@sema-agent/server 7.117.0 → 7.119.0

package/deploy/sema-up/cluster-up.sh

@@ -31,6 +31,10 @@ unset _self _hops _dir
 . "$HERE/lib/shell-access.sh"
 # 取值旗的形(S-621):判据与词表同 sema-up.sh 一处定义。
 . "$HERE/lib/flagshape.sh"
+# 引擎 /health 体里「落在哪个后端」的读法与期望值(smoke.sh / kube-up.sh 同一只)。
+. "$HERE/lib/health.sh"
+# 对象存储桶的唯一表(sema-up.sh / kube-up.sh / smoke.sh 同读这一张)。
+. "$HERE/lib/buckets.sh"
 log() { printf '[cluster-up] %s\n' "$*" >&2; }
 die() { log "⛔ $*"; exit 1; }
 
@@ -419,8 +423,9 @@ PY
 # 凭据清单经 stdin 直接 apply,不落远端盘(落 /tmp 失败时会残留)
 rrun 0 k3s kubectl apply -f - < "$RENDERED" >/dev/null
 fi
-rsudo 0 <<'EOF'
+rsudo 0 $(buckets_prefixed local/ $(buckets_k8s)) <<'EOF'
 set -e
+BUCKETS=("$@")   # 要建的桶(local/<桶>):清单只在 lib/buckets.sh 一处,经位置参数递给远端
 # runner token 跨 ns 复制要赶在 server 起 pod 前(晚了=CreateContainerConfigError 干等——真踩);
 # SA token secret 由控制器异步填充,先等它有值
 TOK=""
@@ -431,6 +436,12 @@ done
 [ -n "$TOK" ] || { echo "sema-runner-token 未被控制器填充" >&2; exit 1; }
 k3s kubectl create secret generic sema-runner-token-copy -n sema --from-literal=token="$(printf '%s' "$TOK" | base64 -d)" \
   --dry-run=client -o yaml | k3s kubectl apply -f - >/dev/null
+# MinIO 建桶(备份桶+引擎桶)—— 排在等 PG healthy 与等 server rollout **之前**:引擎起服会核快照桶在不在,桶缺时 server 不就绪、rollout 永远等不到,而建桶又排在它后面 ⇒ 互等;
+# MinIO 不依赖 PG,建桶也就不必陪着等 PG(冷启拉镜像 + init 可要几分钟,会把引擎的等桶窗耗掉)
+k3s kubectl rollout status deployment/sema-minio -n sema --timeout=300s >/dev/null
+PW=$(k3s kubectl get secret sema-minio -n sema -o jsonpath='{.data.rootPassword}' | base64 -d)
+k3s kubectl exec deploy/sema-minio -n sema -- sh -c \
+  "mc alias set local http://localhost:9000 sema '$PW' >/dev/null && mc mb --ignore-existing ${BUCKETS[*]}" >/dev/null
 # PG healthy(冷启拉镜像+init 可要几分钟)
 for t in $(seq 1 120); do
   s=$(k3s kubectl get cluster sema-pg -n sema -o jsonpath='{.status.phase}' 2>/dev/null || true)
@@ -438,24 +449,25 @@ for t in $(seq 1 120); do
 done
 [ "$s" = "Cluster in healthy state" ] || { k3s kubectl get cluster -n sema; echo "PG 未达 healthy" >&2; exit 1; }
 k3s kubectl rollout status deployment/sema-server -n sema --timeout=300s >/dev/null
-# MinIO 建桶(备份桶+对象桶)
-PW=$(k3s kubectl get secret sema-minio -n sema -o jsonpath='{.data.rootPassword}' | base64 -d)
-k3s kubectl exec deploy/sema-minio -n sema -- sh -c \
-  "mc alias set local http://localhost:9000 sema '$PW' >/dev/null && mc mb --ignore-existing local/sema-pg-backup local/workspaces local/blobs" >/dev/null
 echo STACK_OK
 EOF
 
 # ── 8. smoke(节点内经 NodePort;外网入口=LB 在云商侧配,打印指引)────────────────
 log "8/8 smoke"
 # NodePort 被 nodeport-addresses 钉在节点网段——loopback 不在其内,必须打 node-ip(真踩 curl exit 7)
-SMOKE=$(rsudo 0 <<EOF
-H=\$(curl -m5 -s -o /dev/null -w '%{http_code}' "http://$K3S0_IP:$NODEPORT/health" || echo 000)
+# 第一行 = 两个 HTTP 码,其后 = /health 体(后端位在里面:200 + 401 测不出「服务在内存里跑」,验收必须读那一位)
+SMOKE_OUT=$(rsudo 0 <<EOF
+HB=\$(curl -m5 -s -w '\n%{http_code}' "http://$K3S0_IP:$NODEPORT/health" || printf '\n000')
+H="\${HB##*\$'\n'}"
 A=\$(curl -m5 -s -o /dev/null -w '%{http_code}' "http://$K3S0_IP:$NODEPORT/v1/runs" || echo 000)
 echo "health=\$H auth=\$A"
+printf '%s' "\${HB%\$'\n'*}"
 EOF
 )
+SMOKE="${SMOKE_OUT%%$'\n'*}"
 case "$SMOKE" in *"health=200 auth=401"*) : ;; *) die "smoke 失败:$SMOKE(期望 health=200 auth=401)" ;; esac
-log "smoke ✓ $SMOKE"
+BK_WHY=$(health_backend_check "${SMOKE_OUT#*$'\n'}") || die "smoke 失败:$BK_WHY。下一步:kubectl -n sema logs deploy/sema-server(引擎在库没连上时不会再退内存起服 —— 它会拒启;读到 memory 多半是旧镜像)"
+log "smoke ✓ $SMOKE backend=$SEMA_UP_EXPECT_SESSION_BACKEND"
 cat >&2 <<EOF
 
 ══════════ cluster-up 完成($MACHINE_COUNT 节点)══════════

package/deploy/sema-up/kube-up.sh

@@ -9,7 +9,7 @@
 # 输入(sema-up.sh 注入;也可单独跑):
 #   WORK(状态目录)PROJECT REGION KUBE_MODE [KUBECONFIG_PATH] [DRY_RUN]
 #   USERS REGISTRY_ENABLED GIT_MODE [GIT_URL GIT_TOKEN]
-#   SEMA_SERVER_IMAGE(必需)[SEMA_REGISTRY_IMAGE][GITEA_IMAGE]
+#   SEMA_SERVER_IMAGE(必需)[SEMA_REGISTRY_IMAGE][GITEA_IMAGE][MINIO_IMAGE(整条引用,换国内源用;缺省 = chart 钉死的 tag)]
 #   MODEL_GATEWAY_BASEURL MODEL_ID MODEL_API_KEY
 #   [NAMESPACE=sema][STORAGE_CLASS=集群默认][CNPG_VERSION]
 set -euo pipefail
@@ -33,6 +33,10 @@ unset _self _hops _dir
 . "$HERE/lib/shell-access.sh"
 # 取值旗的形(S-621):判据与词表同 sema-up.sh 一处定义。
 . "$HERE/lib/flagshape.sh"
+# 引擎 /health 体里「落在哪个后端」的读法与期望值(smoke.sh / cluster-up.sh 同一只)。
+. "$HERE/lib/health.sh"
+# 对象存储桶的唯一表(sema-up.sh / cluster-up.sh / smoke.sh 同读这一张)。
+. "$HERE/lib/buckets.sh"
 log() { printf '[kube-up] %s\n' "$*" >&2; }
 die() { log "⛔ $*"; exit 1; }
 
@@ -214,6 +218,7 @@ helm_values() { # helm_values <giteaBaseUrl> <oauthId> <oauthSecret>
   V_REG_PW="${REGISTRY_ADMIN_PASSWORD:-}" V_REG_SS="${REGISTRY_SESSION_SECRET:-}" V_REG_PT="${REGISTRY_PULL_TOKEN:-}" \
   V_GITEA_ENABLED="$([ "$GIT_MODE" = provision ] && echo true || echo false)" \
   V_GITEA_IMAGE="${GITEA_IMAGE:-gitea/gitea:1.24}" V_NODE_IP="$NODE_IP" \
+  V_MINIO_IMAGE="${MINIO_IMAGE:-}" \
   python3 - <<'PY'
 import json, os
 e = os.environ
@@ -244,6 +249,8 @@ v = {
   "gitea": {"enabled": e["V_GITEA_ENABLED"] == "true", "image": e["V_GITEA_IMAGE"],
             "storageClass": e["V_SC"], "domain": e["V_NODE_IP"]},
 }
+# MinIO 镜像:给了才递(默认只在 chart values.yaml 写一处,不在脚本里再抄一份);国内源 = 整条引用
+if e["V_MINIO_IMAGE"]: v["minio"]["image"] = e["V_MINIO_IMAGE"]
 print(json.dumps(v))
 PY
 }
@@ -317,6 +324,12 @@ done
 [ -n "$TOK" ] || die "sema-runner-token 未被控制器填充。下一步:kubectl -n sema-sandbox get secret,sa"
 printf '%s' "$TOK" | base64 -d | $KUBECTL create secret generic sema-runner-token-copy -n "$NAMESPACE" \
   --from-file=token=/dev/stdin --dry-run=client -o yaml | $KUBECTL apply -f - >/dev/null
+$KUBECTL rollout status deployment/sema-minio -n "$NAMESPACE" --timeout=300s >/dev/null
+# MinIO 建桶(幂等;备份桶+引擎桶,清单只在 lib/buckets.sh 一处)。引擎起服会核快照桶在不在,所以建桶排在等 PG healthy 与等 server rollout 之前
+# (MinIO 不依赖 PG;PG 冷启可要几分钟,不该把引擎的等桶窗耗掉)
+$KUBECTL exec deploy/sema-minio -n "$NAMESPACE" -- sh -c \
+  "mc alias set local http://localhost:9000 sema \"\$MINIO_ROOT_PASSWORD\" >/dev/null && mc mb --ignore-existing $(buckets_prefixed local/ $(buckets_k8s))" >/dev/null \
+  || die "MinIO 建桶失败。下一步:kubectl -n $NAMESPACE logs deploy/sema-minio"
 # PG healthy(冷启拉镜像+init 可要几分钟)
 s=""
 for t in $(seq 1 120); do
@@ -324,11 +337,6 @@ for t in $(seq 1 120); do
   [ "$s" = "Cluster in healthy state" ] && break; sleep 5
 done
 [ "$s" = "Cluster in healthy state" ] || { $KUBECTL get cluster -n "$NAMESPACE" >&2 || true; die "PG 未达 healthy。下一步:kubectl -n $NAMESPACE describe cluster sema-pg;PVC Pending 时查 StorageClass"; }
-$KUBECTL rollout status deployment/sema-minio -n "$NAMESPACE" --timeout=300s >/dev/null
-# MinIO 建桶(幂等;备份桶+对象桶)
-$KUBECTL exec deploy/sema-minio -n "$NAMESPACE" -- sh -c \
-  "mc alias set local http://localhost:9000 sema \"\$MINIO_ROOT_PASSWORD\" >/dev/null && mc mb --ignore-existing local/sema-pg-backup local/workspaces local/blobs local/backups" >/dev/null \
-  || die "MinIO 建桶失败。下一步:kubectl -n $NAMESPACE logs deploy/sema-minio"
 $KUBECTL rollout status deployment/sema-server -n "$NAMESPACE" --timeout=600s >/dev/null || die "sema-server 未就绪。下一步:kubectl -n $NAMESPACE logs deploy/sema-server(常见:镜像拉取失败→imagePullSecrets/私仓凭据)"
 
 # ── Gitea 引导(provision:管理员/token/OAuth app;全部 in-pod 动作,不依赖 NodePort 可达)──
@@ -379,30 +387,35 @@ fi
 
 # ── smoke(port-forward 直验——kind/远程 kubeconfig 下 NodePort 对本机不可达,别靠它)──
 log "5/6 smoke"
-smoke_pf() { # smoke_pf <svc> <port> <path> → http code
-  local pf_pid code
+smoke_pf() { # smoke_pf <svc> <port> <path> → 第一行 http code,其后是响应体(调用方按需取)
+  local pf_pid out code body
   $KUBECTL port-forward "svc/$1" -n "$NAMESPACE" "1$2:$2" >/dev/null 2>&1 &
   pf_pid=$!
   sleep 2
-  code=$(curl -m5 -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:1$2$3" || echo 000)
+  out=$(curl -m5 -s -w '\n%{http_code}' "http://127.0.0.1:1$2$3" || printf '\n000')
   kill $pf_pid 2>/dev/null; wait $pf_pid 2>/dev/null || true
-  printf '%s' "$code"
+  code="${out##*$'\n'}"; body="${out%$'\n'*}"
+  [ "$out" = "$code" ] && body=""   # 没有换行 = 只有码(假 curl / 空体)
+  printf '%s\n%s' "$code" "$body"
 }
-H=$(smoke_pf sema-server 8090 /health)
+HR=$(smoke_pf sema-server 8090 /health)
+H="${HR%%$'\n'*}"
 [ "$H" = "200" ] || die "smoke 失败:server /health=$H(期望 200)。下一步:kubectl -n $NAMESPACE logs deploy/sema-server"
-A=$(smoke_pf sema-server 8090 /v1/runs)
+# /health 200 ≠ 数据落了库:后端位必须是期望的持久后端(durable(pg));读到 memory = 服务在内存里跑、重启即丢,不许判绿
+BK_WHY=$(health_backend_check "${HR#*$'\n'}") || die "smoke 失败:$BK_WHY。下一步:kubectl -n $NAMESPACE logs deploy/sema-server(引擎在库没连上时不会再退内存起服 —— 它会拒启;读到 memory 多半是旧镜像)"
+A=$(smoke_pf sema-server 8090 /v1/runs); A="${A%%$'\n'*}"
 [ "$A" = "401" ] || die "smoke 失败:无 token /v1/runs=$A(期望 401=auth 门在)。SERVICE_AUTH_TOKEN 未生效=裸奔,立刻查"
 R="n/a"
 if [ "$REGISTRY_ENABLED" = "true" ]; then
-  R=$(smoke_pf sema-registry 3000 /api/healthz)
+  R=$(smoke_pf sema-registry 3000 /api/healthz); R="${R%%$'\n'*}"
   [ "$R" = "200" ] || die "smoke 失败:registry healthz=$R。下一步:kubectl -n $NAMESPACE logs deploy/sema-registry"
 fi
 G="n/a"
 if [ "$GIT_MODE" = "provision" ]; then
-  G=$(smoke_pf sema-gitea 3000 /api/healthz)
+  G=$(smoke_pf sema-gitea 3000 /api/healthz); G="${G%%$'\n'*}"
   [ "$G" = "200" ] || die "smoke 失败:gitea healthz=$G"
 fi
-log "smoke ✓ health=$H auth=$A registry=$R gitea=$G"
+log "smoke ✓ health=$H backend=$(health_session_backend "${HR#*$'\n'}") auth=$A registry=$R gitea=$G"
 
 # ── summary(一屏;凭据一次性显示)────────────────────────────────────────────────
 log "6/6 完成"
@@ -414,7 +427,7 @@ log "6/6 完成"
   echo "           本机不可达 NodePort 时(kind/远程):kubectl -n $NAMESPACE port-forward svc/sema-server 8090:8090"
   # 壳对 NodePort 的明文 http 按设计拒连(非回环要 https)⇒ 经 port-forward 带到本机回环再 connect。
   shell_access_text "$ENVF" "装了 kubectl、能连这个集群的机器上:" "kubectl -n $NAMESPACE port-forward svc/sema-server 8090:8090" "http://127.0.0.1:8090"
-  echo " 数据      CNPG sema-pg×$PG_INSTANCES($PG_AA)+ MinIO(桶:workspaces/blobs/backups/sema-pg-backup)"
+  echo " 数据      CNPG sema-pg×$PG_INSTANCES($PG_AA)+ MinIO(桶:$(buckets_k8s | tr ' ' '/'))"
   if [ "$REGISTRY_ENABLED" = "true" ]; then
     echo " 配置中心  NodePort 30300 → http://$NODE_IP:30300"
     if $NEW_REG_PW; then echo "           首登:${REGISTRY_ADMIN_USER:-zhaoheran} / ${REGISTRY_ADMIN_PASSWORD}(⚠ 只显示这一次,之后看 .env)"

package/deploy/sema-up/lib/buckets.sh

@@ -0,0 +1,21 @@
+# lib/buckets.sh — 部署侧「要预置哪些对象存储桶」的唯一表。sema-up.sh(compose 建桶 / 外接 S3 建桶 / 汇总)、kube-up.sh、cluster-up.sh(k8s 建桶)与
+# smoke.sh(验桶)都读这一张,不各写一份串:各写一份的下场是清单漏一只桶,而漏桶的症状是起服后每一次对象写 / 每一拍 sweep 都 404。
+#
+# server **不建桶**(docs/DEPLOY-PREREQS.md「对象存储桶」),引擎起服只核一次快照桶在不在、不在就拒启 —— 所以这张表必须包含引擎要用的每一只:
+#  · `session-snapshots` = 引擎的 `SESSION_SNAPSHOT_BUCKET` 缺省名(snapshot-BLOB offload + SendUserFile 私有 presigned 轨 / 沙箱 staging);
+#    由测试把这个名与引擎的缺省逐字咬合(引擎改缺省而这里没跟 ⇒ 红);
+#  · `sema-public`(SendUserFile 永久公链轨)**不在表里**:它要匿名 GetObject-only 策略,是运维另配的桶,脚本不替人开匿名读。
+SEMA_UP_ENGINE_BUCKETS="workspaces blobs backups session-snapshots"
+# CNPG 的 WAL 归档 / 每日基备桶(只有 k8s 两条路径有 PG 备份;名与 chart values 的 `pg.backup.bucket: s3://<名>/` 同名,由测试咬合)。
+SEMA_UP_PG_BACKUP_BUCKET="sema-pg-backup"
+
+# buckets_k8s → 打印 k8s 路径(kube-up / cluster-up)要建的全部桶,空格分隔,每只一次。
+buckets_k8s() { printf '%s %s' "$SEMA_UP_PG_BACKUP_BUCKET" "$SEMA_UP_ENGINE_BUCKETS"; }
+
+# buckets_prefixed <前缀> <桶…> → 每个桶名前加前缀(mc 的 `<别名>/<桶>` 写法),空格分隔。桶名是 S3 闭字符集,不含空白,按空白拆是安全的。
+buckets_prefixed() {
+  local p="$1" b out=""
+  shift
+  for b in "$@"; do out="$out$p$b "; done
+  printf '%s' "${out% }"
+}

package/deploy/sema-up/lib/health.sh

@@ -0,0 +1,33 @@
+# lib/health.sh — 「装好的引擎 /health 体说它真落在哪个后端」的唯一读法 + sema-up 部署的期望值。
+# smoke.sh / kube-up.sh / cluster-up.sh 三处验收都调它,不各写一份(各写一份的下场:有一处还只看 HTTP 200,把退到内存的服务判绿)。
+#
+# 事实(出处是引擎,不是推测):
+#  · `/health` 体里的 `sessionBackend` 是**装配后**的有效店:`durable(<kind>)`(kind = pg | mysql | local)或 `memory`
+#    (引擎侧只有一只读法:src/store-posture.ts 的 `sessionStoreLabelOf`);
+#  · sema-up 三条路径(compose / kube / 多机)起的引擎一律 `DB_BACKEND=pg`(stack/compose.yaml、chart/templates/server.yaml、
+#    stack/sema-stack-cluster.yaml 逐份写死),所以装好的引擎必须读到 `durable(pg)`。读到 `memory` = 会话 / 停驻 / run 账本在进程内存里、
+#    重启即丢 —— /health 照样 200、401 门照样在,只有这一位说了实话,验收必须看它。
+SEMA_UP_EXPECT_SESSION_BACKEND="durable(pg)"
+
+# health_session_backend <health 体> → 打印 `sessionBackend` 的值;体读不成 JSON / 没有这一位 ⇒ 打印空串(调用方按「读不出」处置,不猜)。
+health_session_backend() {
+  printf '%s' "$1" | python3 -c 'import json,sys
+try:
+  v = json.load(sys.stdin).get("sessionBackend", "")
+  print(v if isinstance(v, str) else "")
+except Exception:
+  print("")' 2>/dev/null
+}
+
+# health_backend_check <health 体> → 0 = 落在期望的后端;1 = 不是(stdout 打一句人话,供调用方拼进失败行)。
+health_backend_check() {
+  local got
+  got="$(health_session_backend "$1")"
+  if [ "$got" = "$SEMA_UP_EXPECT_SESSION_BACKEND" ]; then return 0; fi
+  if [ -z "$got" ]; then
+    printf '/health 体里读不出 sessionBackend(期望 %s)' "$SEMA_UP_EXPECT_SESSION_BACKEND"
+  else
+    printf '/health.sessionBackend=%s,期望 %s' "$got" "$SEMA_UP_EXPECT_SESSION_BACKEND"
+  fi
+  return 1
+}

package/deploy/sema-up/sema-up.sh

@@ -34,6 +34,8 @@ unset _self _hops _dir
 . "$HERE/lib/shell-access.sh"
 # 取值旗的形(S-621):判据与词表(--profile / --users / --region / --git / --kube)的唯一定义;--help 的词表也从这里渲。
 . "$HERE/lib/flagshape.sh"
+# 对象存储桶的唯一表(kube-up.sh / cluster-up.sh / smoke.sh 同读这一张)。
+. "$HERE/lib/buckets.sh"
 # 日志一律打到 stderr(stdout 留给 --interactive=json 的协议行)。定义在最前面:参数一解析完就要判形,那时下面的函数都还没定义。
 log() { printf '[sema-up] %s\n' "$*" >&2; }
 # 执行车道表的唯一读者(S-599)。定义在**最前面**:`--help` 的词表也从表渲(手抄的词表会在加一条
@@ -647,7 +649,7 @@ if $DRY_RUN; then
     [ "$GIT_MODE" = "provision" ] && echo "   2. 先起 Gitea → 引导管理员+access token$([ "$REGISTRY_ENABLED" = "true" ] && printf '+OAuth app(接 registry 登录)')"
     [ -n "$PG_URL$S3_ENDPOINT" ] && echo "   2b. 外接端点连接检测(PG=真 select 1;S3=兼容协议 ls+建桶;证书不校验)"
     echo "   3. docker compose up -d --wait(profiles=$COMPOSE_PROFILES)$([ -n "$DATA_ROOT" ] && printf ';数据卷 bind → %s' "$DATA_ROOT")"
-    case ",$COMPOSE_PROFILES," in *,s3,*) echo "   4. MinIO 建桶 workspaces/blobs/backups(幂等)" ;; esac
+    case ",$COMPOSE_PROFILES," in *,s3,*) echo "   4. MinIO 建桶 ${SEMA_UP_ENGINE_BUCKETS// //}(幂等)" ;; esac
     [ "$GIT_MODE" = "connect" ] && echo "   +. 验证 $GIT_URL 连通(Gitea→GitHub→通用 git 探测链,证书不校验;Gitea=自动建 OAuth app,其余=打印待人工项)"
     echo "   5. 装后即验(PG/S3$([ "$PROFILE" != "data-center" ] && printf '/引擎 health')$([ "$REGISTRY_ENABLED" = "true" ] && printf '/registry healthz')$([ "$GIT_MODE" = "provision" ] && printf '/gitea healthz'))+ 一屏 summary"
     echo " 端口: $PF_PORTS(bind:数据面 $([ "$PROFILE" = "data-center" ] && echo 0.0.0.0 || echo 127.0.0.1);服务/registry/git 0.0.0.0)"
@@ -874,9 +876,9 @@ fi
 if [ -n "$S3_ENDPOINT" ]; then
   log "外接 S3 连接检测($S3_ENDPOINT)"
   S3OK=$(docker run --rm --entrypoint sh -e MC_HOST_x="$(printf '%s' "$S3_ENDPOINT" | sed "s#://#://$S3_ACCESS_KEY:$S3_SECRET_KEY@#")" \
-    "${MC_IMAGE:-minio/mc:latest}" -c 'mc --insecure ls x/ >/dev/null 2>&1 && mc --insecure mb --ignore-existing x/workspaces x/blobs x/backups >/dev/null 2>&1 && echo S3_OK' 2>/dev/null | tail -1)
+    "${MC_IMAGE:-minio/mc:latest}" -c "mc --insecure ls x/ >/dev/null 2>&1 && mc --insecure mb --ignore-existing $(buckets_prefixed x/ $SEMA_UP_ENGINE_BUCKETS) >/dev/null 2>&1 && echo S3_OK" 2>/dev/null | tail -1)
   [ "$S3OK" = "S3_OK" ] || { log "⛔ 外接 S3 连不上或建桶失败。下一步:核对 endpoint/密钥;需要 S3 兼容协议(MinIO/OSS/COS/R2 等);证书问题已用 --insecure 忽略,若还不通多半是网络/密钥"; exit 1; }
-  log "外接 S3 就绪(workspaces/blobs/backups 已确保)"
+  log "外接 S3 就绪(${SEMA_UP_ENGINE_BUCKETS// //} 已确保)"
 fi
 
 # ── git=provision:先起 Gitea 并引导(OAuth app 的 client id/secret 要在 registry 起来之前
@@ -1005,13 +1007,16 @@ fi
 # D(S-618):up 之前先 `compose config` 渲染对账 —— 容器真正拿到的决策键与本次决策逐值对齐才 up。
 reconcile_render
 log "装配:docker compose profiles=$COMPOSE_PROFILES project=$PROJECT"
-COMPOSE_PROFILES="$COMPOSE_PROFILES" compose up -d --wait --remove-orphans \
-  || { log "⛔ compose up 失败。下一步:docker compose -p $PROJECT logs(常见:镜像拉取失败→检查镜像引用/docker login;端口占用→--port 换口)"; exit 1; }
-# 建桶(幂等,一次性动作归 Layer 0;只对本地 MinIO——外接 S3 已在连接检测时确保)
+# 建桶(幂等,一次性动作归 Layer 0;只对本地 MinIO——外接 S3 已在连接检测时确保)。🔴 排在**全栈 up 之前**:引擎起服会核快照桶在不在
+# (缺则拒启),而 `up --wait` 要等引擎健康 —— 桶建在 up 之后,新数据卷上就是引擎等桶、compose 等引擎的互等。所以先只起 MinIO(`--wait` 等它健康)、建桶,再起全栈。
 envf_load MINIO_PASSWORD   # A:回读生成的 MinIO 口令(建桶用),不 source .env
 case ",$COMPOSE_PROFILES," in *,s3,*)
-  docker run --rm --network "${PROJECT}_default" -e MC_HOST_x="http://sema:${MINIO_PASSWORD}@minio:9000" "${MC_IMAGE:-minio/mc:latest}" mb --ignore-existing x/workspaces x/blobs x/backups >/dev/null || { log "⛔ MinIO 建桶失败。下一步:docker compose -p $PROJECT logs minio"; exit 1; } ;;
+  COMPOSE_PROFILES="$COMPOSE_PROFILES" compose up -d --wait minio \
+    || { log "⛔ MinIO 启动失败。下一步:docker compose -p $PROJECT logs minio(常见:镜像拉取失败→检查镜像引用/docker login)"; exit 1; }
+  docker run --rm --network "${PROJECT}_default" -e MC_HOST_x="http://sema:${MINIO_PASSWORD}@minio:9000" "${MC_IMAGE:-minio/mc:latest}" mb --ignore-existing $(buckets_prefixed x/ $SEMA_UP_ENGINE_BUCKETS) >/dev/null || { log "⛔ MinIO 建桶失败。下一步:docker compose -p $PROJECT logs minio"; exit 1; } ;;
 esac
+COMPOSE_PROFILES="$COMPOSE_PROFILES" compose up -d --wait --remove-orphans \
+  || { log "⛔ compose up 失败。下一步:docker compose -p $PROJECT logs(常见:镜像拉取失败→检查镜像引用/docker login;端口占用→--port 换口)"; exit 1; }
 
 # ── 验证(装后即验,§3d smoke 的子集;全量随时可跑 smoke.sh --project=$PROJECT)──────────────
 # A:回读验证 / 汇总要用的凭据与登记值(不 source .env);缺的键回读成空,由下游 :- 缺省处置。
@@ -1066,9 +1071,9 @@ else
     esac
     [ -n "$PG_URL" ] && echo " PG(外接) $EXT_PG_HOST:$EXT_PG_PORT/$EXT_PG_DB(连接检测已过;凭据在 .env)"
     case ",$COMPOSE_PROFILES," in *,s3,*)
-      echo " S3/MinIO  http://$HOSTIP:$MINIO_PORT(console :$MINIO_CONSOLE_PORT,桶×$V_BK:workspaces/blobs/backups)" ;;
+      echo " S3/MinIO  http://$HOSTIP:$MINIO_PORT(console :$MINIO_CONSOLE_PORT,桶×$V_BK:${SEMA_UP_ENGINE_BUCKETS// //})" ;;
     esac
-    [ -n "$S3_ENDPOINT" ] && echo " S3(外接) $S3_ENDPOINT(连接检测+三桶已确保;密钥在 .env)"
+    [ -n "$S3_ENDPOINT" ] && echo " S3(外接) $S3_ENDPOINT(连接检测+引擎桶已确保;密钥在 .env)"
     case ",$COMPOSE_PROFILES," in *,agent,*)
       echo " 引擎      http://$HOSTIP:$SERVER_PORT(/health: $V_HEALTH;API 凭据=SERVICE_AUTH_TOKEN)"
       compose_shell_access_text "$SERVER_PORT" ;;

package/deploy/sema-up/smoke.sh

@@ -22,6 +22,10 @@ unset _self _hops _dir
 . "$HERE/lib/envf.sh"
 # 取值旗的形(S-621):判据同 sema-up.sh 一处定义。
 . "$HERE/lib/flagshape.sh"
+# 引擎 /health 体里「落在哪个后端」的读法与期望值(kube-up / cluster-up 的验收同一只)。
+. "$HERE/lib/health.sh"
+# 对象存储桶的唯一表(sema-up.sh / kube-up.sh / cluster-up.sh 的建桶清单同读这一张)。
+. "$HERE/lib/buckets.sh"
 log() { printf '[smoke] %s\n' "$*" >&2; }
 
 PROJECT="" URL="" TOKEN=""
@@ -68,9 +72,10 @@ if [ -n "$PROJECT" ]; then
   # 哨兵判定(cat 回读值核对后 echo),不依赖各 mc 子命令的输出行为
   S3RT=$(docker run --rm --entrypoint sh --network "${PROJECT}_default" -e MC_HOST_x="http://sema:${MINIO_PASSWORD}@minio:9000" "${MC_IMAGE:-minio/mc:latest}" -c 'echo smoke > /tmp/s && mc cp /tmp/s x/blobs/_smoke >/dev/null && [ "$(mc cat x/blobs/_smoke)" = smoke ] && mc rm x/blobs/_smoke >/dev/null && echo S3_ROUNDTRIP_OK' 2>/dev/null | tail -1)
   [ "$S3RT" = "S3_ROUNDTRIP_OK" ] && ok "S3 put/get/rm 往返" || fail "S3" "对象读写失败" "docker compose -p $PROJECT logs minio"
-  # ③b 三个约定桶逐个点名(data-center 验收:ls 行数≠桶名对——错桶也会凑数)
-  BKTS=$(docker run --rm --entrypoint sh --network "${PROJECT}_default" -e MC_HOST_x="http://sema:${MINIO_PASSWORD}@minio:9000" "${MC_IMAGE:-minio/mc:latest}" -c 'for b in workspaces blobs backups; do mc ls "x/$b" >/dev/null 2>&1 && printf "%s " "$b"; done' 2>/dev/null)
-  [ "$BKTS" = "workspaces blobs backups " ] && ok "桶就绪(workspaces/blobs/backups)" || fail "桶" "缺桶:应有 workspaces/blobs/backups,实有 ${BKTS:-无}" "重跑 sema-up.sh(建桶幂等)"
+  # ③b 引擎桶逐个点名(data-center 验收:ls 行数≠桶名对——错桶也会凑数;清单 = lib/buckets.sh 那一张表)
+  BKTS=$(docker run --rm --entrypoint sh --network "${PROJECT}_default" -e MC_HOST_x="http://sema:${MINIO_PASSWORD}@minio:9000" "${MC_IMAGE:-minio/mc:latest}" -c "for b in $SEMA_UP_ENGINE_BUCKETS; do mc ls \"x/\$b\" >/dev/null 2>&1 && printf \"%s \" \"\$b\"; done" 2>/dev/null)
+  BKTS_WANT="$(printf '%s ' $SEMA_UP_ENGINE_BUCKETS)"
+  [ "$BKTS" = "$BKTS_WANT" ] && ok "桶就绪(${SEMA_UP_ENGINE_BUCKETS// //})" || fail "桶" "缺桶:应有 ${SEMA_UP_ENGINE_BUCKETS// //},实有 ${BKTS:-无}" "重跑 sema-up.sh(建桶幂等)"
   fi
   # 外接数据面(--pg-url/--s3-endpoint):有 endpoint 就远程直验(证书不校验)
   if [ -n "${AGENT_PG_HOST:-}" ] && ! $HAS_PG && [ "${DEPLOY_PROFILE:-}" != "local-plus" ]; then
@@ -100,9 +105,14 @@ except Exception: print("")' 2>/dev/null)
 fi
 
 if [ -n "$URL" ]; then
-  # ④ /health
-  H=$(curl -m5 -s "$URL/health" | head -c 200)
-  case "$H" in *'"status":"ok"'*) ok "/health($URL)" ;; *) fail "/health" "无响应或非 ok:${H:-空}" "服务没起/端口不对/防火墙;docker logs 或 systemctl 看进程" ;; esac
+  # ④ /health(整体取回:后端位在体的中后段,截断读会丢它)
+  H=$(curl -m5 -s "$URL/health")
+  case "$H" in *'"status":"ok"'*) ok "/health($URL)" ;; *) fail "/health" "无响应或非 ok:$(printf '%s' "${H:-空}" | head -c 200)" "服务没起/端口不对/防火墙;docker logs 或 systemctl 看进程" ;; esac
+  # ④′ 后端位:/health 200 ≠ 数据落了库 —— 引擎的 sessionBackend 必须是期望的持久后端(durable(pg)),`memory` = 内存里跑、重启即丢
+  case "$H" in *'"status":"ok"'*)
+    if BK_WHY=$(health_backend_check "$H"); then ok "引擎后端(sessionBackend=$SEMA_UP_EXPECT_SESSION_BACKEND)"
+    else fail "引擎后端" "$BK_WHY" "库没连上时引擎不会再退内存起服(拒启);读到 memory 多半是旧镜像或手工起的引擎 —— 看 docker logs / kubectl logs 的 store_sql_open_wait 与拒启句"; fi ;;
+  esac
   if [ -n "$TOKEN" ]; then
     # ⑤ auth 门:无 token 必须 401(部署安全底线)
     C=$(curl -m5 -s -o /dev/null -w '%{http_code}' -X POST "$URL/v1/tasks" -H "Content-Type: application/json" -d '{}')

package/deploy/sema-up/stack/compose.yaml

@@ -33,7 +33,7 @@ services:
       retries: 20
 
   minio:
-    image: ${MINIO_IMAGE:-minio/minio:latest}
+    image: ${MINIO_IMAGE:-minio/minio:RELEASE.2025-09-07T16-13-09Z}
     profiles: ["data", "s3"]
     restart: unless-stopped
     # 单机=单盘模式(§3c:显式无冗余;集群形态才上 EC)

package/deploy/sema-up/stack/sema-stack-cluster.yaml

@@ -77,7 +77,8 @@ spec:
     spec:
       containers:
         - name: minio
-          image: minio/minio:latest
+          image: minio/minio:RELEASE.2025-09-07T16-13-09Z
+          imagePullPolicy: IfNotPresent
           args: ["server", "/data", "--console-address", ":9001"]
           env:
             - { name: MINIO_ROOT_USER, valueFrom: { secretKeyRef: { name: sema-minio, key: rootUser } } }
@@ -155,6 +156,8 @@ spec:
           env:
             - { name: PORT, value: "8090" }
             - { name: DB_BACKEND, value: pg }
+            # 引擎 boot 期等库的窗(ms):CNPG 与 server Pod 同时起,库初始化常慢于 server 就绪 —— 窗内重试、到窗仍连不上才拒启(chart 的 server.storeWaitMs 同值)
+            - { name: STORE_LOCK_WAIT_MS, value: "300000" }
             - { name: SESSION_BACKEND, value: auto }
             - { name: PG_HOST, value: sema-pg-rw.sema.svc }
             - { name: PG_PORT, value: "5432" }

package/dist/approval-ask-audit-store.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { join } from "node:path";
-import { AppendLog, ensureDir } from "@sema-agent/core";
+import { AppendLog, ensureDir, isHostDecider } from "@sema-agent/core";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { replayJsonlSkipping } from "./observability/corrupt-read-seat.js";
 export const APPROVAL_ASK_AUDIT_DIR = "approval-ask-audit";
@@ -10,11 +10,6 @@ export const AUDIT_SHUTDOWN_CAUSE_WORDS = { shutdown_before_park: true };
 export function buildCheckpointAnchorHash(token) {
     return createHash("sha256").update(token, "utf8").digest("hex").slice(0, 16);
 }
-const HOST_DECIDED_BY_WORDS = ["person", "sla_timeout", "policy"];
-const HOST_DECIDED_BY = new Set(HOST_DECIDED_BY_WORDS);
-function isHostDecidedBy(v) {
-    return typeof v === "string" && HOST_DECIDED_BY.has(v);
-}
 function isAuditShutdownCause(v) {
     return typeof v === "string" && Object.hasOwn(AUDIT_SHUTDOWN_CAUSE_WORDS, v);
 }
@@ -123,7 +118,7 @@ function readLedgerRecord(u, noteOutOfSetSeat) {
             const decidedByV = o.decidedBy;
             const legacySettledByV = decidedByV === undefined ? o.settledBy : undefined;
             const legacySettledBy = legacySettledByV === "human" || legacySettledByV === "timeout" || legacySettledByV === "aborted" ? legacySettledByV : undefined;
-            const decidedBy = isHostDecidedBy(decidedByV) ? decidedByV : legacySettledBy !== undefined ? "person" : undefined;
+            const decidedBy = isHostDecider(decidedByV) ? decidedByV : legacySettledBy !== undefined ? "person" : undefined;
             const approver = s("approver");
             const settledAtMs = num("settledAtMs");
             const sessionId = s("sessionId");