EraseRequestSchema = z.object({
     requestId: z.string().min(1),
@@ -23,15 +24,28 @@ export async function handleMemoryCompliance(req, res, match, ctx) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
+    const fact = facts.memoryCompliance(deps);
+    if (!fact.available && fact.why === "operator_principals_empty") {
+        sendOperatorPrincipalsRequired(res);
+        return;
+    }
     if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
         sendError(res, 403, "auth.operator_only", "memory provenance and erasure are operator-only deployment actions");
         return;
     }
-    const faces = deps.memoryCompliance;
-    if (faces === undefined) {
-        sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
-        return;
+    if (!fact.available) {
+        switch (fact.why) {
+            case "memory_compliance_faces_absent":
+                sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
+                return;
+            case "operator_principals_empty":
+                sendOperatorPrincipalsRequired(res);
+                return;
+            default:
+                return assertNever(fact.why);
+        }
     }
+    const faces = fact.faces;
     switch (match.decl.id) {
         case "memory-entry-provenance": {
             const entryId = ctx.helpers.safeDecode(match.params.entryId);

package/dist/http/routes/memory-consolidation.d.ts

@@ -6,20 +6,17 @@
  *
  * ── 族属与门序 ────────────────────────────────────────────────────────────────────────────────────
  * 与 `/v1/admin/drain` · `/v1/admin/config/refresh` 逐字同族(operator lane:同一条 `explicitOperatorOk`
- * 门)。门序照 operator 面既有口径:身份(401)→ 授权(403)→ 验型(400)。**授权在验型之前** —— 一个
+ * 门)。门序照 operator 面口径:身份(401)→ 能力(501,事实)→ 授权(403)→ 验型(400)。**授权在验型之前** —— 一个
  * 够不着任何东西的调用方不该从「你的 body 形不对」上读出这台部署有没有这条面。
  *
- * ── 为什么缺席形是 **404 族**而不是 501(D4)───────────────────────────────────────────────────────
- * 本仓的 501 `capability.*` 说的是「**这家店**在本部署上不存在,换部署形态才行」(记忆引擎没接线、
- * 后端没有某个复合面)。本族不是那个形:阀门关着是一句**运维表态**(`MEMORY_CONSOLIDATION_DRIVER=off`),或
- * 出厂缺省派生成关(S-824 / [ref]:未设而整理座落主模型 —— 起服时有一行提示点名 `MODEL_CHEAP_ID`),不是部署能力的
- * 缺失。而阀门开着却结构上跑不了的三种形(引擎没接线 / 后端没有控制面
- * 归属 / provenance=off)在**启动期**就被拒了(`boot/memory-consolidation.ts` 的
- * `assertConsolidationDriverWirable`)—— 那些机器根本起不来,不会有一个"挂着的 501"去代表它们。
- * ⇒ 剩下的唯一缺席成因就是「阀门没开」,而它的诚实形是**这条路径不存在**:挂载条件写在 server.ts 的
- * 域头合取式里,能力位 `memoryConsolidationDriver` 读同一个事实,「说 yes ⟺ 打得通」因此是结构性的。
- * 🔴 刻意与 permissionRules 的 501 分家:那一族的 501 是「规则店没装」,消费端的动作是换部署;本族的
- * 404 的动作是「去把旋钮打开」。同码会让运维照着一条修不好的路走。
+ * ── 缺席形(D4):**501**,与能力位同一只事实 ─────────────────────────────────────────────────────
+ * 两口恒挂载;域头调事实 `memoryConsolidation`(`src/capability-facts.ts`,`capabilities.memoryConsolidationDriver` 读的是同一只):
+ *  · 阀门关(`MEMORY_CONSOLIDATION_DRIVER=off`,或 S-824 出厂缺省派生成关 —— 未设而整理座落主模型)⇒ 501
+ *    `feature.memory_consolidation_disabled`。旋钮关是一句运维表态,不是部署能力缺失 —— 「去开旋钮」由 `feature.*` 这一族码
+ *    与拒句承担(同仓旋钮关的既有答法),不靠状态码:HTTP 上「这台部署上不可用」只有 501 一种答。
+ *  · operator 名单空 ⇒ 501 `capability.operator_principals_required`(对谁都打不通 = 部署不可用,先于授权答)。
+ * 阀门开着却结构上跑不了的三种形(引擎没接线 / 后端没有控制面归属 / provenance=off)在**启动期**就被拒了
+ * (`boot/memory-consolidation.ts` 的 `assertConsolidationDriverWirable`),那些机器根本起不来。
  *
  * ── scope **恒不猜**(D2)────────────────────────────────────────────────────────────────────────
  * 一轮 consolidation 读**全库**(~1e5 prompt tokens/轮)。在两个库之间替 operator 挑一个去花这笔钱,

package/dist/http/routes/memory-consolidation.js

@@ -1,8 +1,9 @@
 import { z } from "zod";
 import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export const MEMORY_CONSOLIDATION_STATUS_PATH = "/v1/admin/memory/consolidation";
 export const MEMORY_CONSOLIDATION_RUN_PATH = "/v1/admin/memory/consolidation/run";
 const RunRequestSchema = z.object({ scope: z.string().optional() }).strict();
@@ -72,14 +73,27 @@ function codeOf(err) {
 }
 export async function handleMemoryConsolidation(req, res, match, ctx) {
     const { deps } = ctx;
-    const faces = deps.memoryConsolidation;
     const principal = gatedPrincipal(req, deps.config);
     if (deps.config.requirePrincipal && !principal) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
+    const fact = facts.memoryConsolidation(deps);
+    if (!fact.available) {
+        switch (fact.why) {
+            case "consolidation_valve_closed":
+                sendError(res, 501, "feature.memory_consolidation_disabled", "memory consolidation is switched off on this deployment (MEMORY_CONSOLIDATION_DRIVER is off, or its default derived off because no cheap model is configured); turn it on to use these endpoints");
+                return;
+            case "operator_principals_empty":
+                sendOperatorPrincipalsRequired(res);
+                return;
+            default:
+                return assertNever(fact.why);
+        }
+    }
+    const faces = fact.valve;
     if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
-        sendError(res, 403, "auth.operator_only", "memory consolidation is operator-only: the caller principal is not in OPERATOR_PRINCIPALS (an empty list means NO one is an operator — configure it to enable these endpoints)");
+        sendError(res, 403, "auth.operator_only", "memory consolidation is operator-only: the caller principal is not in OPERATOR_PRINCIPALS");
         return;
     }
     switch (match.decl.id) {

package/dist/http/routes/memory-origin.js

@@ -3,8 +3,9 @@ import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
 import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export const MEMORY_ORIGIN_EXTERNAL_PATH = "/v1/memory/origin/external";
 export const MEMORY_ORIGIN_CLEARANCES_PATH = "/v1/memory/origin/clearances";
 const ClearRequestSchema = z.object({
@@ -116,15 +117,28 @@ export async function handleMemoryOrigin(req, res, match, ctx) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
+    const fact = facts.memoryOrigin(deps);
+    if (!fact.available && fact.why === "operator_principals_empty") {
+        sendOperatorPrincipalsRequired(res);
+        return;
+    }
     if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
         sendError(res, 403, "auth.operator_only", "memory origin marking and clearance are operator-only deployment actions");
         return;
     }
-    const faces = deps.memoryOriginFace;
-    if (faces === undefined) {
-        sendError(res, 501, "capability.memory_engine_required", "memory origin marking and clearance are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the clearance ledger and its write-ahead custody rows live in that plane, and on a backend without it they would land on one replica's local disk");
-        return;
+    if (!fact.available) {
+        switch (fact.why) {
+            case "memory_origin_faces_absent":
+                sendError(res, 501, "capability.memory_engine_required", "memory origin marking and clearance are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the clearance ledger and its write-ahead custody rows live in that plane, and on a backend without it they would land on one replica's local disk");
+                return;
+            case "operator_principals_empty":
+                sendOperatorPrincipalsRequired(res);
+                return;
+            default:
+                return assertNever(fact.why);
+        }
     }
+    const faces = fact.faces;
     switch (match.decl.id) {
         case "memory-origin-external": {
             const scopes = parseScopes(new URLSearchParams(match.search).getAll("scopes"));

package/dist/http/routes/notify-wake.js

@@ -3,6 +3,7 @@ import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export async function handleNotifyWake(req, res, match, ctx) {
     const { deps } = ctx;
     const { steerableRuns } = ctx.registry;
@@ -57,11 +58,12 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendError(res, 400, "request.field_invalid", "source must be a string of at most 190 characters when present");
                 return;
             }
-            if (!deps.sessionStorage?.ownerOf) {
+            const owned = facts.sessionOwnership(deps);
+            if (!owned.available) {
                 sendError(res, 501, "capability.session_ownership_required", "external notify requires the session-ownership face (sessionStorage.ownerOf)");
                 return;
             }
-            const notifyOwner = await deps.sessionStorage.ownerOf(notifySession);
+            const notifyOwner = await owned.sessionStorage.ownerOf(notifySession);
             if (notifyOwner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
@@ -104,7 +106,7 @@ export async function handleNotifyWake(req, res, match, ctx) {
             return;
         }
         case "session-wake": {
-            if (!deps.checkpointStore) {
+            if (!facts.checkpointPark(deps).available) {
                 sendError(res, 501, "capability.checkpoint_store_required", "wake requires the checkpoint store");
                 return;
             }