@sema-agent/server 7.115.0 → 7.116.1

package/dist/http/routes/devices.js

@@ -1,6 +1,7 @@
 import { sendError, sendJson } from "../send.js";
 import { explicitOperatorOk, gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 import { DEVICE_PLATFORM_OS, DEVICE_PUBKEY_MAX_BYTES, DEVICE_TEXT_LIMITS, assertDeviceIdShape, assertDevicePubkeyShape, assertRootSessionIdShape, sameDeviceOwner, } from "../../device-store.js";
 import { DEFAULT_ENROLL_TOKEN_TTL_SEC } from "../../device-enrollment.js";
 import { deviceOwnerDomainOf } from "../device-placement.js";
@@ -133,13 +134,22 @@ export async function handleDevices(req, res, match, ctx) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
-    const store = deps.deviceStore;
-    const hub = deps.deviceHub;
-    const enrollment = deps.deviceEnrollment;
-    if (!store || !hub || !enrollment) {
-        sendError(res, 501, "capability.device_lane_required", DEVICE_LANE_REQUIRED_MESSAGE);
-        return;
+    const lane = facts.deviceManagement(deps);
+    if (!lane.available) {
+        switch (lane.why) {
+            case "device_hub_absent":
+            case "device_store_absent":
+            case "device_enrollment_absent":
+                sendError(res, 501, "capability.device_lane_required", DEVICE_LANE_REQUIRED_MESSAGE);
+                return;
+            case "run_store_absent":
+                sendError(res, 501, "capability.run_store_required", "device rebind needs the run store to judge the no-active-run door (a durable, cross-replica criterion) — this deployment has no run store wired");
+                return;
+            default:
+                return assertNever(lane.why);
+        }
     }
+    const { store, hub, enrollment, runStore } = lane;
     const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
     const domain = deviceOwnerDomainOf(req, deps.config);
     if (match.decl.id === "devices-list") {
@@ -293,11 +303,7 @@ export async function handleDevices(req, res, match, ctx) {
         sendDeviceNotFound(res);
         return;
     }
-    if (!deps.runStore) {
-        sendError(res, 501, "capability.run_store_required", "device rebind needs the run store to judge the no-active-run door (a durable, cross-replica criterion) — this deployment has no run store wired");
-        return;
-    }
-    const activeTaskId = await deps.runStore.getActiveTaskId(rootSessionId);
+    const activeTaskId = await runStore.getActiveTaskId(rootSessionId);
     if (activeTaskId) {
         sendError(res, 409, "device.rebind_active_run", "this session has a non-terminal run — rebinding now would leave in-flight work addressed at another workspace; cancel the run (or let it finish), then retry", { activeTaskId });
         return;

package/dist/http/routes/diagnostics.js

@@ -4,7 +4,8 @@ import { projectExecutionLaneCapability } from "../../capabilities/execution-lan
 import { readOutboundWiring } from "../../outbound-dispatcher.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, isLoopbackAddress, verifiedIdentitySource } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, isLoopbackAddress, sendOperatorPrincipalsRequired, verifiedIdentitySource } from "../principal-gate.js";
+import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
 export function buildServerWiringGates(input) {
     const gate = resolveStreamApprovalGate({
@@ -87,6 +88,10 @@ export async function handleDiagnostics(req, res, match, ctx) {
     switch (match.decl.id) {
         case "diagnostics-wiring": {
             if (deps.config.operatorPrincipals.length > 0 || deps.config.requirePrincipal) {
+                if (!facts.operatorLane(deps).available) {
+                    sendOperatorPrincipalsRequired(res);
+                    return;
+                }
                 const principal = gatedPrincipal(req, deps.config);
                 if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
                     sendError(res, 403, "auth.operator_only", "wiring diagnostics are operator-only on a multi-tenant worker");

package/dist/http/routes/fleet.js

@@ -4,12 +4,14 @@ import { taskNotificationFoldKey } from "../../orchestration/workflow-completion
 import { sendJson, sendError, sseHeaders } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export async function handleFleet(req, res, match, ctx) {
     const { deps } = ctx;
     const { sessionOwnerScope } = ctx.helpers;
     switch (match.decl.id) {
         case "fleet-stream": {
-            if (!deps.fleetBus) {
+            const fleet = facts.fleetStream(deps);
+            if (!fleet.available) {
                 sendError(res, 501, "capability.self_orchestration_required", "fleet stream requires self-orchestration / fleet wiring");
                 return;
             }
@@ -22,7 +24,7 @@ export async function handleFleet(req, res, match, ctx) {
             const fleetParams = new URLSearchParams(match.search);
             const callerSession = fleetParams.get("session");
             const observeOnly = fleetParams.get("observe") === "1";
-            await streamFleet(req, res, deps.fleetBus, fleetWide ? null : (principal ?? "default"), callerSession || null, observeOnly ? undefined : deps.workflowCompletionInbox, { store: deps.workflowRunStore, scope: fleetWide ? null : (principal ?? "default"), pullScope: principal ?? "default", ready: deps.fleetRecoveryDone });
+            await streamFleet(req, res, fleet.fleetBus, fleetWide ? null : (principal ?? "default"), callerSession || null, observeOnly ? undefined : deps.workflowCompletionInbox, { store: deps.workflowRunStore, scope: fleetWide ? null : (principal ?? "default"), pullScope: principal ?? "default", ready: deps.fleetRecoveryDone });
             return;
         }
         default:

package/dist/http/routes/images.js

@@ -5,9 +5,10 @@ import { manifestToIndexEntry } from "../../images/manifest.js";
 import { validateBake, buildBakeArgv } from "../../images/bake-validate.js";
 import { streamSseLog } from "../sse-log.js";
 import { sendJson, sendError } from "../send.js";
-import { headerStr, safeEqual, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+import { headerStr, safeEqual, gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export function createImagesLocal(deps) {
     return { bakeSubmitLimiter: new RateLimiter(deps.config.imageBakes?.submitRateMax ?? 0, (deps.config.imageBakes?.submitRateWindowSec ?? 60) * 1000) };
 }
@@ -50,9 +51,14 @@ export async function handleImages(req, res, match, ctx) {
         const principal = gatedPrincipal(req, deps.config);
         const operators = deps.config.operatorPrincipals;
         const isExplicitOperator = explicitOperatorOk(principal, operators);
+        const operatorLane = facts.operatorLane(deps);
         const cfg = deps.config.imageBakes;
         const isRunner = source !== undefined && source !== null && source === cfg.runnerPrincipal;
         if (match.decl.id === "image-bake-submit") {
+            if (!operatorLane.available) {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
             if (!isExplicitOperator) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
@@ -124,6 +130,10 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-bake-events") {
+            if (!operatorLane.available) {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
             if (!isExplicitOperator) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
@@ -142,6 +152,10 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-bake-cancel") {
+            if (!operatorLane.available) {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
             if (!isExplicitOperator) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
@@ -250,6 +264,10 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-bake-detail") {
+            if (!operatorLane.available) {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
             if (!isExplicitOperator) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
@@ -269,8 +287,9 @@ export async function handleImages(req, res, match, ctx) {
         }
         return assertNever(match.decl.id);
     }
-    if (deps.imageIndex && isIndexRouteId(match.decl.id)) {
-        const idx = deps.imageIndex;
+    const pool = facts.imagePool(deps);
+    if (pool.available && isIndexRouteId(match.decl.id)) {
+        const idx = pool.imageIndex;
         const principal = gatedPrincipal(req, deps.config);
         const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
         const viewer = { operator, tenantId: principal ?? null };
@@ -322,6 +341,10 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-register") {
+            if (!facts.operatorLane(deps).available) {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
             if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
@@ -397,6 +420,10 @@ export async function handleImages(req, res, match, ctx) {
         return assertNever(match.decl.id);
     }
     {
+        if (!pool.available) {
+            sendError(res, 501, "capability.image_index_required", "the sandbox-image-pool requires a SQL store backend (DB_BACKEND=mysql|pg) — the local backend wires no image index");
+            return;
+        }
         sendError(res, 501, "capability.image_index_required", "the sandbox-image-pool requires a SQL store backend (DB_BACKEND=mysql|pg) — the local backend wires no image index");
         return;
     }

package/dist/http/routes/leader.js

@@ -1,6 +1,7 @@
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, headerStr, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export const LEADER_SUBMIT_PATH = "/v1/leader";
 export async function handleLeader(req, res, match, ctx) {
     switch (match.decl.id) {
@@ -12,7 +13,12 @@ export async function handleLeader(req, res, match, ctx) {
     }
     const { deps } = ctx;
     const { readJson, rateLimited, quotaExceeded, leaseDenied, usageWindowDenied } = ctx.helpers;
-    const endpoint = deps.leaderEndpoint;
+    const lane = facts.leaderLane(deps);
+    if (!lane.available) {
+        sendError(res, 501, "capability.leader_endpoint_required", "this orchestration endpoint is not available on this deployment: nothing is wired to serve it here");
+        return;
+    }
+    const endpoint = lane.endpoint;
     if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
         sendPrincipalRefusal(res, req, deps.config);
         return;

package/dist/http/routes/mcp-reconnect.js

@@ -5,6 +5,7 @@ import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import {} from "../route-ctx.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 const BodySchema = z.object({ server: z.string().min(1).max(190) }).strict();
 const NEUTRALIZED_TEXT_MAX = 200;
 const humanText = (s) => redactSecrets(s).slice(0, NEUTRALIZED_TEXT_MAX);
@@ -56,10 +57,20 @@ export async function handleMcpReconnect(req, res, match, ctx) {
         case "mcp-reconnect": {
             if (ctx.helpers.rateLimited(req, res))
                 return;
-            if (!deps.runStore) {
-                sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg|local)");
-                return;
+            const fact = facts.mcpReconnect(deps);
+            if (!fact.available) {
+                switch (fact.why) {
+                    case "run_store_absent":
+                        sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg|local)");
+                        return;
+                    case "session_owner_face_absent":
+                        sendError(res, 501, "capability.session_ownership_required", "the MCP re-dial verb requires the session-ownership face (sessionStorage.ownerOf)");
+                        return;
+                    default:
+                        return assertNever(fact.why);
+                }
             }
+            const { runStore, sessionStorage } = fact;
             const principal = gatedPrincipal(req, deps.config);
             if (deps.config.requirePrincipal && principal === undefined) {
                 sendPrincipalRefusal(res, req, deps.config);
@@ -76,11 +87,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            if (!deps.sessionStorage?.ownerOf) {
-                sendError(res, 501, "capability.session_ownership_required", "the MCP re-dial verb requires the session-ownership face (sessionStorage.ownerOf)");
-                return;
-            }
-            const owner = await deps.sessionStorage.ownerOf(sessionId);
+            const owner = await sessionStorage.ownerOf(sessionId);
             if (owner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
@@ -88,7 +95,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
             const isOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
             if (!isOperator && !ctx.helpers.runOwnerOk(req, res, owner, "session"))
                 return;
-            const activeTaskId = await deps.runStore.getActiveTaskId(sessionId);
+            const activeTaskId = await runStore.getActiveTaskId(sessionId);
             const live = activeTaskId === undefined ? undefined : ctx.registry.steerableRuns.get(activeTaskId);
             if (live) {
                 try {
@@ -113,7 +120,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                     }
                 }
             }
-            const run = activeTaskId === undefined ? undefined : await deps.runStore.getRun(activeTaskId);
+            const run = activeTaskId === undefined ? undefined : await runStore.getRun(activeTaskId);
             if (run && isParkedRunStatus(run.status)) {
                 sendError(res, 409, "steering.not_running", "run is waiting on a pending decision — the MCP re-dial verb needs a live turn; a resumed continuation dials every declared server afresh (the re-dial applies to the current turn only and is not persisted), so resume this run first — a re-dial cannot be queued behind the decision");
                 return;

package/dist/http/routes/memory-bundle.js

@@ -2,8 +2,9 @@ import { z } from "zod";
 import { sendJson, sendError } from "../send.js";
 import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
 import { buildOriginFencedBundle, readOriginAware } from "../../memory-origin-fence.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export const MEMORY_BUNDLE_EXPORT_PATH = "/v1/memory/export";
 export const MEMORY_BUNDLE_IMPORT_PATH = "/v1/memory/import";
 const ExportRequestSchema = z.object({ scopes: z.array(z.string().min(1)).min(1) });
@@ -67,16 +68,29 @@ export async function handleMemoryBundle(req, res, match, ctx) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
+    const fact = facts.memoryBundle(deps);
+    if (!fact.available && fact.why === "operator_principals_empty") {
+        sendOperatorPrincipalsRequired(res);
+        return;
+    }
     if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
         sendError(res, 403, "auth.operator_only", "memory governance bundles are an operator-only deployment action");
         return;
     }
-    const engineExport = deps.memoryBundleExport;
-    const engineImport = deps.memoryBundleImport;
-    if (engineExport === undefined || engineImport === undefined) {
-        sendError(res, 501, "capability.memory_engine_required", "memory governance bundles are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend implements the v2-c bundle composite (exportSnapshotOf / importBundleCommit); the file memory backend does, the pg/tidb memory backends do not");
-        return;
+    if (!fact.available) {
+        switch (fact.why) {
+            case "memory_bundle_faces_absent":
+                sendError(res, 501, "capability.memory_engine_required", "memory governance bundles are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend implements the v2-c bundle composite (exportSnapshotOf / importBundleCommit); the file memory backend does, the pg/tidb memory backends do not");
+                return;
+            case "operator_principals_empty":
+                sendOperatorPrincipalsRequired(res);
+                return;
+            default:
+                return assertNever(fact.why);
+        }
     }
+    const engineExport = fact.exportScopes;
+    const engineImport = fact.importBundle;
     const raw = await ctx.helpers.readJson(req);
     switch (match.decl.id) {
         case "memory-bundle-export": {

package/dist/http/routes/memory-compliance.js

@@ -2,8 +2,9 @@ import { z } from "zod";
 import { erasureInputSmugglesPrototypeKey } from "../../memory-operator-faces.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export const MEMORY_ERASE_PATH = "/v1/memory/erase";
 const EraseRequestSchema = z.object({
     requestId: z.string().min(1),
@@ -23,15 +24,28 @@ export async function handleMemoryCompliance(req, res, match, ctx) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
+    const fact = facts.memoryCompliance(deps);
+    if (!fact.available && fact.why === "operator_principals_empty") {
+        sendOperatorPrincipalsRequired(res);
+        return;
+    }
     if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
         sendError(res, 403, "auth.operator_only", "memory provenance and erasure are operator-only deployment actions");
         return;
     }
-    const faces = deps.memoryCompliance;
-    if (faces === undefined) {
-        sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
-        return;
+    if (!fact.available) {
+        switch (fact.why) {
+            case "memory_compliance_faces_absent":
+                sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
+                return;
+            case "operator_principals_empty":
+                sendOperatorPrincipalsRequired(res);
+                return;
+            default:
+                return assertNever(fact.why);
+        }
     }
+    const faces = fact.faces;
     switch (match.decl.id) {
         case "memory-entry-provenance": {
             const entryId = ctx.helpers.safeDecode(match.params.entryId);

package/dist/http/routes/memory-consolidation.d.ts

@@ -6,20 +6,17 @@
  *
  * ── 族属与门序 ────────────────────────────────────────────────────────────────────────────────────
  * 与 `/v1/admin/drain` · `/v1/admin/config/refresh` 逐字同族(operator lane:同一条 `explicitOperatorOk`
- * 门)。门序照 operator 面既有口径:身份(401)→ 授权(403)→ 验型(400)。**授权在验型之前** —— 一个
+ * 门)。门序照 operator 面口径:身份(401)→ 能力(501,事实)→ 授权(403)→ 验型(400)。**授权在验型之前** —— 一个
  * 够不着任何东西的调用方不该从「你的 body 形不对」上读出这台部署有没有这条面。
  *
- * ── 为什么缺席形是 **404 族**而不是 501(D4)───────────────────────────────────────────────────────
- * 本仓的 501 `capability.*` 说的是「**这家店**在本部署上不存在,换部署形态才行」(记忆引擎没接线、
- * 后端没有某个复合面)。本族不是那个形:阀门关着是一句**运维表态**(`MEMORY_CONSOLIDATION_DRIVER=off`),或
- * 出厂缺省派生成关(S-824 / [ref]:未设而整理座落主模型 —— 起服时有一行提示点名 `MODEL_CHEAP_ID`),不是部署能力的
- * 缺失。而阀门开着却结构上跑不了的三种形(引擎没接线 / 后端没有控制面
- * 归属 / provenance=off)在**启动期**就被拒了(`boot/memory-consolidation.ts` 的
- * `assertConsolidationDriverWirable`)—— 那些机器根本起不来,不会有一个"挂着的 501"去代表它们。
- * ⇒ 剩下的唯一缺席成因就是「阀门没开」,而它的诚实形是**这条路径不存在**:挂载条件写在 server.ts 的
- * 域头合取式里,能力位 `memoryConsolidationDriver` 读同一个事实,「说 yes ⟺ 打得通」因此是结构性的。
- * 🔴 刻意与 permissionRules 的 501 分家:那一族的 501 是「规则店没装」,消费端的动作是换部署;本族的
- * 404 的动作是「去把旋钮打开」。同码会让运维照着一条修不好的路走。
+ * ── 缺席形(D4):**501**,与能力位同一只事实 ─────────────────────────────────────────────────────
+ * 两口恒挂载;域头调事实 `memoryConsolidation`(`src/capability-facts.ts`,`capabilities.memoryConsolidationDriver` 读的是同一只):
+ *  · 阀门关(`MEMORY_CONSOLIDATION_DRIVER=off`,或 S-824 出厂缺省派生成关 —— 未设而整理座落主模型)⇒ 501
+ *    `feature.memory_consolidation_disabled`。旋钮关是一句运维表态,不是部署能力缺失 —— 「去开旋钮」由 `feature.*` 这一族码
+ *    与拒句承担(同仓旋钮关的既有答法),不靠状态码:HTTP 上「这台部署上不可用」只有 501 一种答。
+ *  · operator 名单空 ⇒ 501 `capability.operator_principals_required`(对谁都打不通 = 部署不可用,先于授权答)。
+ * 阀门开着却结构上跑不了的三种形(引擎没接线 / 后端没有控制面归属 / provenance=off)在**启动期**就被拒了
+ * (`boot/memory-consolidation.ts` 的 `assertConsolidationDriverWirable`),那些机器根本起不来。
  *
  * ── scope **恒不猜**(D2)────────────────────────────────────────────────────────────────────────
  * 一轮 consolidation 读**全库**(~1e5 prompt tokens/轮)。在两个库之间替 operator 挑一个去花这笔钱,

package/dist/http/routes/memory-consolidation.js

@@ -1,8 +1,9 @@
 import { z } from "zod";
 import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export const MEMORY_CONSOLIDATION_STATUS_PATH = "/v1/admin/memory/consolidation";
 export const MEMORY_CONSOLIDATION_RUN_PATH = "/v1/admin/memory/consolidation/run";
 const RunRequestSchema = z.object({ scope: z.string().optional() }).strict();
@@ -72,14 +73,27 @@ function codeOf(err) {
 }
 export async function handleMemoryConsolidation(req, res, match, ctx) {
     const { deps } = ctx;
-    const faces = deps.memoryConsolidation;
     const principal = gatedPrincipal(req, deps.config);
     if (deps.config.requirePrincipal && !principal) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
+    const fact = facts.memoryConsolidation(deps);
+    if (!fact.available) {
+        switch (fact.why) {
+            case "consolidation_valve_closed":
+                sendError(res, 501, "feature.memory_consolidation_disabled", "memory consolidation is switched off on this deployment (MEMORY_CONSOLIDATION_DRIVER is off, or its default derived off because no cheap model is configured); turn it on to use these endpoints");
+                return;
+            case "operator_principals_empty":
+                sendOperatorPrincipalsRequired(res);
+                return;
+            default:
+                return assertNever(fact.why);
+        }
+    }
+    const faces = fact.valve;
     if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
-        sendError(res, 403, "auth.operator_only", "memory consolidation is operator-only: the caller principal is not in OPERATOR_PRINCIPALS (an empty list means NO one is an operator — configure it to enable these endpoints)");
+        sendError(res, 403, "auth.operator_only", "memory consolidation is operator-only: the caller principal is not in OPERATOR_PRINCIPALS");
         return;
     }
     switch (match.decl.id) {

package/dist/http/routes/memory-origin.js

@@ -3,8 +3,9 @@ import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
 import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export const MEMORY_ORIGIN_EXTERNAL_PATH = "/v1/memory/origin/external";
 export const MEMORY_ORIGIN_CLEARANCES_PATH = "/v1/memory/origin/clearances";
 const ClearRequestSchema = z.object({
@@ -116,15 +117,28 @@ export async function handleMemoryOrigin(req, res, match, ctx) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
+    const fact = facts.memoryOrigin(deps);
+    if (!fact.available && fact.why === "operator_principals_empty") {
+        sendOperatorPrincipalsRequired(res);
+        return;
+    }
     if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
         sendError(res, 403, "auth.operator_only", "memory origin marking and clearance are operator-only deployment actions");
         return;
     }
-    const faces = deps.memoryOriginFace;
-    if (faces === undefined) {
-        sendError(res, 501, "capability.memory_engine_required", "memory origin marking and clearance are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the clearance ledger and its write-ahead custody rows live in that plane, and on a backend without it they would land on one replica's local disk");
-        return;
+    if (!fact.available) {
+        switch (fact.why) {
+            case "memory_origin_faces_absent":
+                sendError(res, 501, "capability.memory_engine_required", "memory origin marking and clearance are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the clearance ledger and its write-ahead custody rows live in that plane, and on a backend without it they would land on one replica's local disk");
+                return;
+            case "operator_principals_empty":
+                sendOperatorPrincipalsRequired(res);
+                return;
+            default:
+                return assertNever(fact.why);
+        }
     }
+    const faces = fact.faces;
     switch (match.decl.id) {
         case "memory-origin-external": {
             const scopes = parseScopes(new URLSearchParams(match.search).getAll("scopes"));

package/dist/http/routes/notify-wake.js

@@ -3,6 +3,7 @@ import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export async function handleNotifyWake(req, res, match, ctx) {
     const { deps } = ctx;
     const { steerableRuns } = ctx.registry;
@@ -57,11 +58,12 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendError(res, 400, "request.field_invalid", "source must be a string of at most 190 characters when present");
                 return;
             }
-            if (!deps.sessionStorage?.ownerOf) {
+            const owned = facts.sessionOwnership(deps);
+            if (!owned.available) {
                 sendError(res, 501, "capability.session_ownership_required", "external notify requires the session-ownership face (sessionStorage.ownerOf)");
                 return;
             }
-            const notifyOwner = await deps.sessionStorage.ownerOf(notifySession);
+            const notifyOwner = await owned.sessionStorage.ownerOf(notifySession);
             if (notifyOwner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
@@ -104,7 +106,7 @@ export async function handleNotifyWake(req, res, match, ctx) {
             return;
         }
         case "session-wake": {
-            if (!deps.checkpointStore) {
+            if (!facts.checkpointPark(deps).available) {
                 sendError(res, 501, "capability.checkpoint_store_required", "wake requires the checkpoint store");
                 return;
             }

package/dist/http/routes/observability.js

@@ -1,10 +1,16 @@
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, isOperator, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, isOperator, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 export async function handleObservability(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
         case "outcomes": {
+            const fact = facts.outcomeLedger(deps);
+            if (!fact.available && fact.why === "operator_principals_empty") {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
             if (deps.config.requirePrincipal) {
                 const principal = gatedPrincipal(req, deps.config);
                 if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
@@ -12,14 +18,22 @@ export async function handleObservability(req, res, match, ctx) {
                     return;
                 }
             }
-            if (!deps.outcomeSink?.summary) {
-                sendError(res, 501, "capability.outcome_ledger_required", "no queryable outcome ledger on this worker (File sink — read the JSONL dataset directly)");
-                return;
+            if (!fact.available) {
+                switch (fact.why) {
+                    case "outcome_ledger_unqueryable":
+                        sendError(res, 501, "capability.outcome_ledger_required", "no queryable outcome ledger on this worker (File sink — read the JSONL dataset directly)");
+                        return;
+                    case "operator_principals_empty":
+                        sendOperatorPrincipalsRequired(res);
+                        return;
+                    default:
+                        return assertNever(fact.why);
+                }
             }
             const q = new URLSearchParams(match.search);
             const sig = q.get("signature") ?? undefined;
             try {
-                const rows = await deps.outcomeSink.summary({ ...(sig ? { taskSignature: sig } : {}), includeAborted: q.get("includeAborted") === "true" });
+                const rows = await fact.sink.summary({ ...(sig ? { taskSignature: sig } : {}), includeAborted: q.get("includeAborted") === "true" });
                 sendJson(res, 200, { outcomes: rows });
             }
             catch (err) {

package/dist/http/routes/retention-ops.js

@@ -1,5 +1,6 @@
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
+import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
 import { RETENTION_AUDIT_DEFAULT_LIMIT, RETENTION_AUDIT_MAX_LIMIT } from "../../plugins/retention-lane-store-sql.js";
 const AUDIT_PATH = "/v1/ops/retention/audit";
@@ -31,6 +32,10 @@ export async function handleRetention(req, res, match, ctx) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
+    if (!facts.operatorLane(deps).available) {
+        sendOperatorPrincipalsRequired(res);
+        return;
+    }
     if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
         sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
         return;