@sema-agent/server 7.119.0 → 7.121.0

package/dist/fleet-client.js

@@ -1,6 +1,7 @@
-import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS } from "@sema-agent/settings-schema/fleet";
-import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS, readCapabilityReading } from "@sema-agent/settings-schema/fleet";
+import { drainingFlag, fleetMembershipKeys } from "./fleet/engine-signal.js";
 import { centerFetch, centerLaneConfigured } from "./config-center/center-request.js";
+import { recordFailOpen } from "./observability/fail-open.js";
 export const FLEET_USAGE_KEY_CAP = 1024;
 export const FLEET_CLIENT_FETCH_TIMEOUT_MS = 5000;
 export class FleetUsageAccumulator {
@@ -74,6 +75,16 @@ async function rejectionSnippet(res) {
         return "";
     }
 }
+async function capabilityReadingOf(res) {
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch (err) {
+        return { kind: "unreadable", why: "body", detail: err instanceof Error ? err.message : String(err) };
+    }
+    return readCapabilityReading(body);
+}
 export function startFleetClient(opts) {
     const f = opts.fetchImpl ?? fetch;
     const heartbeatMs = opts.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
@@ -81,28 +92,55 @@ export function startFleetClient(opts) {
     const send = (route, method, json) => centerFetch(opts.center, { kind: route }, { method, json, timeoutMs: FLEET_CLIENT_FETCH_TIMEOUT_MS, fetchImpl: f });
     let stopped = false;
     let failStreak = 0;
+    let unreadableStreak = 0;
     const address = opts.advertiseAddress;
     const announceOnce = async () => {
         if (stopped || address === undefined)
             return;
         try {
-            const verdict = opts.readiness();
-            const restart = opts.restart();
+            const signal = opts.signal();
             const modelRefusals = opts.modelRefusals();
             const body = {
                 instanceId: opts.instanceId,
                 worker: opts.center.worker,
                 address,
                 version: opts.version,
-                ready: verdict.ready,
-                draining: !verdict.ready && verdict.reasons.includes("draining"),
+                ready: signal.verdict.ready,
+                draining: drainingFlag(signal),
                 heartbeatMs,
-                ...(restart !== undefined ? { restart } : {}),
+                ...(signal.restart !== undefined ? { restart: signal.restart } : {}),
                 ...(modelRefusals !== undefined ? { modelRefusals } : {}),
+                ...fleetMembershipKeys(signal),
             };
             const { res } = await send("fleet-instances", "POST", body);
             if (!res.ok)
                 throw new Error(`announce ${res.status}${await rejectionSnippet(res)}`);
+            if (opts.onCenterCapabilities !== undefined) {
+                const reading = await capabilityReadingOf(res);
+                switch (reading.kind) {
+                    case "declared":
+                    case "undeclared":
+                        unreadableStreak = 0;
+                        opts.onCenterCapabilities(reading.kind === "declared" ? reading.capabilities : undefined);
+                        break;
+                    case "unreadable":
+                        recordFailOpen("server.fleet.announce-reply-unreadable", `why=${reading.why} leaseState=${signal.lease.state}`);
+                        unreadableStreak += 1;
+                        if (unreadableStreak === 1) {
+                            opts.logger?.warn("fleet_announce_reply_unreadable", {
+                                status: res.status,
+                                why: reading.why,
+                                ...(reading.detail !== undefined ? { error: reading.detail } : {}),
+                                note: "the fleet center's heartbeat reply is not a capability reading (unreadable body, not an object, or a malformed capabilities value) — no reading taken; the last one stands (the serving lease keeps its state and outage clock)",
+                            });
+                        }
+                        break;
+                    default: {
+                        const unhandled = reading;
+                        throw new Error(`heartbeat reply: unknown capability reading ${JSON.stringify(unhandled)}`);
+                    }
+                }
+            }
             if (failStreak > 0)
                 opts.logger?.info("fleet_announce_recovered", { after: failStreak });
             failStreak = 0;
@@ -156,7 +194,7 @@ export function startFleetClient(opts) {
     };
     const announcing = address !== undefined;
     if (announcing)
-        void announceNow();
+        queueMicrotask(() => void announceNow());
     const hb = announcing ? setInterval(() => void announceNow(), heartbeatMs) : undefined;
     hb?.unref?.();
     const uw = opts.usage ? setInterval(() => void flushUsage(), usageWindowMs) : undefined;
@@ -190,29 +228,15 @@ export function startFleetClient(opts) {
     };
     return { announceNow, stopRouting, flushFinalUsage };
 }
-export function startFleetClientFromEnv(cfg, opts) {
+export function startFleetClientFromConfig(cfg, opts) {
     const cc = cfg.configCenter;
-    const raw = opts.advertiseAddress ?? process.env.FLEET_ADVERTISE_ADDRESS;
-    const address = raw === undefined || raw === "" ? undefined : raw;
-    if (address !== undefined && cc?.baseUrl && cc.credential.declared) {
-        let parsed;
-        try {
-            parsed = new URL(address);
-        }
-        catch {
-            parsed = undefined;
-        }
-        if (parsed === undefined || (parsed.protocol !== "http:" && parsed.protocol !== "https:")) {
-            throw new Error(`FLEET_ADVERTISE_ADDRESS must be a parseable http(s) base URL (e.g. "http://10.0.0.5:8090"); got "${buildDisplaySafeUrl(address)}" — the fleet center rejects any other shape on every announce`);
-        }
-    }
+    const address = cfg.fleetAdvertiseAddress;
     if (!centerLaneConfigured(cfg)) {
         if (address !== undefined && cc?.baseUrl && cc.credential.declared) {
             opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
         }
         return undefined;
     }
-    const lane = cfg.configCenter;
-    return startFleetClient({ ...opts, center: { baseUrl: lane.baseUrl, credential: lane.credential, worker: lane.worker }, advertiseAddress: address });
+    return startFleetClient({ ...opts, center: cfg.configCenter, advertiseAddress: address });
 }
 //# sourceMappingURL=fleet-client.js.map

package/dist/http/approval-sweeps.js

@@ -6,7 +6,7 @@ import { APPROVAL_GATE_KINDS } from "../tool-approval.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import { hasServiceAuth } from "./dispatch.js";
 import { gatedPrincipal } from "./principal-gate.js";
-import { readinessOf, billableRefusalOf } from "./readiness.js";
+import { admissionRefusalOf, readinessOf } from "./readiness.js";
 import { readResumeCtx } from "./resume-ctx-read.js";
 import { storedBodyReplayRefusal } from "./checkpoint-ctx.js";
 const BLOCKED_SCALAR_KEYS = ["errorCode", "blockedBy", "field", "reason", "count", "cap", "index"];
@@ -107,11 +107,9 @@ export function createApprovalSweeps(ctx) {
         if (!hasServiceAuth(deps.config) && !deps.config.allowUnauthedWrites) {
             return { status: 503, body: { error: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions", errorCode: "auth.service_token_required" } };
         }
-        const readiness = readinessOf(deps);
-        if (!readiness.ready) {
-            const refusal = billableRefusalOf(readiness, deps.drainState?.reason);
+        const refusal = admissionRefusalOf(readinessOf(deps), deps.servingLease?.(), "hitl-answer");
+        if (refusal !== undefined)
             return { status: refusal.status, body: refusal.body };
-        }
         if (deps.costQuota && req.httpReq) {
             const quotaPrincipal = gatedPrincipal(req.httpReq, deps.config);
             if (quotaPrincipal !== undefined) {

package/dist/http/dispatch.js

@@ -3,9 +3,11 @@ import { setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isDestructiveSessio
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
-import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath } from "./route-table.js";
+import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath } from "./route-table.js";
 import { sendJson, sendError, isSseResponse } from "./send.js";
-import { readinessOf, healthReadinessKeys, sendReadyz, billableRefusalOf, sendBillableRefusal } from "./readiness.js";
+import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal } from "./readiness.js";
+import { fleetMembershipKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
+import { buildHealthSelfReport } from "./health-self-report.js";
 import { authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, verifiedIdentitySource } from "./principal-gate.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 export function hasServiceAuth(config) {
@@ -113,7 +115,7 @@ export function createDispatch(ctx) {
             return;
         }
         if (req.method === "GET" && url === "/health") {
-            const restart = deps.restartState?.();
+            const signal = mintEngineSignal(deps);
             const configHash = createHash("sha256")
                 .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec?.provider, port: deps.config.port }))
                 .digest("hex")
@@ -121,24 +123,26 @@ export function createDispatch(ctx) {
             sendJson(res, 200, {
                 status: "ok",
                 ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
-                ...(deps.drainState?.draining ? { draining: true, ...(deps.drainState.since ? { drainingSince: deps.drainState.since } : {}), ...(deps.drainState.reason ? { drainReason: deps.drainState.reason } : {}) } : {}),
+                ...(deps.drainState?.draining ? { draining: true, ...(deps.drainState.since ? { drainingSince: deps.drainState.since } : {}) } : {}),
                 ...(deps.drainState?.inflight ? { inflight: deps.drainState.inflight() } : {}),
                 ...(deps.storePosture?.degradedReason !== undefined ? { durable: false, storeDegraded: true } : {}),
-                ...healthReadinessKeys(readinessOf(deps)),
+                ...healthReadinessKeys(signal.verdict),
                 model: deps.config.model.id,
                 sessionBackend: deps.sessionStoreLabel ?? deps.config.sessionBackend,
                 sessions: deps.runner.sessions.size,
                 ...(deps.instanceId ? { instanceId: deps.instanceId } : {}),
+                ...fleetMembershipKeys(signal),
                 ...(deps.config.localDataRoot ? { dataRoot: deps.config.localDataRoot } : {}),
                 configHash,
                 pid: process.pid,
                 startedAt: PROCESS_STARTED_AT_MS,
                 port: deps.config.port,
                 ...(deps.config.directDoorActive ? { directDoorActive: true } : {}),
-                ...(restart ? { restartRequired: true, restart } : {}),
+                ...buildHealthSelfReport(deps, hasServiceAuth(deps.config)),
+                ...(signal.restart ? { ...(restartActionable(signal) ? { restartRequired: true } : {}), restart: signal.restart } : {}),
                 ...(() => {
-                    const stuck = deps.planeDeferredState?.();
-                    return stuck ? { modelPlaneDeferred: { version: stuck.version, since: stuck.since, noHandoff: true, ...(stuck.blocked ? { blockedReasons: stuck.blocked } : {}) } } : {};
+                    const configHandoff = deps.configHandoffState?.();
+                    return configHandoff ? { configHandoff } : {};
                 })(),
                 ...(() => {
                     const gen = deps.configApplyState?.();
@@ -173,7 +177,7 @@ export function createDispatch(ctx) {
             return;
         }
         if (req.method === "GET" && url === "/readyz") {
-            sendReadyz(res, readinessOf(deps));
+            sendReadyz(res, mintEngineSignal(deps).verdict);
             return;
         }
         if (req.method === "GET" && (url === "/metrics" || url === "/metrics/summary" || url === "/metrics/plan-cache")) {
@@ -244,10 +248,11 @@ export function createDispatch(ctx) {
             sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions");
             return;
         }
-        if (req.method === "POST" && isBillableSubmitPath(url) && !isMethodDispatchedSubmitPath(url)) {
-            const verdict = readinessOf(deps);
-            if (!verdict.ready) {
-                sendBillableRefusal(res, billableRefusalOf(verdict, deps.drainState?.reason));
+        const billableKind = req.method === "POST" && !isMethodDispatchedSubmitPath(url) ? billableKindOf(url) : undefined;
+        if (billableKind !== undefined) {
+            const refusal = admissionRefusalOf(readinessOf(deps), deps.servingLease?.(), billableKind);
+            if (refusal !== undefined) {
+                sendBillableRefusal(res, refusal);
                 return;
             }
         }

package/dist/http/health-self-report.d.ts

@@ -0,0 +1,60 @@
+/**
+ * `GET /health` 的**自报位**(7.121.0)—— `auth` / `operator` / `center` 三键:壳在**带凭据之前**要知道的三件部署事实
+ * (这台引擎要不要凭据、认哪几类、能不能附着身份;有没有运维方可找;接着哪个中心、会话会不会出现在那个中心的 web 面)。
+ *
+ * ## 规则(一条):自报位是**投影**,不是第二份规则
+ * 每一位读的是**门本身读的那只谓词 / 那只取值口**,本模块不判任何东西:
+ *  · `auth.required` = 全局凭据门的武装谓词(`hasServiceAuth`,由 `dispatch.ts` 交进来 —— 门与本位读同一次求值的同一只函数);
+ *  · `auth.kinds` = {@link IDENTITY_SOURCES}(`verifiedIdentitySource` 的回值闭集)里,这台部署的装配**能**回的那几个词:
+ *    `service_token` ⇐ 全局门武装(`systemFor` 只在配了 service token 时回得出值)· `sso` ⇐ 鉴权桥装了(入口预认证只在
+ *    `registryJwtVerifier` 在场时挂身份)· `direct_door_jwt` ⇐ 直连门开着(`verifiedIdentitySource` 那一臂的第一个合取项);
+ *  · `auth.identityAttach` = kinds 里有没有**带调用方身份**的一类({@link carriesCallerIdentity},穷举):`service_token` 认的是系统
+ *    (`systemFor` 回系统名或 null),不是人;
+ *  · `operator` = 能力事实 `operatorLane`(operator 面族的 501 门读的同一只;名单本身不上 wire);
+ *  · `center.issuer` = 鉴权桥 issuer 的唯一取值 `authBridgeIssuerOf`(装配 `boot/stage-09-leader.ts` 与 caps `centerWiring.issuer` 同读);
+ *  · `center.webBaseUrl` = 运维旋钮 `SEMA_REGISTRY_WEB_URL`(`config.configCenter.webBaseUrl`,接了中心才挂;起服时已判成固定基址);
+ *  · `center.sessionsVisible` = 中心的 web 面能不能列出本引擎的会话 —— 四件接线事实全在才可能:中心车道配齐(`centerLaneConfigured`,
+ *    租约 / 用量 / 公告同一只谓词)∧ 公告地址在(配置席 `fleetAdvertiseAddress`:web 面只拨中心登记过的实例地址)∧ 鉴权桥在(web 面带的是
+ *    中心铸的中继令牌,不带 service token)∧ 会话枚举面在(事实 `sessionList`,web 面中继 `GET /v1/sessions`);缺任一 ⇒ `false`。
+ *    四件齐时:多租户(`REQUIRE_PRINCIPAL`)每条会话都落着验过的属主 ⇒ `true`;单用户形下一条会话归谁取决于提交它的那次请求带没带
+ *    身份(web 面只列调用人自己的会话)—— 部署级答不了 ⇒ `"unknown"`。
+ *
+ * ## 无鉴权面
+ * `/health` 排在凭据门之前、缺省全网卡监听:本模块只出闭集词、布尔与运维要发布的 URL。两只 URL 值都过 display-safe 律
+ * (`buildDisplaySafeUrl`,所有展示面 URL 的同一个铸点):userinfo 落地、query 值成记号、尾斜杠折掉 —— issuer 的来源
+ * (`AUTH_BRIDGE_ISSUER` / `SEMA_REGISTRY_URL`)起服时不判凭据形,这一道是它上无鉴权面的唯一闸。令牌、名单、worker 名、凭证一概不上。
+ *
+ * ## 在场律
+ * 三键**恒在场**;缺席 = 老 worker(≤7.120.x)。`center.issuer` / `center.webBaseUrl` 缺席即缺席(没有鉴权桥 / 没配旋钮),不拼不猜。
+ */
+import type { FlatServiceDeps } from "./server.js";
+import { type IdentitySource } from "./principal-gate.js";
+/** `auth.identityAttach` 的词表。 */
+export declare const IDENTITY_ATTACH_WORDS: readonly ["available", "unavailable"];
+export type IdentityAttach = (typeof IDENTITY_ATTACH_WORDS)[number];
+/** `operator` 的词表。 */
+export declare const OPERATOR_PRESENCE_WORDS: readonly ["present", "absent"];
+export type OperatorPresence = (typeof OPERATOR_PRESENCE_WORDS)[number];
+/** `center.sessionsVisible` 的值域(两个布尔 + 一个词;`"unknown"` = 接线齐了,但会话归谁要看提交它的那次请求)。 */
+export declare const SESSIONS_VISIBLE_VALUES: readonly [true, false, "unknown"];
+export type SessionsVisible = (typeof SESSIONS_VISIBLE_VALUES)[number];
+/** 三键的 wire 形(纯数据)。 */
+export interface HealthSelfReport {
+    readonly auth: {
+        readonly required: boolean;
+        readonly kinds: readonly IdentitySource[];
+        readonly identityAttach: IdentityAttach;
+    };
+    readonly operator: OperatorPresence;
+    readonly center: {
+        readonly issuer?: string;
+        readonly webBaseUrl?: string;
+        readonly sessionsVisible: SessionsVisible;
+    };
+}
+/**
+ * 三键的**唯一铸点**(`build*`:纯数据)。`credentialGateArmed` 由 `dispatch.ts` 交进来 —— 它是全局凭据门自己的那一句
+ * (`hasServiceAuth`),本模块不另求一遍(另求就是第二个写者)。
+ */
+export declare function buildHealthSelfReport(deps: Pick<FlatServiceDeps, "config" | "registryJwtVerifier" | "sessionStorage" | "runStore">, credentialGateArmed: boolean): HealthSelfReport;
+//# sourceMappingURL=health-self-report.d.ts.map

package/dist/http/health-self-report.js

@@ -0,0 +1,53 @@
+import { IDENTITY_SOURCES } from "./principal-gate.js";
+import { operatorLane, sessionList } from "../capability-facts.js";
+import { authBridgeIssuerOf } from "../auth-bridge.js";
+import { centerLaneConfigured } from "../config-center/center-request.js";
+import { buildDisplaySafeUrl } from "../trace/redact.js";
+export const IDENTITY_ATTACH_WORDS = ["available", "unavailable"];
+export const OPERATOR_PRESENCE_WORDS = ["present", "absent"];
+export const SESSIONS_VISIBLE_VALUES = [true, false, "unknown"];
+function carriesCallerIdentity(kind) {
+    switch (kind) {
+        case "service_token":
+            return false;
+        case "sso":
+        case "direct_door_jwt":
+            return true;
+        default: {
+            const unknownKind = kind;
+            throw new Error(`health self-report: unknown identity source ${String(unknownKind)}`);
+        }
+    }
+}
+function identitySourceWired(kind, a) {
+    switch (kind) {
+        case "service_token":
+            return a.credentialGateArmed;
+        case "sso":
+            return a.bridgeWired;
+        case "direct_door_jwt":
+            return a.directDoorActive;
+        default: {
+            const unknownKind = kind;
+            throw new Error(`health self-report: unknown identity source ${String(unknownKind)}`);
+        }
+    }
+}
+export function buildHealthSelfReport(deps, credentialGateArmed) {
+    const { config } = deps;
+    const bridgeWired = deps.registryJwtVerifier !== undefined;
+    const kinds = IDENTITY_SOURCES.filter((k) => identitySourceWired(k, { credentialGateArmed, bridgeWired, directDoorActive: config.directDoorActive }));
+    const issuer = authBridgeIssuerOf(config)?.issuer;
+    const webBaseUrl = config.configCenter?.webBaseUrl;
+    const sessionsVisible = centerLaneConfigured(config) && config.fleetAdvertiseAddress !== undefined && bridgeWired && sessionList(deps).available ? (config.requirePrincipal ? true : "unknown") : false;
+    return {
+        auth: { required: credentialGateArmed, kinds, identityAttach: kinds.some(carriesCallerIdentity) ? "available" : "unavailable" },
+        operator: operatorLane(deps).available ? "present" : "absent",
+        center: {
+            ...(issuer !== undefined ? { issuer: buildDisplaySafeUrl(issuer) } : {}),
+            ...(webBaseUrl !== undefined ? { webBaseUrl: buildDisplaySafeUrl(webBaseUrl) } : {}),
+            sessionsVisible,
+        },
+    };
+}
+//# sourceMappingURL=health-self-report.js.map

package/dist/http/principal-gate.d.ts

@@ -13,13 +13,20 @@ export declare function systemFor(req: IncomingMessage, config: ServiceConfig):
 export declare function bearerPresentedButUnverified(req: IncomingMessage, config: ServiceConfig): boolean;
 /** loopback 三形(IPv4 / IPv6 / IPv4-mapped)—— 一处定义,diagnostics 门与任何「本机自用」判据同吃。缺席 ⇒ false(fail-closed)。 */
 export declare function isLoopbackAddress(addr: string | undefined): boolean;
+/**
+ * 验过的身份来源的**闭集**(序 = `/health.auth.kinds` 的出现序)。{@link verifiedIdentitySource} 的回值就是这张表的词;
+ * `/health` 的自报位(`http/health-self-report.ts`)读同一张表,答「这台部署的装配**能**回哪几个词」—— 加一个来源 = 加一个词,
+ * 两边各自的穷举 `switch` 不接就编译红。
+ */
+export declare const IDENTITY_SOURCES: readonly ["service_token", "sso", "direct_door_jwt"];
+export type IdentitySource = (typeof IDENTITY_SOURCES)[number];
 /**
  * 这次请求的身份是不是**密码学验过**的(而不是调用方自述的 header):`sso` = registry JWT(入口预认证的签名真源)/
  * `direct_door_jwt` = direct-door principal JWT 验过 / `service_token` = 出示了单一或 per-system service token。
  * 缺席 = 只有自述头或什么都没有。一处判定(7.63.0 codex [high]+[medium]):off-box 读 operator 面的门用它——名单只在
  * 有可验身份时才是身份,零凭据下它只是谁都能写的字符串;而 JWT 身份不依赖静态 token 的在场。
  */
-export declare function verifiedIdentitySource(req: IncomingMessage, config: ServiceConfig): "sso" | "direct_door_jwt" | "service_token" | undefined;
+export declare function verifiedIdentitySource(req: IncomingMessage, config: ServiceConfig): IdentitySource | undefined;
 export declare function gatedPrincipal(req: IncomingMessage, config: ServiceConfig): string | undefined;
 /**
  * 「**出示了凭证但验不过** ≠ **没出示**」在 **direct-door principal JWT** 面上的形 —— 本仓

package/dist/http/principal-gate.js

@@ -37,6 +37,7 @@ export function bearerPresentedButUnverified(req, config) {
 export function isLoopbackAddress(addr) {
     return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
+export const IDENTITY_SOURCES = ["service_token", "sso", "direct_door_jwt"];
 export function verifiedIdentitySource(req, config) {
     if (ssoVerifiedPrincipal(req))
         return "sso";

package/dist/http/readiness.d.ts

@@ -22,6 +22,7 @@
  * 模块形:纯叶(只值 import `send.ts`)—— `fleet-client.ts` / `boot/` 都会读它,不许长出回环。
  */
 import type { ServerResponse } from "node:http";
+import type { ServingLeaseView } from "../fleet/engine-signal.js";
 /**
  * 就绪原因闭集,**数组序 = 优先序**:`/health.readyReason` 取首条的句、计费门取首条的拒绝码。
  * draining 在前 —— 一台正在下线的副本「去找替补」(Retry-After 15)比「稍后重试本机」(5)更对。
@@ -61,6 +62,26 @@ export declare function healthReadinessKeys(v: ReadinessVerdict): Record<string,
 /** `/readyz` 两形:200 `{ready:true}` / 503 `{ready:false, reasons}` + `Retry-After: 5`。体只这两键(不带身份字段:
  *  就绪探针给 k8s readinessProbe / Traefik / LB 摘流用,不是 `/health` 的替身;`drainReason` 等运维自由文本也不上这一面)。 */
 export declare function sendReadyz(res: ServerResponse, v: ReadinessVerdict): void;
+/**
+ * 编排器片 2 件 2 —— 计费面请求的**种类**(闭集;路由声明表 `billable` 列的取值,`http/route-ctx.ts`):
+ *  · `submit`      —— 起一轮**新**工作(新任务 / 新 run / leader / side-query / wake / 记忆整理 / A2A `message/send`);
+ *  · `hitl-answer` —— 对一张已经在等人的卡作答(耐久 `/decide`、计划审阅、PARKED 停驻卡的赎回);
+ *  · `resume`      —— 续跑一条已经存在的 run(助手 resume、子代 resume)。
+ */
+export declare const BILLABLE_KINDS: readonly ["submit", "hitl-answer", "resume"];
+export type BillableKind = (typeof BILLABLE_KINDS)[number];
+/**
+ * 计费面的拒因(**数组序 = 优先序**):就绪原因({@link READINESS_REASONS})∪ `lease_expired`(服务租约过期且中心不可达满 `T_max`)。
+ * `lease_expired` 刻意不是就绪原因:它不翻 `/readyz`(中心不可达不是本实例的病,摘它出路由只会把取消 / HITL / 读面一起摘掉)。
+ */
+export declare const ADMISSION_REFUSALS: readonly ["draining", "model_roster_pending", "lease_expired"];
+export type AdmissionRefusal = (typeof ADMISSION_REFUSALS)[number];
+/**
+ * 计费面请求的**唯一**准入判(dispatch 的计费门、a2a `message/send`、PARKED 赎回席同调):按 {@link ADMISSION_REFUSALS} 序找第一条
+ * 成立且按 {@link ADMISSION_TABLE} 拒这一种的拒因;没有 ⇒ `undefined`(放行)。入参是**判决**而不是 deps:就绪判由调用点经唯一谓词
+ * {@link readinessOf} 现读(模块边界上那一只 —— 谓词单源钉注入它,任何读点自己读 `drainState` 都会当场红),租约读数取 `deps.servingLease`。
+ */
+export declare function admissionRefusalOf(verdict: ReadinessVerdict, lease: ServingLeaseView | undefined, kind: BillableKind): BillableRefusal | undefined;
 /** 计费提交门的拒绝(首条 reason 定码)。`retryAfterSec` 由发送形(`sendBillableRefusal`)镜像成头;交回
  *  `{status, body}` 的赎回席只取体(它的路由刻意不带头,见 `approval-sweeps.ts` 该臂注)。 */
 export interface BillableRefusal {
@@ -69,17 +90,16 @@ export interface BillableRefusal {
         readonly error: string;
         readonly errorCode: string;
         readonly message: string;
-        readonly reason?: string;
     };
-    readonly retryAfterSec: 15 | 5;
+    readonly retryAfterSec: 15 | 5 | 60;
 }
 /**
  * 计费提交门的拒绝体 —— **唯一铸点**(`error` 字面 `"draining"` / `"model_roster_pending"` 与 `message` 是冻结的
  * wire 契约:SDK / 壳的 pre-stream 重试按它们判型;冻结在 `test/api-error-text-freeze.test.ts` 的
- * `FROZEN_RESULT_BODY` 与 `test/api-notice-text-freeze.test.ts` §2)。`drainReason` = `POST /v1/admin/drain`
- * 声明的停机因由([ref],additive 键 `reason`;未声明 = 键缺席)。
+ * `FROZEN_RESULT_BODY` 与 `test/api-notice-text-freeze.test.ts` §2)。编排器片 2:排空体的 `reason` 键随
+ * 停机因由声明口一起退役(排空口的体改成契约 `DrainRequest`,没有因由字段);`lease_expired` 一臂新增。
  */
-export declare function billableRefusalOf(v: NotReadyVerdict, drainReason: string | undefined): BillableRefusal;
+export declare function billableRefusalOf(reason: AdmissionRefusal): BillableRefusal;
 /** 发送形:`Retry-After` + 体(`dispatch.ts` 的 billable 门与 a2a `message/send` 同调)。走 `sendError` —— errorCode
  *  是它的必填位置参(对抗复审 #3:修前这里是 `sendJson(res, r.status, r.body)`,与 leader 口的豁免行逐字同文,
  *  在 error-code-key-gate 上借了别人的豁免过门);体键序与修前逐字同(`error, errorCode, message, reason?`)。 */

package/dist/http/readiness.js

@@ -33,16 +33,41 @@ export function sendReadyz(res, v) {
     res.setHeader("retry-after", "5");
     sendJson(res, 503, { ready: false, reasons: [...v.reasons] });
 }
-export function billableRefusalOf(v, drainReason) {
-    const primary = v.reasons[0];
-    switch (primary) {
+export const BILLABLE_KINDS = ["submit", "hitl-answer", "resume"];
+export const ADMISSION_REFUSALS = [...READINESS_REASONS, "lease_expired"];
+const ADMISSION_TABLE = {
+    draining: { submit: true, "hitl-answer": false, resume: false },
+    model_roster_pending: { submit: true, "hitl-answer": true, resume: true },
+    lease_expired: { submit: true, "hitl-answer": false, resume: false },
+};
+export function admissionRefusalOf(verdict, lease, kind) {
+    const holdsNow = (r) => {
+        switch (r) {
+            case "draining":
+            case "model_roster_pending":
+                return !verdict.ready && verdict.reasons.includes(r);
+            case "lease_expired":
+                return lease?.state === "expired" && lease.pastOutageMax;
+            default: {
+                const unhandled = r;
+                throw new Error(`admission refusal without a predicate arm: ${String(unhandled)}`);
+            }
+        }
+    };
+    const refusal = ADMISSION_REFUSALS.find((r) => holdsNow(r) && ADMISSION_TABLE[r][kind]);
+    return refusal === undefined ? undefined : billableRefusalOf(refusal);
+}
+export function billableRefusalOf(reason) {
+    switch (reason) {
         case "draining":
-            return { status: 503, body: { error: "draining", errorCode: "draining", message: "this instance is draining for shutdown/upgrade — retry against the replacement instance", ...(drainReason ? { reason: drainReason } : {}) }, retryAfterSec: 15 };
+            return { status: 503, body: { error: "draining", errorCode: "draining", message: "this instance is draining for shutdown/upgrade — retry against the replacement instance" }, retryAfterSec: 15 };
         case "model_roster_pending":
             return { status: 503, body: { error: "model_roster_pending", errorCode: "state.model_roster_pending", message: "this worker has no model yet (waiting for the first effective-config pull to land the roster) — retry shortly" }, retryAfterSec: 5 };
+        case "lease_expired":
+            return { status: 503, body: { error: "lease_expired", errorCode: "state.lease_expired", message: "this instance has not renewed its serving lease with the fleet center for longer than its outage limit — it takes no new work; cancel, approvals, resume and reads stay open here — retry new work against another instance" }, retryAfterSec: 60 };
         default: {
-            const unhandled = primary;
-            throw new Error(`readiness reason without a billable refusal: ${String(unhandled)}`);
+            const unhandled = reason;
+            throw new Error(`admission refusal without a billable refusal: ${String(unhandled)}`);
         }
     }
 }

package/dist/http/resume-legs.js

@@ -69,6 +69,10 @@ const WORKER_SWAP_REDEEMABLE = {
     write_face_damaged: false,
     skill_grants_damaged: false,
     constraint_chain_missing: false,
+    hands_coordinates_damaged: false,
+    installation_record_absent: true,
+    installation_record_misaligned: false,
+    installation_record_invalid: false,
 };
 function checkpointRowRedeemableElsewhere(reason) {
     return reason !== undefined && WORKER_SWAP_REDEEMABLE[reason] === true;
@@ -578,7 +582,7 @@ export function createResumeLegs(ctx) {
         let unregisterEngineNotice;
         try {
             const instructionLeg = createInstructionSelectionLeg();
-            result = await instructionLeg.run(sessionId, () => withModelReachScope(sessionId, () => withPrincipal(principal, async () => {
+            result = await instructionLeg.run(sessionId, () => withModelReachScope({ sessionId, taskId }, () => withPrincipal(principal, async () => {
                 const resumeNotifiedKeys = new NotifiedKeys();
                 if (deps.runStore && taskId) {
                     const rs0 = deps.runStore;

package/dist/http/route-ctx.d.ts

@@ -569,10 +569,12 @@ export type RouteMethod = "GET" | "POST" | "PUT" | "DELETE";
  *  `satisfies` 让它与 {@link RouteMethod} 双向闭合:漏一个动词 / 多一个都是编译红。 */
 export declare const ROUTE_METHOD_ORDER: readonly ["GET", "POST", "PUT", "DELETE"];
 export interface RouteDeclFacts {
-    /** 「这条 url **烧模型**」—— drain / model-roster-pending / 无 service-token 三道 503 的共同判别。
-     *  没有这一列 = 不烧模型(零默认值:要它为真必须显式写出来,漏写的方向是**少收一笔账单**而不是
-     *  少一道门 —— 反了才是灾难,所以三道门读的是 true 这一侧)。 */
-    readonly billable?: true;
+    /** 「这条 url **烧模型**」—— drain / model-roster-pending / 租约过期 / 无 service-token 四道 503 的共同判别。
+     *  没有这一列 = 不烧模型(零默认值:要它在场必须显式写出来,漏写的方向是**少收一笔账单**而不是
+     *  少一道门 —— 反了才是灾难,所以门读的是在场这一侧)。
+     *  编排器片 2 件 2:值 = 这一种计费请求的**种类**(`submit` 新工作 / `hitl-answer` 对等人的卡作答 / `resume` 续跑;闭集属主
+     *  `http/readiness.ts` 的 `BILLABLE_KINDS`)—— 排空与租约过期只拒 `submit`(放行闭集表 `ADMISSION_TABLE`),无凭证门不看种类。 */
+    readonly billable?: import("./readiness.js").BillableKind;
     /** 「本条 url 在**没有任何 service credential** 的部署形下,这几个方法必须 fail-closed」。
      *  判据(两个合取项)= 「授权的唯一输入是 principal 头」∧「持久改写,或爆炸半径跨租户的治理读」;
      *  逐口论证在各 `routes/*.ts` 的头注里,声明行只记结论。 */

package/dist/http/route-table.d.ts

@@ -54,6 +54,7 @@
 import type { FlatServiceDeps } from "./server.js";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteDecl, RouteDispatchDecl, RouteMatch, RouteCtx, RouteMethod } from "./route-ctx.js";
+import type { BillableKind } from "./readiness.js";
 /** 一只域 handler 相对**全局服务凭据门**的位置。门前 = 未鉴权可达(每一只都要单独论证),门后 = 先过凭据。 */
 /**
  * 一行路由在全局服务凭据门的哪一侧、吃哪道门(闭集,三员;S-672 起由两员拆成三员):
@@ -133,6 +134,8 @@ export declare function matchDecl(d: RouteDispatchDecl, url: string): Readonly<R
 export declare function routeLabel(_method: string, url: string): string;
 /** POST endpoints that trigger BILLABLE work — the fail-closed auth guard must cover ALL of them. */
 export declare function isBillableSubmitPath(url: string): boolean;
+/** 编排器片 2 件 2:这条 url 是哪一**种**计费请求(`undefined` = 不在计费面)。声明序第一条命中的行定种类(今天每条 url 至多命中一行)。 */
+export declare function billableKindOf(url: string): BillableKind | undefined;
 /** [ref]([ref] 件5)—— **改写门**:不烧模型、但在没有任何 service credential 的部署形下必须
  *  与 billable / bake 两族一样 fail-closed 的写门。与 `isBillableSubmitPath` **刻意分开**:这几扇门
  *  `billable=false`(零模型工作),塞进那张名单会让它们连带吃 drain 与 roster-pending 两道 503 ——

package/dist/http/route-table.js

@@ -109,7 +109,7 @@ export function matchDecl(d, url) {
 const NO_PARAMS = Object.freeze({});
 const LABEL_BY_PATH = new Map(ROUTE_DECLARATIONS.flatMap((d) => ("path" in d ? [[d.path, d.path]] : [])));
 const SHAPED_LABEL_DECLS = ROUTE_DECLARATIONS.filter((d) => !("path" in d) && typeof d.label === "string");
-const BILLABLE_DECLS = ROUTE_DECLARATIONS.filter((d) => d.billable === true);
+const BILLABLE_DECLS = ROUTE_DECLARATIONS.filter((d) => d.billable !== undefined);
 const METHOD_DISPATCHED_DECLS = ROUTE_DECLARATIONS.filter((d) => d.methodDispatched === true);
 const CREDENTIAL_GATED_BY_METHOD = (() => {
     const m = new Map();
@@ -135,6 +135,9 @@ export function routeLabel(_method, url) {
 export function isBillableSubmitPath(url) {
     return BILLABLE_DECLS.some((d) => declMatches(d, url));
 }
+export function billableKindOf(url) {
+    return BILLABLE_DECLS.find((d) => declMatches(d, url))?.billable;
+}
 export function isCredentialGatedRewrite(method, url) {
     const rows = CREDENTIAL_GATED_BY_METHOD.get(method.toUpperCase());
     return rows !== undefined && rows.some((d) => declMatches(d, url));

package/dist/http/routes/a2a-serve.d.ts

@@ -79,7 +79,7 @@ export type A2aServeRouteId = RouteIdsOf<typeof A2A_SERVE_ROUTES>;
 export declare const A2A_RPC_ROUTES: readonly [{
     readonly id: "a2a-rpc";
     readonly path: "/v1/a2a";
-    readonly billable: true;
+    readonly billable: "submit";
     readonly methodDispatched: true;
     readonly methods: readonly ["POST"];
 }];

package/dist/http/routes/a2a-serve.js

@@ -5,7 +5,7 @@ import { isParkedRunStatus, isTerminalRunStatus } from "../../plugins/store-cont
 import { HttpError } from "../../security.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError } from "../send.js";
-import { readinessOf, billableRefusalOf, sendBillableRefusal } from "../readiness.js";
+import { admissionRefusalOf, readinessOf, sendBillableRefusal } from "../readiness.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -168,10 +168,10 @@ function rpcErrorFromTypedFailure(err, skillId) {
 }
 function submitUnavailable(res, ctx) {
     const { deps } = ctx;
-    const verdict = readinessOf(deps);
-    if (verdict.ready)
+    const refusal = admissionRefusalOf(readinessOf(deps), deps.servingLease?.(), "submit");
+    if (refusal === undefined)
         return false;
-    sendBillableRefusal(res, billableRefusalOf(verdict, deps.drainState?.reason));
+    sendBillableRefusal(res, refusal);
     return true;
 }
 function readBlocking(params) {
@@ -392,6 +392,6 @@ export const A2A_SERVE_ROUTES = [
     { id: "a2a-agent-card", path: "/.well-known/agent-card.json", methods: ["GET"] },
 ];
 export const A2A_RPC_ROUTES = [
-    { id: "a2a-rpc", path: "/v1/a2a", billable: true, methodDispatched: true, methods: ["POST"] },
+    { id: "a2a-rpc", path: "/v1/a2a", billable: "submit", methodDispatched: true, methods: ["POST"] },
 ];
 //# sourceMappingURL=a2a-serve.js.map