@sema-agent/server 7.118.0 → 7.119.0

package/dist/bake-runner/protocol.js

@@ -33,6 +33,7 @@ export function synthDoneFrame(lineOrd, kind, detail) {
     }
     return { event: "done", lineOrd, status: "FAILED", exitCode: 124, error: detail?.error ?? "bake hard-deadline exceeded (killed)" };
 }
+export const STDERR_TAIL_LINES = 12;
 export function exitDoneFrame(lineOrd, exitCode, stderrTail) {
     const tail = stderrTail.trim();
     return {
@@ -40,13 +41,32 @@ export function exitDoneFrame(lineOrd, exitCode, stderrTail) {
         lineOrd,
         status: "FAILED",
         exitCode,
-        error: tail.length > 0 ? `build.sh exited ${exitCode}: ${lastLines(tail, 12)}` : `build.sh exited ${exitCode}`,
+        error: tail.length > 0 ? `build.sh exited ${exitCode}: ${lastLines(tail, STDERR_TAIL_LINES)}` : `build.sh exited ${exitCode}`,
     };
 }
+function contentLines(text) {
+    return text
+        .split(/\r?\n/)
+        .map((l) => l.replace(/\r$/, ""))
+        .filter((l) => l.length > 0);
+}
 export function lastLines(text, n) {
-    const lines = text.split(/\r?\n/).filter((l) => l.length > 0);
+    const lines = contentLines(text);
     return lines.slice(Math.max(0, lines.length - n)).join("\n");
 }
+export function createStderrTail() {
+    const lines = [];
+    return {
+        push(raw) {
+            for (const l of contentLines(raw)) {
+                lines.push(l);
+                if (lines.length > STDERR_TAIL_LINES)
+                    lines.shift();
+            }
+        },
+        text: () => lines.join("\n"),
+    };
+}
 export function deadlineMsForProfile(profile, bands) {
     const HEAVY_MS = 60 * 60 * 1000;
     const NORMAL_MS = 45 * 60 * 1000;

package/dist/bake-runner/runner.d.ts

@@ -11,10 +11,12 @@ export interface ClaimedBake {
     profile?: string | null;
     bands?: string[] | null;
 }
-/** The ingest/heartbeat response — image-api echoes whether a cancel was requested so the runner kills the group. */
-export interface IngestAck {
+/** The heartbeat response (a no-frame `…/ingest` POST) — image-api echoes whether a cancel was requested so the runner
+ *  kills the group, and whether the lease is still ours. The heartbeat is the ONE place these two bits are read
+ *  ({@link BakeRunner.runOne}'s supervisor); a frame ingest's ack has no reader, so `ingest` returns nothing. */
+export interface HeartbeatAck {
     accepted: boolean;
-    /** The durable cancel flag (§P2.11) — polled off EVERY ingest/heartbeat response (≤heartbeat-interval lag). */
+    /** The durable cancel flag (§P2.11) — read off each HEARTBEAT response (≤ heartbeat-interval lag). */
     cancelRequested?: boolean;
     /** False when the lease was lost/stolen (the runner aborts + kills the child — it no longer owns the build). */
     leaseValid?: boolean;
@@ -51,10 +53,11 @@ export interface ChildSpawner {
 export interface ImageApiClient {
     /** Long-poll for + claim the next queued bake; null when none is claimable right now. */
     claimNext(): Promise<ClaimedBake | null>;
-    /** POST one frame to `…/ingest` (carries the per-bake ingest secret header); returns the ack (cancel/lease). */
-    ingest(bakeId: string, ingestSecret: string, frame: Record<string, unknown>): Promise<IngestAck>;
-    /** Heartbeat the lease forward (also surfaces cancel/lease state) — distinct from a frame ingest. */
-    heartbeat(bakeId: string, ingestSecret: string): Promise<IngestAck>;
+    /** POST one frame to `…/ingest` (carries the per-bake ingest secret header). Resolves with nothing: the runner reads no
+     *  ack off a frame ingest (the cancel / lease bits are read off {@link ImageApiClient.heartbeat} only). */
+    ingest(bakeId: string, ingestSecret: string, frame: Record<string, unknown>): Promise<void>;
+    /** Heartbeat the lease forward and surface the cancel / lease state — the only call whose response the runner reads. */
+    heartbeat(bakeId: string, ingestSecret: string): Promise<HeartbeatAck>;
 }
 /** Host-side ops the runner needs that are NOT image-api calls (fs + a thin docker-push wrapper for the big-blob
  *  retry — NOT a build.sh --replay). All injected so the orchestration is testable off build-host. */
@@ -208,7 +211,8 @@ export declare class BakeRunner {
      *  reaper + a mid-build fill guard still protect the host). */
     private freeGbOrNull;
     /** Ingest one frame, swallowing transient errors (the buffered-retry of unsent lines is the real-runner's job;
-     *  image-api's uq_line makes a re-send a no-op, so a dropped frame is recoverable, never a crash). */
+     *  image-api's uq_line makes a re-send a no-op, so a dropped frame is recoverable, never a crash). Returns nothing:
+     *  the cancel / lease bits are read off the heartbeat response only, never off a frame ingest's ack. */
     private safeIngest;
 }
 /** Allocate the next per-bake lineOrd (monotonic from 1) — the at-least-once ingest dedupe key (§P2.10). */

package/dist/bake-runner/runner.js

@@ -1,5 +1,5 @@
 import { resolve as resolvePath } from "node:path";
-import { lineToFrame, dockerBuildTickFrame, synthDoneFrame, exitDoneFrame, deadlineMsForProfile, parseDfFreeGb, parseBuildShLine, manifestPathFromLine, } from "./protocol.js";
+import { lineToFrame, dockerBuildTickFrame, synthDoneFrame, exitDoneFrame, deadlineMsForProfile, parseDfFreeGb, parseBuildShLine, manifestPathFromLine, createStderrTail, } from "./protocol.js";
 const DEFAULT_HEARTBEAT_MS = 30_000;
 const DEFAULT_IDLE_POLL_MS = 5_000;
 const DEFAULT_MIN_FREE_GB = 20;
@@ -137,7 +137,7 @@ export class BakeRunner {
             await this.safeIngest(bake, exitDoneFrame(nextOrd(ord), 1, `recipe checkout failed: ${String(err)}`));
             return;
         }
-        const stderrTail = [];
+        const stderrTail = createStderrTail();
         let lastManifestPath = null;
         let lastImageTag = null;
         let sawDone = false;
@@ -166,10 +166,7 @@ export class BakeRunner {
                 }
                 enqueueIngest(lineToFrame(raw, nextOrd(ord)));
             },
-            onStderrLine: (raw) => {
-                if (stderrTail.length < 80)
-                    stderrTail.push(raw);
-            },
+            onStderrLine: (raw) => stderrTail.push(raw),
         });
         inFlight.child = child;
         const deadlineMs = deadlineMsForProfile(bake.profile ?? "custom", bake.bands ?? null);
@@ -230,7 +227,7 @@ export class BakeRunner {
             return;
         }
         const code = exit.code ?? (exit.signal ? 137 : 1);
-        await this.safeIngest(bake, exitDoneFrame(nextOrd(ord), code, stderrTail.join("\n")));
+        await this.safeIngest(bake, exitDoneFrame(nextOrd(ord), code, stderrTail.text()));
     }
     async forwardDone(bake, ord, doneLine, lastManifestPath, lastImageTag) {
         let line = doneLine;
@@ -309,11 +306,10 @@ export class BakeRunner {
     }
     async safeIngest(bake, frame) {
         try {
-            return await this.o.api.ingest(bake.bakeId, bake.ingestSecret, frame);
+            await this.o.api.ingest(bake.bakeId, bake.ingestSecret, frame);
         }
         catch (err) {
             this.o.log.warn("bake_ingest_error", { bakeId: bake.bakeId, lineOrd: frame.lineOrd, err: String(err) });
-            return null;
         }
     }
 }

package/dist/boot/config-center.js

@@ -624,7 +624,7 @@ export async function createConfigCenterRuntime(ctx) {
             if (effective?.skills && config.configCenter) {
                 skills = await applyCenterSkills(skills, effective.skills, config.configCenter, logger, undefined, configLkgEnabled() ? defaultSkillCacheDir() : undefined);
             }
-            if (effective?.plugins) {
+            if (effective?.plugins !== undefined) {
                 const pluginOut = await applyCenterPlugins(skills, effective, {
                     cacheRoot: join(config.localDataRoot ?? join(homedir(), ".ai-agent"), "plugin-cache"),
                     allowHosts: config.pluginsAllowHosts,

package/dist/boot/coordinators.js

@@ -1,6 +1,7 @@
 import { ElicitationCoordinator } from "../elicitation.js";
 import { QuestionCoordinator } from "../question.js";
 import { ToolApprovalCoordinator, resolveStreamApprovalGate } from "../tool-approval.js";
+import { deploymentListAsks } from "../approval.js";
 import { FileApprovalAskAuditStore } from "../approval-ask-audit-store.js";
 import { SendUserFileEmitter, SEND_USER_FILE_MAX_BYTES, sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { createSandboxFileSend, TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
@@ -58,7 +59,9 @@ export function createLiveCoordinators(ctx) {
             unattendedPolicy: config.unattendedApprovalPolicy,
             ...(getParkedRedeem !== undefined ? { parkedRedeem: getParkedRedeem } : {}),
             ...(approvalAskAudit !== undefined ? { askAudit: approvalAskAudit } : {}),
-            ...(approvalExemptionStore !== undefined ? { sessionGrants: approvalExemptionStore } : {}),
+            ...(approvalExemptionStore !== undefined
+                ? { sessionGrants: approvalExemptionStore, deploymentListAsks: (call) => deploymentListAsks(config, call) }
+                : {}),
             ...(parkCommits !== undefined ? { parkCommits } : {}),
         })
         : undefined;

package/dist/boot/device-lane.d.ts

@@ -59,9 +59,9 @@ export declare function createDeviceLane(ctx: DeviceLaneCtx): DeviceLane | undef
  * `boot/leader.ts` 的 `assertLeaderDurableStore`)。
  *
  * config 层的门①判的是「运维配没配 SQL 坐标」——那句话回答的是**意图**。它回答不了「这次启动**真的
- * 拿到**了店吗」:`openStoreBackendWithFallback` 在 `SESSION_BACKEND=auto` 下(🔴 S-866 注改真:`auto` **不是**缺省 ——
- * 缺省是 `memory`,`DB_BACKEND` 显式 mysql|pg 时缺省 `mysql`;`auto` 要显式写),SQL 连不上 /
- * 建表失败 ⇒ `backend=undefined` + 一条 warn 就继续启动。那次启动里 device lane 的四表整个不在,
+ * 拿到**了店吗」:`openStoreBackendWithFallback` 曾在 `SESSION_BACKEND=auto` 下,SQL 连不上 /
+ * 建表失败 ⇒ `backend=undefined` + 一条 warn 就继续启动(那条降级臂已退役:配了 DSN 的库窗内重试、到窗拒启,见 `plugins/store-open-wait.ts`;
+ * 仍走得到本门的形:`DB_BACKEND=mysql|pg` 声明了 SQL 而 `SESSION_BACKEND=memory`,刻意不持久 ⇒ 不开店)。那次启动里 device lane 的四表整个不在,
  * 而 `boot/execution-env.ts` 的第七臂拿不到三件 ⇒ `executionEnvFactory` 落 `undefined` ⇒ core 拿
  * `StubExecutionEnv`:**一台自称在员工设备上执行的 worker 实际在自己进程里跑,而且回执同形**。
  * 那正是 [ref]「执行车道禁静默降级」点名的样板病,也正是 A-1 那条临时门当初要拦的东西 —— 换执法点,

package/dist/boot/device-lane.js

@@ -40,8 +40,7 @@ export function assertDeviceLaneWired(isDeviceLane, lane, hasFactory) {
         return;
     if (!lane) {
         throw new Error("REMOTE_EXEC=device but the device lane could not be wired at boot [device-lane-unwired]: the SQL backend is " +
-            "configured yet this replica did not get one (an unreachable DB / failed DDL degrades to the in-memory fallback " +
-            "when SESSION_BACKEND=auto), so the device registry / session↔device binding / audit tables are absent. " +
+            "configured yet this replica did not get one, so the device registry / session↔device binding / audit tables are absent. " +
             "Refusing to serve a lane that would silently fall back to the in-process stub env — a worker claiming to " +
             "execute on the employee's device while actually running inside its own process (#157). Fix the database " +
             "(or unset REMOTE_EXEC) and restart (device-executor-lane-v2 §4.7)");

package/dist/boot/leader.d.ts

@@ -64,10 +64,10 @@ export declare function leaderK8sMinioGap(leaderEnabled: boolean, leaderProvider
  * [ref] 车4 件2 的**能力面**门(codex 交叉复审 R1-high①,验真后修)。
  *
  * config 层的门②判的是 `DB_BACKEND` 的字面值 —— 那句话回答的是「运维要没要 durable」。它回答不了
- * 「这次启动**真的拿到**了 durable 吗」:`openStoreBackendWithFallback` 在 `SESSION_BACKEND=auto`
- * 下(🔴 S-866 注改真:`auto` **不是**缺省 —— 缺省是 `memory`,`DB_BACKEND` 显式 mysql|pg 时缺省 `mysql`;`auto` 要显式写),SQL 连不上 /
- * 建表失败 ⇒ 返回 `backend=undefined` + 一条 warn 就继续启动。那次启动里
- * `leaderRun()` 缺席,leader 端点会静默落进单副本内存臂:多副本各自受理同一个 Idempotency-Key、
+ * 「这次启动**真的拿到**了 durable 吗」:`openStoreBackendWithFallback` 曾在 `SESSION_BACKEND=auto`
+ * 下,SQL 连不上 / 建表失败 ⇒ 返回 `backend=undefined` + 一条 warn 就继续启动(那条降级臂已退役:配了 DSN 的库窗内重试、到窗拒启,
+ * 见 `plugins/store-open-wait.ts`)。仍走得到本门的形:`DB_BACKEND=mysql|pg` 声明了 SQL 而 `SESSION_BACKEND=memory`(声明 pg、刻意不持久 ⇒ 不开店)。
+ * 那次启动里 `leaderRun()` 缺席,leader 端点会静默落进单副本内存臂:多副本各自受理同一个 Idempotency-Key、
  * 跨副本 GET 404、重启失忆 —— 而这条腿的产物是**真 git push**。
  *
  * ⇒ 判据锚**真拿到了没有**。纯谓词、只吃两个原语(与 {@link leaderK8sMinioGap} 同姿势),便于单测。

package/dist/boot/leader.js

@@ -15,8 +15,7 @@ export function assertLeaderDurableStore(leaderEnabled, hasLeaderRunStore) {
     if (!leaderEnabled || hasLeaderRunStore)
         return;
     throw new Error("LEADER_ENABLED=true but no durable leader-run store is available at boot — the SQL backend is configured " +
-        "yet this replica did not get one (an unreachable DB / failed DDL degrades to the in-memory fallback when " +
-        "SESSION_BACKEND=auto). Refusing to serve the leader endpoint from a single-replica in-memory registry: " +
+        "yet this replica did not get one. Refusing to serve the leader endpoint from a single-replica in-memory registry: " +
         "the `leader_run` table is what makes a retried submit idempotent and a cross-replica GET answerable, and " +
         "without it a retry starts a SECOND real git push. Fix the database (or unset LEADER_ENABLED) and restart " +
         "(#193 车4 件2 capability gate; the DB_BACKEND literal check in config.ts is the intent half of the same rule)");

package/dist/boot/parked-revive-gate.d.ts

@@ -3,6 +3,7 @@ import type { ServiceConfig } from "../config.js";
 import type { RunnerDepsOnAsk } from "./runner-deps.js";
 import { type ApprovalBaselineConfigView, type DeploymentGovernanceConfigView, type LiveQuestionFace } from "../deployment-governance.js";
 import { type SandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
+import type { ApprovalExemptionStore } from "../plugins/approval-exemption-store.js";
 /** 本腿读的配置切面(`ServiceConfig` 结构满足)。两个构造口各自的切面 + lane 判别式读的 `remoteExec`。 */
 export interface ParkedReviveGateConfigView extends DeploymentGovernanceConfigView, ApprovalBaselineConfigView {
     readonly remoteExec?: ServiceConfig["remoteExec"];
@@ -43,6 +44,8 @@ export interface ParkedReviveGateDeps {
      *    headless auto-deny,比「再问人一次」严且哑。交了之后最坏也是 park,方向 fail-safe。
      */
     readonly approverSeat: RunnerDepsOnAsk | undefined;
+    /** 会话豁免店(部署名单那一问的「本会话放行」读面;`StoreBackend.approvalExemption()` 结构满足)。缺席 = 部署没有 store backend ⇒ 名单照问。 */
+    readonly approvalExemptionStore: Pick<ApprovalExemptionStore, "has"> | undefined;
     /**
      * [ref] —— core `RunnerDeps.runtimeCapsResolver` 的**同一只**(main.ts 的 `runtimeCapsResolver`,
      * 单一属主同 `boot/runtime-caps.ts`)。重建条目的第三位决议链元数据 `autoModeArmed` 的唯一判据是
@@ -64,6 +67,7 @@ export interface ParkedReviveGateDeps {
      *  这一座可改读它 —— 接线不在本次提货单内,见 7.106.0 收车档「未闭环」。 */
     readonly parentAutoModeIntent?: ((row: BackgroundAgentRecord) => boolean) | undefined;
     readonly logger: {
+        info(event: string, fields?: Record<string, unknown>): void;
         warn(event: string, fields?: Record<string, unknown>): void;
     };
     /** host 腿 cwd 占位的落地根(main.ts 的 `localRoot`;`config.localDataRoot` 优先)。 */
@@ -90,7 +94,7 @@ export type RebuiltParentConstraint = NonNullable<RebuiltInheritedGate["parentCo
  * 赎回腿的父约束链重建([ref] 件二)。
  *
  * 语义:**同/跨副本一致地重建「部署 ⊇ 操作员」两层完整链**——审批基线(durable question 门 + F4 高危写
- * 审批门)作 base 的 `toolPolicy` 座,经**折叠属主** `applyRuntimeGovernance`
+ * 审批门 + 部署名单那一问的豁免读面)作 base 的 `toolPolicy` 座,经**折叠属主** `applyRuntimeGovernance`
  * (→ core `tightenTaskSpec`)叠上部署治理段(autonomy / commandPolicy / MANUAL_MODE_SHELL_GATE /
  * 守卫集),取其 `toolPolicy` 装进单层 `parentConstraints`。
  *

package/dist/boot/parked-revive-gate.js

@@ -6,11 +6,12 @@ import { createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from
 import { applyRuntimeGovernance } from "../runtime-governance.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
+import { createDeploymentListExemption } from "../approval.js";
 function hostGateCwd(config, localRoot) {
     return join(config.localDataRoot ?? localRoot, "parked-revive-unrooted");
 }
 export function createParkedReviveInheritedGate(deps) {
-    const { config, question, logger, localRoot, approverSeat, memoryEngineRoot } = deps;
+    const { config, question, approvalExemptionStore, logger, localRoot, approverSeat, memoryEngineRoot } = deps;
     const slots = deps.slots ?? sandboxPathEnvSlots;
     return async (row, identity) => {
         const metadata = await chainMetadataOf(deps, row, identity);
@@ -26,7 +27,12 @@ export function createParkedReviveInheritedGate(deps) {
                 ...homeBase,
             }
             : { env: createHostAdjudicationEnv(config, localRoot), ...homeBase };
-        const baseline = createApprovalBaselinePolicy(config, { kind: "durable", question });
+        const rootSessionId = row.rootSessionId;
+        const baseline = createApprovalBaselinePolicy(config, {
+            kind: "durable",
+            question,
+            ...(approvalExemptionStore !== undefined && rootSessionId ? { exemption: createDeploymentListExemption(approvalExemptionStore, rootSessionId, logger, "parked_revive") } : {}),
+        });
         const governed = applyRuntimeGovernance({ objective: "", toolPolicy: baseline }, createDeploymentGovernanceInputs(config, pathAdjudication, { engineDataRoot: memoryEngineRoot }));
         return {
             parentConstraints: [

package/dist/boot/resolve-spec.js

@@ -10,7 +10,7 @@ import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.j
 import { buildNoticeLaneFacts, shouldDiscloseNoPersistentMemory, withNoPersistentMemoryNotice } from "../capabilities/memory-notice.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildApprovalGrantNotice, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
-import { gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
+import { createDeploymentListExemption, gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
@@ -137,9 +137,8 @@ export function createResolveSpec(ctx) {
         return stamped;
     };
     const gateScenarioAndAppend = async (body, auth, opts) => {
-        const requested = gateScenarioRequest(await principalCaps?.scenarioRuling(auth?.principal), body.scenario, config.defaultScenario, Object.keys(scenarios), logger);
+        const scenarioName = gateScenarioRequest(await principalCaps?.scenarioRuling(auth?.principal), body.scenario, config.defaultScenario, Object.keys(scenarios), logger, auth?.principal);
         gateExecutionLane(await principalCaps?.executionRuling(auth?.principal), executionLaneOf(config.remoteExec?.provider), logger);
-        const scenarioName = scenarios[requested] ? requested : "default";
         const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, auth?.sessionId !== undefined ? { sessionId: auth.sessionId } : {});
         const centerDecls = getCenterPrompts()?.declarations;
         const appendLessPack = centerDecls
@@ -460,7 +459,11 @@ export function createResolveSpec(ctx) {
             a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), body.a2aPeers, config, logger),
             promptProvider: centerDecls ? centerPromptProvider(centerDecls, scenarioName) : cap.promptProvider,
             toolPolicy: toolPolicyForHands(hands, durableEnabled
-                ? createApprovalBaselinePolicy(config, { kind: "durable", question: liveQuestionFace })
+                ? createApprovalBaselinePolicy(config, {
+                    kind: "durable",
+                    question: liveQuestionFace,
+                    ...(approvalExemptionStore !== undefined && auth?.sessionId ? { exemption: createDeploymentListExemption(approvalExemptionStore, auth.sessionId, logger) } : {}),
+                })
                 : singleUserAutoAcceptBaselineApplies(config)
                     ? createApprovalBaselinePolicy(config, { kind: "absent" })
                     : undefined),

package/dist/boot/stage-07-capability-layer.js

@@ -10,7 +10,7 @@ import { buildForceDurableGateInertNotice, buildNoResponderBootWarns, gateIntent
 import { executionLaneOf } from "../execution-lane-caps.js";
 import { loadDeploymentSkills } from "../capabilities/skills.js";
 import { createRepoClient } from "../capabilities/repo-tools.js";
-import { buildScenarios, builtinScenarioDetails } from "../capabilities/scenarios.js";
+import { buildScenarios, builtinScenarioDetails, danglingScenarioRefusal } from "../capabilities/scenarios.js";
 import { RateLimiter } from "../observability/rate-limit.js";
 import { explicitOperatorOk } from "../http/server.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
@@ -169,6 +169,7 @@ export async function runStage07(ctx) {
             config, question, logger, localRoot,
             memoryEngineRoot: memoryEngine?.root,
             approverSeat: createRunnerDepsOnAsk(toolApproval),
+            approvalExemptionStore,
             ...(runnerDeps.runtimeCapsResolver ? { resolveRuntimeCaps: runnerDeps.runtimeCapsResolver } : {}),
             autoModeSeatMounted: runnerDeps.autoMode !== undefined,
         })
@@ -176,6 +177,9 @@ export async function runStage07(ctx) {
     const scenarioDetails = builtinScenarioDetails(scenarios, scenarioDeps);
     const builtinScenarioNames = Object.keys(scenarioDetails);
     configCenter.applyCenterScenarios({ scenarioDeps, scenarios, scenarioDetails, builtinScenarioNames });
+    const defaultScenarioRefusal = danglingScenarioRefusal(config.defaultScenario, "deployment", Object.keys(scenarios));
+    if (defaultScenarioRefusal !== undefined)
+        throw new Error(defaultScenarioRefusal);
     logger.info("capabilities", { skills: skills.length, scenarios: Object.keys(scenarios), repoTools: Boolean(repoClient) });
     return { ...ctx, approvalExemptionStore, approvalNonceStore, authorize, imageBakes, imageIndex, parkedReviveInheritedGate, parkedReviveSurface, rateLimiter, resumeAnchorStore, runStore, scenarioDetails, scenarios, selectEnvTool, taskLimitCaps, taskTimeoutSec, userInputLedger, userInputLedgerStore, webSearchProvider: webSearchCfg?.provider };
 }

package/dist/boot/stage-10-http-server.js

@@ -12,6 +12,7 @@ import { backgroundAgentOutput, taskHandleOutput, taskHandleStop } from "../runs
 import { SQL_BLOB_DEFAULT_MAX_BYTES } from "../plugins/blob-backend.js";
 import { createStoreLiveProbe } from "../store-live-probe.js";
 import { counterStoreLabel } from "../plugins/store-backend.js";
+import { sessionStoreLabelOf } from "../store-posture.js";
 import { startFleetClientFromEnv } from "../fleet-client.js";
 import { createCenterWiringReader } from "../capabilities/center-wiring.js";
 import { readinessOf } from "../http/readiness.js";
@@ -133,7 +134,7 @@ export async function runStage10(ctx) {
         ? createStoreLiveProbe({ probe: () => backend.dbNowMs(), intervalMs: config.storeProbeIntervalMs, logger })
         : undefined;
     const deployment = {
-        sessionStoreLabel: config.sessionBackend === "tidb" && backend ? `durable(${backend.kind})` : config.sessionBackend,
+        sessionStoreLabel: sessionStoreLabelOf(config.sessionBackend, backend?.kind),
         modelReady: () => configCenter.modelReady(),
         scenarioDetails,
         workflowsCapable,
@@ -269,7 +270,7 @@ export async function runStage10(ctx) {
         model: config.model.id,
         brain: brainSummary(config),
         breakerState: config.resilience.circuitBreaker ? (breakerState ? `shared(${backend.kind})` : "in-process") : "off",
-        session: config.sessionBackend === "tidb" && backend ? `durable(${backend.kind})` : config.sessionBackend,
+        session: sessionStoreLabelOf(config.sessionBackend, backend?.kind),
         memory: memoryEngine ? `engine(${memoryEngine.root})` : "off",
         instanceId,
         rateLimitPerMin: config.rateLimitPerMin,

package/dist/boot/stores.js

@@ -9,6 +9,7 @@ import { TiDBMemoryEngineBackend, ensureTiDBMemoryEngineSchema } from "../plugin
 import { PgMemoryHistoryStore, PgMemorySyncStore, ensurePgMemoryHistorySchema, ensurePgMemorySyncSchema } from "../plugins/memory-sync-store-pg.js";
 import { TiDBMemoryHistoryStore, TiDBMemorySyncStore, ensureTiDBMemoryHistorySchema, ensureTiDBMemorySyncSchema } from "../plugins/memory-sync-store-tidb.js";
 import { MinioBlobBackend } from "../plugins/blob-backend.js";
+import { ensureSnapshotBucket } from "../plugins/snapshot-bucket-presence.js";
 import { PgBackgroundAgentStore, TiDBBackgroundAgentStore, ensurePgBackgroundAgentSchema, ensureTiDBBackgroundAgentSchema } from "../plugins/background-agent-store-sql.js";
 import { PgMailboxStore, TiDBMailboxStore, ensurePgMailboxSchema, ensureTiDBMailboxSchema } from "../plugins/mailbox-store-sql.js";
 import { createDropOnlyRecipientLifecycle } from "../plugins/mailbox-recipient-lifecycle.js";
@@ -48,9 +49,12 @@ export async function openStores(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     let backend;
     let storeDegradedReason;
+    const dsnConfigured = !!(config.tidb || config.pg);
+    if (config.snapshotBlobStore)
+        await ensureSnapshotBucket(config.snapshotBlobStore, config.storeLockWaitMs, logger);
     const wantDb = config.sessionBackend === "tidb" ||
         config.dbBackend === "local" ||
-        (config.sessionBackend === "auto" && !!(config.tidb || config.pg));
+        (config.sessionBackend === "auto" && dsnConfigured);
     if (wantDb) {
         const opened = await openStoreBackendWithFallback(config, logger);
         backend = opened.backend;
@@ -111,7 +115,7 @@ export async function openStores(ctx) {
         metrics.setGauge("snapshot_blob_backend", 1, { backend: config.snapshotBlobStore ? "minio" : "sql" });
     }
     if (config.sessionBackend === "auto")
-        config.sessionBackend = backend ? "tidb" : "memory";
+        config.sessionBackend = dsnConfigured ? "tidb" : "memory";
     if (config.dbBackend === "local" && backend)
         config.sessionBackend = "tidb";
     let memoryEngine;
@@ -414,11 +418,12 @@ export async function openStores(ctx) {
     }
     const sessionStore = createSessionStore(config, backend, metrics);
     if (config.requirePrincipal && backend?.kind === "local") {
-        throw new Error("REQUIRE_PRINCIPAL=true is not supported on the local file backend (DB_BACKEND=local): session/run CONTENT is " +
-            "durable there, but OWNER attribution is process-local and lost on restart (store-backend.ts §0.5 — durable " +
-            "owners = P1), so it cannot durably enforce multi-tenant session ownership. Use a SQL backend " +
-            "(DB_BACKEND=mysql|pg) for multi-tenant, or run local single-user with REQUIRE_PRINCIPAL=false (a BFF may " +
-            "still inject x-agent-principal per request for memory scoping and audit attribution).");
+        throw new Error("REQUIRE_PRINCIPAL=true is not supported on the local file backend (DB_BACKEND=local): the lane is single-user " +
+            "by construction — a session created before owners were recorded is claimed by the FIRST principal that submits " +
+            "to it during the upgrade window, and the lane's mutual-recognition arms assume one user — so it cannot enforce " +
+            "a multi-tenant session boundary. Use a SQL backend (DB_BACKEND=mysql|pg) for multi-tenant, or run local " +
+            "single-user with REQUIRE_PRINCIPAL=false (a BFF may still inject x-agent-principal per request for memory " +
+            "scoping and audit attribution).");
     }
     if (backend)
         assertCloudSnapshotBlobPosture(backend.kind, config);

package/dist/capabilities/center-plugins.d.ts

@@ -97,6 +97,8 @@ export declare function materializablePlugins(eff: {
     url: string;
     sha?: string;
 }>;
+/** 总入口(条款 3/7/8):逐条物化 + 装载 + 让位合并。materialize 盘位 = `<cacheRoot>/<name>/live`
+ *  (成功后原子 rename 替换,失败保留旧盘位 = LKG)。 */
 export declare function applyCenterPlugins(baseline: LoadedSkill[], eff: {
     plugins?: unknown;
 }, opts: {

package/dist/capabilities/center-plugins.js

@@ -108,21 +108,39 @@ export function resolvePluginSkillsRoot(cloneRoot) {
     }
     return { ok: true, dir: candidate };
 }
+const PLUGINS_DOMAIN_FAILURE_NAME = "(plugins domain)";
 function declaredPlugins(eff) {
-    if (Array.isArray(eff.plugins))
-        return eff.plugins;
-    const wrapped = eff.plugins?.plugins;
-    return Array.isArray(wrapped) ? wrapped : [];
+    const domain = eff.plugins;
+    if (domain === undefined)
+        return { ok: true, decls: [] };
+    if (Array.isArray(domain))
+        return { ok: true, decls: domain };
+    if (typeof domain === "object" && domain !== null) {
+        const inner = domain.plugins;
+        if (Array.isArray(inner))
+            return { ok: true, decls: inner };
+        return { ok: false, reason: `plugins domain shape rejected: expected an array or { plugins: [...] }, got an object whose plugins member is ${wireTypeWord(inner)}` };
+    }
+    return { ok: false, reason: `plugins domain shape rejected: expected an array or { plugins: [...] }, got ${wireTypeWord(domain)}` };
 }
 export function materializablePlugins(eff, allowHosts) {
-    return declaredPlugins(eff).flatMap((decl) => {
+    const shape = declaredPlugins(eff);
+    if (!shape.ok)
+        return [];
+    return shape.decls.flatMap((decl) => {
         const v = validatePluginDecl(decl, allowHosts);
         return v.ok ? [{ name: v.name, url: v.url, ...(v.sha !== undefined ? { sha: v.sha } : {}) }] : [];
     });
 }
 export async function applyCenterPlugins(baseline, eff, opts) {
-    const declared = declaredPlugins(eff);
+    const shape = declaredPlugins(eff);
     const out = { skills: [...baseline], failures: [], letGo: [], lkgUsed: [] };
+    if (!shape.ok) {
+        opts.logger?.warn("center_plugins_domain_rejected", { reason: shape.reason });
+        out.failures.push({ plugin: PLUGINS_DOMAIN_FAILURE_NAME, reason: shape.reason });
+        return out;
+    }
+    const declared = shape.decls;
     if (declared.length === 0)
         return out;
     const runGit = opts.runGit ?? (async (args) => {

package/dist/capabilities/code-review-council.js

@@ -35,8 +35,10 @@ export function createCouncilTool(subRunner, repoTools, objective, opts = {}) {
         parameters: Type.Object({}),
         execute: async (_args, ctx) => {
             const active = pickLenses(opts.lensCount);
-            const lenses = await runLensReviews(subRunner, repoTools, objective, ctx.signal, active);
-            const findings = lenses.map((l) => `### ${l.lens} reviewer\n${l.text}`).join("\n\n");
+            const outcomes = await runLensReviews(subRunner, repoTools, objective, ctx.signal, active);
+            const lenses = outcomes.filter((o) => o.ok);
+            const failedLenses = outcomes.flatMap((o) => (o.ok ? [] : [{ lens: o.lens, reason: o.reason }]));
+            const findings = outcomes.map((o) => `### ${o.lens} reviewer\n${o.ok ? o.text : `(lens errored: ${o.reason})`}`).join("\n\n");
             const converge = await runConvergence(subRunner, repoTools, objective, findings, opts, ctx.signal, active);
             const totalTokens = lenses.reduce((s, l) => s + l.tokens, 0) + converge.tokens;
             const totalTurns = lenses.reduce((s, l) => s + l.turns, 0) + converge.turns;
@@ -46,10 +48,10 @@ export function createCouncilTool(subRunner, repoTools, objective, opts = {}) {
             opts.metrics?.inc("council_runs_total", { mode });
             opts.metrics?.inc("task_tokens_total", {}, totalTokens);
             opts.metrics?.observe("council_tokens", totalTokens);
-            opts.logger?.info("council_done", { mode, lenses: lenses.length, totalTokens, totalTurns });
+            opts.logger?.info("council_done", { mode, lenses: lenses.length, failedLenses, totalTokens, totalTurns });
             return {
                 content: converge.review,
-                details: { council: { mode, totalTokens, totalTurns, perLens: lenses.map((l) => ({ lens: l.lens, tokens: l.tokens })) } },
+                details: { council: { mode, totalTokens, totalTurns, perLens: lenses.map((l) => ({ lens: l.lens, tokens: l.tokens })), failedLenses } },
             };
         },
     };
@@ -65,16 +67,11 @@ async function runLensReviews(subRunner, repoTools, objective, signal, lenses) {
             enableBlockedReport: false,
             signal,
         });
-        return { lens: lens.name, text: r.result?.trim() || "(no findings)", tokens: r.stats.tokens, turns: r.stats.turns };
+        return { ok: true, lens: lens.name, text: r.result?.trim() || "(no findings)", tokens: r.stats.tokens, turns: r.stats.turns };
     }));
     return settled.map((s, i) => s.status === "fulfilled"
         ? s.value
-        : {
-            lens: lenses[i].name,
-            text: `(lens errored: ${s.reason instanceof Error ? s.reason.message : String(s.reason)})`,
-            tokens: 0,
-            turns: 0,
-        });
+        : { ok: false, lens: lenses[i].name, reason: s.reason instanceof Error ? s.reason.message : String(s.reason) });
 }
 async function runConvergence(subRunner, repoTools, objective, findings, opts, signal, lenses) {
     if (opts.debate) {

package/dist/capabilities/scenarios.d.ts

@@ -174,7 +174,12 @@ export declare function semaIdentityProvider(): PromptProvider;
  */
 export declare function codePromptProvider(brand: boolean): PromptProvider;
 export declare function buildScenarios(deps: ScenarioDeps): Record<string, Scenario>;
-/** Resolve the scenario for a request (falls back to `default`). */
+/**
+ * Resolve the scenario bundle for a name. `undefined` = no preference ⇒ the built-in `default`; any OTHER name must be
+ * registered — an unregistered one is a caller bug and THROWS (it never falls back to `default`: a restricted principal's
+ * bundle must not silently widen). Request paths get their name from {@link gateScenarioRequest}, whose result is always
+ * registered, so the throw is unreachable from them; it is the loud arm for a direct caller that skipped the gate.
+ */
 export declare function selectScenario(scenarios: Record<string, Scenario>, name: string | undefined): Scenario;
 /** web 渲染契约(定稿形状;knobs 现在没有=整字段省略)。 */
 export interface ScenarioDetail {
@@ -259,16 +264,38 @@ export interface ScenarioRuling {
     /** 纯场景名集合(principal/组名不上 wire);空 = 该 principal 无任何指派 = 无治理。 */
     allowlist: string[];
 }
+/**
+ * 一个场景名的**来源**(闭集:新增一词 ⇒ {@link danglingScenarioRefusal} 的穷尽 switch 编译红)。
+ *  · `ruling` —— 中心按主体指派的场景(`ScenarioRuling.scenario`);
+ *  · `deployment` —— 部署自己写的缺省(`DEFAULT_SCENARIO` / config `defaultScenario`)。
+ * 请求体显式给的名字不在此列:那是调用方的话,不在册 ⇒ 400 `scenario_unknown`(见 {@link gateScenarioRequest})。
+ */
+export type ScenarioNameSource = "ruling" | "deployment";
+/**
+ * 🔴 **悬空场景名的判据与拒句 —— 全仓唯一属主。**
+ *
+ * 指派 / 部署缺省指向不在册的名字,此前一路被折成 `default`(工具 / 提示 / skills / mcp 整包跟着换,零 warn):受限场景的主体被
+ * 悄悄放进更宽的 default。本函数把那条回退链换成两条出路,**没有第三条**:
+ *  · `deployment` 悬空 ⇒ 起服拒启(`boot/stage-07-capability-layer.ts` 在 center 场景 overlay 之后调它、`throw new Error`);
+ *  · `ruling` 悬空 ⇒ 该 run 503 `state.scenario_assignment_unknown`({@link gateScenarioRequest} 调它);
+ *  · `deployment` 悬空到得了 run(只有自己装配 `resolveSpec`、没经过起服的嵌入方)⇒ 同码同判据同一句话 —— 起服拒启与这一条是同一个答案。
+ *
+ * 返回 `undefined` = 在册;否则是**拒句**(点名名字与来源、给在册词表、说怎么修)。判据按**自有键**(`known` 是场景表的
+ * `Object.keys`,`constructor` / `__proto__` 不是场景名)。
+ */
+export declare function danglingScenarioRefusal(name: string, source: ScenarioNameSource, known: readonly string[]): string | undefined;
 /**
  * resolveSpec 的执法入口(指派为默认、body.scenario 可换但限 allowlist)。返回本请求的
- * 生效场景名(未做 unknown→default 回退——那是 resolveSpec 既有职责,保持单点)。
+ * **在册**生效场景名 —— 返回值一定在 `known` 里:下游直接按它取场景,没有「未知名 → default」的回退臂。
  *
- *   - body.scenario 显式给出:allowlist 非空且集外 ⇒ typed 拒绝(400 `scenario_not_allowed`,附 allowlist
- *     ——机器码归 wire、人话归壳/web);集内 ⇒ 用户主动切换赢。allowlist 为空(无 ruling / 该 principal
- *     三层皆无指派 / caps 面故障)⇒ 无治理约束,现状放行(与「null 落兜底链」同一语义:分配面未覆盖 =
+ *   - body.scenario 显式给出:不在册 ⇒ typed 400 `scenario_unknown`(调用方的错);allowlist 非空且集外 ⇒ typed 拒绝
+ *     (400 `scenario_not_allowed`,附 allowlist ——机器码归 wire、人话归壳/web);集内 ⇒ 用户主动切换赢。allowlist 为空
+ *     (无 ruling / 该 principal 三层皆无指派 / caps 面故障)⇒ 无治理约束,现状放行(与「null 落兜底链」同一语义:分配面未覆盖 =
  *     不收紧,恒不比没有治理时更宽;caps 故障不把用户锁死在 default——场景切换不是权限放大面,fail-open
  *     到现状,与 workflows 面的 fail-closed 是刻意的 posture 差异,见 runtime-caps-resolver)。
- *   - body.scenario 未给:ruling 胜者 ⇒ 指派为默认;无胜者 ⇒ defaultScenario 现状链。
+ *   - body.scenario 未给:ruling 胜者 ⇒ 指派为默认;无胜者 ⇒ defaultScenario 现状链。链上的名字不在册 ⇒ 503
+ *     `state.scenario_assignment_unknown`(部署的错 / 中心的错,不是调用方的错),**不**折 default
+ *     ({@link danglingScenarioRefusal})。`principal` 只进那一行运维日志,不参与判定。
  */
-export declare function gateScenarioRequest(ruling: ScenarioRuling | undefined, bodyScenario: unknown, defaultScenario: string, known: readonly string[], logger?: Logger): string;
+export declare function gateScenarioRequest(ruling: ScenarioRuling | undefined, bodyScenario: unknown, defaultScenario: string, known: readonly string[], logger?: Logger, principal?: string): string;
 //# sourceMappingURL=scenarios.d.ts.map