@sema-agent/server 7.12.0 → 7.13.0

package/dist/adoption/wire.d.ts

@@ -68,7 +68,7 @@ export type AdoptionConfigEntry = z.infer<typeof AdoptionConfigEntrySchema>;
  * 🔴 这是**冻结的闭集**(下游按成员名写正向断言)。改名/删员 = wire 破坏;新增 = 新行为面,要先过三问。
  * 判据形见 183 §10.5:「按设计不迁」与「漏了没迁」在黑盒上必须可分,所以它是**正向声明**而不是沉默。
  */
-export declare const NOT_MIGRATED_FACES: readonly ["usage-window", "cost-quota", "rate-limit", "approval-exemption-grantor", "approval-ask-decision-actor", "image-bake-requested-by"];
+export declare const NOT_MIGRATED_FACES: readonly ["usage-window", "cost-quota", "rate-limit", "approval-exemption-grantor", "approval-ask-decision-actor", "image-bake-requested-by", "permission-rule-approval-history", "permission-rule-import-ticket"];
 export type NotMigratedFace = (typeof NOT_MIGRATED_FACES)[number];
 export declare const AdoptionNotMigratedSchema: z.ZodObject<{
     face: z.ZodEnum<{
@@ -78,6 +78,8 @@ export declare const AdoptionNotMigratedSchema: z.ZodObject<{
         "approval-exemption-grantor": "approval-exemption-grantor";
         "approval-ask-decision-actor": "approval-ask-decision-actor";
         "image-bake-requested-by": "image-bake-requested-by";
+        "permission-rule-approval-history": "permission-rule-approval-history";
+        "permission-rule-import-ticket": "permission-rule-import-ticket";
     }>;
     ruling: z.ZodEnum<{
         D1: "D1";
@@ -124,6 +126,8 @@ export declare const AdoptionReportSchema: z.ZodObject<{
             "approval-exemption-grantor": "approval-exemption-grantor";
             "approval-ask-decision-actor": "approval-ask-decision-actor";
             "image-bake-requested-by": "image-bake-requested-by";
+            "permission-rule-approval-history": "permission-rule-approval-history";
+            "permission-rule-import-ticket": "permission-rule-import-ticket";
         }>;
         ruling: z.ZodEnum<{
             D1: "D1";
@@ -183,6 +187,8 @@ export declare const AdoptionReceiptSchema: z.ZodObject<{
                 "approval-exemption-grantor": "approval-exemption-grantor";
                 "approval-ask-decision-actor": "approval-ask-decision-actor";
                 "image-bake-requested-by": "image-bake-requested-by";
+                "permission-rule-approval-history": "permission-rule-approval-history";
+                "permission-rule-import-ticket": "permission-rule-import-ticket";
             }>;
             ruling: z.ZodEnum<{
                 D1: "D1";

package/dist/adoption/wire.js

@@ -64,6 +64,12 @@ export const NOT_MIGRATED_FACES = [
     "approval-exemption-grantor",
     "approval-ask-decision-actor",
     "image-bake-requested-by",
+    // A-010.22(台账 P1)—— 规则店族此前对回执**零表态**:`permission_rule` 那只**活桶**现在真迁了
+    // (`permission_rule#owner_key` 腿),但同族另外两张表按 D2/D1 刻意不迁,而「刻意不迁」与「漏了没迁」
+    // 在黑盒上必须可分(§10.5)。少了这两员,运维读到的回执是:`notMigratedByDesign` 里没有规则店的影子、
+    // `residualSourceRows` 又把它们数成 0 —— 一份「什么都没落下」的**假声明**。
+    "permission-rule-approval-history",
+    "permission-rule-import-ticket",
 ];
 export const AdoptionNotMigratedSchema = z
     .object({

package/dist/approval-card.d.ts

@@ -50,6 +50,7 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         requiresRealApproval: z.ZodBoolean;
     }, z.core.$strict>;
     governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
+    persistedRuleShadowed: z.ZodOptional<z.ZodString>;
     ruleSuggestions: z.ZodOptional<z.ZodArray<z.ZodObject<{
         rule: z.ZodString;
         match: z.ZodEnum<{
@@ -89,6 +90,7 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             requiresRealApproval: z.ZodBoolean;
         }, z.core.$strict>;
         governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
+        persistedRuleShadowed: z.ZodOptional<z.ZodString>;
         ruleSuggestions: z.ZodOptional<z.ZodArray<z.ZodObject<{
             rule: z.ZodString;
             match: z.ZodEnum<{
@@ -132,6 +134,9 @@ export interface ApprovalCardSource {
     /** [2942]/[2943]:治理来源标 —— 与 wire 帧**同一份素材**(`ToolApprovalFrame` 结构上满足本接口),
      *  于是 live 帧 / `card_json` / 重放帧三面同源,不是三处各判一遍。 */
     governanceForced?: true;
+    /** #144(core 5.25.0):被越级的持久规则原文 —— **已 redactSecrets**(发帧点做,本模块只 clip)。
+     *  与 wire 帧**同一份素材**(`ToolApprovalFrame` 结构上满足本接口)⇒ live 帧 / `card_json` / 重放帧三面同源。 */
+    persistedRuleShadowed?: string;
     /** #154 车二:引擎铸的规则候选(**只在规则店装配时**由发帧点填;语义与在场性契约见
      *  `ApprovalCardSchema.ruleSuggestions`)。与 wire 帧**同一份素材** ⇒ live 帧 / `card_json` / 重放帧
      *  三面同源。 */

package/dist/approval-card.js

@@ -79,6 +79,24 @@ export const ApprovalCardSchema = z
      * park(fail-safe),回滚窗结束即自愈。
      */
     governanceForced: z.literal(true).optional(),
+    /**
+     * #144(core 5.25.0 [3438]/[3443],**ADDITIVE**):这次 ask **命中了**一条用户的持久 allow 规则,
+     * 但规则**清不掉**它 —— 值 = 那条被越级的规则**原文**(语义、消音边界与「缺席 ≠ 没有规则」的
+     * 硬条款逐字见 `tool-approval.ts` 的 `ToolApprovalFrame.persistedRuleShadowed`)。
+     *
+     * 放在**卡的顶层**、与 `governanceForced` 并列而不是塞进 `risk`:`risk` 是引擎对这次**操作**的风险
+     * 判定,这一格讲的是「你那条规则怎么了」——两件事。与 `governanceForced` 也**刻意分列**:那个说
+     * 「门是运维下的」,这个说「有一条你的规则在场但被越级」,两者可以同时在场也可以各自单独在场
+     * (governance 是不可消音的三个来源之一,doctrine `always` 与工具自带 egress/irreversible mark 是另两个)。
+     *
+     * 值域 = **用户内容族**(规则原文是人写的文本,core 侧已过 `inlineUntrusted` 200 cap):
+     * 写侧在**上游**(`tool-approval.ts` 发帧点)过 `redactSecrets` 再交进来,本层只截长(`clip`)。
+     * UNTRUSTED-for-display,同 `message`/`args` 待遇。
+     *
+     * 回滚窗代价与 `governanceForced` **逐字同族**(见上一段那条 ⚠️):`.strict()` 下旧二进制读不动带本键的
+     * 新行 ⇒ 重放跳过 + 幂等重入走 park(fail-safe),`schemaVersion` 不动。
+     */
+    persistedRuleShadowed: z.string().max(MAX_RULE_TEXT_CHARS).optional(),
     /**
      * #154 车二(core 5.18.0 design/179):引擎为这次 ask 铸的**规则候选**(`Bash(git status)` 精确 /
      * `Bash(git status:*)` 词界前缀)—— 呈卡面据它渲「不再询问」。
@@ -183,6 +201,7 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
     const toolCallId = clip(source.toolCallId, MAX_IDENT);
     const sourceTaskId = clip(source.sourceTaskId, MAX_IDENT);
     const sourceAgentName = clip(source.sourceAgentName, MAX_AGENT_NAME);
+    const shadowedRule = clip(source.persistedRuleShadowed, MAX_RULE_TEXT_CHARS);
     return {
         toolName: clip(source.toolName, MAX_IDENT) ?? "",
         message: clip(source.message, MAX_MESSAGE) ?? "",
@@ -195,6 +214,9 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
         },
         // [2942]/[2943]:只在为真时投影(`=== true` 严判:非布尔真值不得把一张普通卡染成治理卡)。
         ...(source.governanceForced === true ? { governanceForced: true } : {}),
+        // #144:被越级的规则原文。**空串不投**(core 的四个 mint 点只在真有命中规则时带这个键 ⇒ 空串不是
+        // 「有一条空规则」而是坏值;投一个空串会让壳渲一行「你的规则 ⟨⟩ 仍在」)。截长同 `message` 待遇。
+        ...(shadowedRule !== undefined && shadowedRule !== "" ? { persistedRuleShadowed: shadowedRule } : {}),
         // #154 车二:候选**逐字**投影(空数组 ⇒ 不投键 —— 「没有候选」与「本部署不供候选」在卡面上都读作
         // 「本卡无此选项」,铸一个空数组只会让消费端多一条无意义的分支)。拷贝一份:卡不与调用方共享可变引用。
         ...(source.ruleSuggestions !== undefined && source.ruleSuggestions.length > 0

package/dist/boot/permission-rules-audit.js

@@ -44,12 +44,40 @@ export async function auditDormantPermissionRules(ctx) {
     if (buckets > 0 && !ctx.explicit) {
         // ②③ 都不成立才说话。文案给的是**一条可行动的因果**:看到少问了 ⇒ 这里有 N 只既有桶 ⇒ 用
         // `GET /v1/rules` 看、用 `DELETE /v1/rules` 收,或者把旋钮显式关掉。
+        //
+        // 🔴 **local-owner 桶的现状必须同拍说清**(#203 收官件 / #205 件5,core 5.24.0 提货批):
+        // `countBuckets` 数的是**所有**桶,其中可能有一只**身份缺席**的 local-owner 桶(File 后端 =
+        // `permission-rules/local-owner.json`,SQL 后端 = owner_key `local-owner` 的行)。而 `GET`/`DELETE
+        // /v1/rules` 两口是 **principal 寻址**的(无 principal 一律 401,契约上刻意的边界)—— 对那只桶,
+        // 上面那句「inspect with GET / revoke with DELETE」是**兑不出来的承诺**。
+        //
+        // ⚠️ 文案只说**兑得出来**的话(codex 对抗复审 R1-[medium],验真后改):第一稿在这里写的是
+        // 「adopt it into a principal first」——**本仓没有那条路**。收编入口的来源词表逐字只有
+        // `{kind:"principal"}`(`adoption/wire.ts` 的 `AdoptionSourceSchema`,`.strict()` 拒 local-owner),
+        // core 的 `adoptFilePermissionRuleStore` 在 src/ 下零调用点,SQL 侧连对应原语都没有。指一条走不通
+        // 的路比不指更坏:运维会去试,试不通才发现自己被误导。
+        // 今天**真能做的**只有两件:①`PERMISSION_RULES_ENABLED=false` 把整条车道关掉(上面已给);
+        // ②运维直接动存储。
+        // 🔴 第二条的**谓词必须是真的**(codex 对抗复审 R2-[medium],验真后改):第一稿写的是
+        // 「owner_key='local-owner'」——那条 SQL **一行都删不到**。`buildRuleOwnerKey`
+        // (`plugins/permission-rule-store-sql.ts`)把 owner_key 算成 `sha256("local-owner")` 的十六进制,
+        // 字面判别式存在**另一列** `owner_kind` 上。给一条匹配零行的删除语句比不给更坏:它会静默成功,
+        // 运维以为收回了权限而规则还在放行。真谓词 = `permission_rule` 表的 `owner_kind='local-owner'`。
+        // File 后端那侧是固定文件名,照给。
+        // 店层与车道层其实已接通(core 5.24.0 的 `removePersistedRule` 收 `RuleOwner`,本仓
+        // `rules-consent.ts` 的 `listRules`/`removeRule` 已能寻址该桶,格见
+        // `test/rules-consent-local-owner.test.ts`),缺的只是一个 HTTP 开口 —— 开不开、开在哪条门
+        // (operator 面 / run-local 面)属产品面裁定,不在本车擅开。
         ctx.logger.info("permission_rules_activated_by_default", {
             buckets,
             knob: "PERMISSION_RULES_ENABLED",
             explicit: false,
             note: `${buckets} pre-existing permission-rule bucket(s) went live with this release's ON-by-default flip — ` +
-                "inspect with GET /v1/rules, revoke with DELETE /v1/rules, or set PERMISSION_RULES_ENABLED=false to keep the lane off",
+                "inspect with GET /v1/rules, revoke with DELETE /v1/rules, or set PERMISSION_RULES_ENABLED=false to keep the lane off. " +
+                "NOTE: an identity-less local-owner bucket (if this count includes one) is NOT reachable through those two " +
+                "principal-addressed endpoints, and this build exposes NO self-service path for it — either turn the knob off, " +
+                "or remove the bucket at the storage layer (file backend: the permission-rules/local-owner.json file; " +
+                "SQL backend: the permission_rule row WHERE owner_kind='local-owner')",
         });
     }
     return { buckets };

package/dist/boot/reapers.d.ts

@@ -51,6 +51,12 @@ export interface ThrottledReaperCatch {
  * survives across ticks — a fresh instance per tick would never accumulate past 1.
  */
 export declare function createThrottledReaperCatch(name: string, logger: Logger, threshold?: number): ThrottledReaperCatch;
+/** A-010.17 —— 维护 tick 真正消费的那**一手**(窄口;理由见 `ReapersCtx.permissionRuleStores`)。
+ *  可选成员:File 车道没有这一面(追加日志的压实是另一件事,如实登记在 `rules-consent.ts` 的
+ *  `PermissionRuleStoreBundle.reapExpired` 注里),缺席 ⇒ 本腿零调用。 */
+export interface PermissionRuleRetentionSweeper {
+    reapExpired?(nowMs: number): Promise<number>;
+}
 export interface ReapersCtx {
     config: ServiceConfig;
     logger: Logger;
@@ -80,6 +86,15 @@ export interface ReapersCtx {
      *  `TOOL_APPROVAL_ENABLED=false` 的部署恒 undefined ⇒ 收敛器照常收敛,只是不发通知帧(壳侧靠
      *  重连 preamble 对账,见 approval-card.ts 的 `ApprovalRevokeFrame` 顶注)。 */
     toolApproval: ToolApprovalCoordinator | undefined;
+    /** A-010.17:规则店的**保留期口**。`PERMISSION_RULES_ENABLED=false` 或后端没实装 ⇒ undefined
+     *  ⇒ 本腿根本不注册(零扫描),与它的同族旋钮腿同姿势。
+     *
+     *  🔴 类型刻意窄到 {@link PermissionRuleRetentionSweeper} 而不是整个 `PermissionRuleStoreBundle`:
+     *  维护 tick 对那只束的其余能力(provider / approvals / tickets)一无所知也不该知道 —— 窄口让测试
+     *  能用**两行**字面量驱动真实现的同一段代码,而不必为了满足一个大接口去铸 `as unknown as` 宽松断言
+     *  (`boot/permission-rules-audit.ts` 的 `DormantRuleCounter` 是同一条判据的先例)。
+     *  生产传的仍是整只束(结构上满足这个窄口)。 */
+    permissionRuleStores: PermissionRuleRetentionSweeper | undefined;
     /** 晚绑(server 造出来才有)——见文件头「位置即契约」①。 */
     getRunDenySweep: () => ((now: number) => Promise<void>) | undefined;
 }

package/dist/boot/reapers.js

@@ -15,6 +15,7 @@
 import { Runner, defaultTaskRegistry } from "@sema-agent/core";
 import { sweepStaleScratchpads } from "../env-facts.js";
 import { CostQuota } from "../observability/cost-quota.js";
+import { isAdoptionQuiescing, trackMaintenanceLeg } from "../adoption/quiesce.js";
 import { createApprovalReconciler } from "../approval-reconciler.js";
 /** #157 / [2762]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
  *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
@@ -74,10 +75,22 @@ export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAIL
 }
 /** 起后台维护 tick,返回定时器 handle(收尾段 clearInterval 用)。 */
 export function startReapers(ctx) {
-    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, getRunDenySweep, } = ctx;
+    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, getRunDenySweep, } = ctx;
     // S7 (SILENT-FALLBACK P0-d): the sweeps' return counts were discarded — an instance death that batch-fails
     // N orphans was indistinguishable from organic failures. Count + log ONLY when a sweep flipped rows (>0),
     // so healthy ticks stay silent. Tolerant of void-returning stores (typeof guard).
+    /**
+     * 一条维护腿的**起飞登记**(codex 对抗复审 R1 [high] 的修复面)。
+     *
+     * 代替裸 `void <promise>`:语义与 `void` 完全一样(不 await、错误由各腿自己的 guard 接住),
+     * 只多一件事 —— 把这一份 promise 登记进收编闸的在飞集,好让一条正要动数据的收编弧**等它落地**。
+     * 少一处没换,那条腿就是闸的漏网者(而漏网是静默的),所以本文件里 tick 内**不该再出现裸 `void`**。
+     * 入参允许 `undefined`(可选链的腿:`void store?.reap()` 在店缺席时求值成 undefined)。
+     */
+    const leg = (p) => {
+        if (p !== undefined)
+            trackMaintenanceLeg(p);
+    };
     const reapCount = (metric, labels) => (n) => {
         if (typeof n === "number" && n > 0) {
             metrics.inc(metric, labels, n);
@@ -111,6 +124,8 @@ export function startReapers(ctx) {
     const rosterReapOlderThanGuard = createThrottledReaperCatch("roster_reap_older_than", logger);
     const scratchpadSweepStaleGuard = createThrottledReaperCatch("scratchpad_sweep_stale", logger);
     const approvalReconcileGuard = createThrottledReaperCatch("approval_reconcile", logger);
+    const permissionRuleReapGuard = createThrottledReaperCatch("permission_rule_reap_expired", logger);
+    let permissionRuleReapInFlight = false; // A-010.17 / codex R2:重入守卫(邻居四腿同形,理由见调用点)
     let approvalReconcileInFlight = false; // 车5 §8 C-8:重入守卫(邻居四先例同形——本腿时长随 PARKING 行数增长)
     // #151 车5(design/172 §3.0 对账收敛器 + 崩溃恢复扫描):建腿条件 = 开关开 ∧ **有 `StoreBackend`**
     // (见下方判据行 —— 是**任意** backend,不限 SQL twins:`local` 车道也算,它的 `approvalAsk()` 是进程内
@@ -237,12 +252,32 @@ export function startReapers(ctx) {
             metrics.setGauge("fleet_clock_probe_ok", 0);
         }
     };
+    let quiesceLogged = false;
     const reaper = setInterval(() => {
-        void probeClockSkew().then(() => probeClockSkewGuard.onSuccess(), probeClockSkewGuard.onError); // S10
-        void runStore
+        // 🔴 A-010.18(验真后修):**收编弧跑动期间整轮让路**。design/183 I1「引擎先停」此前在进程内
+        // 零执法 —— 弧在逐表 UPDATE 的同时,本 tick 的好几条腿写的正是被迁的那些表。最锋利的是审批收敛器:
+        // 它按 `owner` 读出一批行再 CAS 结算,而收编正在把 `approval_ask.owner` 从 A 改成 B ⇒ 一只本该
+        // PARKED 的 ask 可能被写成 **DENIED**,而 DENIED 是终局(收编回滚不了它,重跑也追认不回来)。
+        // 为什么让开**整轮**而不是挑腿避让、以及「只挡本副本」这条射程边界,逐字见 `adoption/quiesce.ts`。
+        // 让路是零代价的:每条腿都幂等、都能等下一轮,而弧是毫秒级的几条 UPDATE。
+        if (isAdoptionQuiescing()) {
+            if (!quiesceLogged) {
+                quiesceLogged = true; // 一次性 —— 弧毫秒级,逐 tick 刷屏没有信息量
+                logger.info("reaper_tick_yielded_to_adoption", {
+                    // 文案只说**兑得出来**的话(codex R1 [high] 的教训):本行保证的是「不再**起飞**新腿」。
+                    // 已经在飞的那些由弧侧的有界排空负责等,等不到会另打一条 `adoption_maintenance_drain_timeout`
+                    // —— 两条读数合起来才是全貌,所以这一行不许自称「没有任何腿在写被迁的表」。
+                    note: "an adoption arc is running in this process; the maintenance tick launches NO new legs for its duration. Legs already airborne when the arc began are waited on separately (bounded) — see adoption_maintenance_drain_timeout if that wait ran out (design/183 I1, in-process half)",
+                });
+            }
+            return;
+        }
+        quiesceLogged = false;
+        leg(probeClockSkew().then(() => probeClockSkewGuard.onSuccess(), probeClockSkewGuard.onError)); // S10
+        leg(runStore
             ?.reapStale(config.runStaleSec * 1000)
             .then(reapCount("runs_reaped_total", { kind: "stale" }))
-            .then(() => runsReapStaleGuard.onSuccess(), runsReapStaleGuard.onError);
+            .then(() => runsReapStaleGuard.onSuccess(), runsReapStaleGuard.onError));
         // Durable F4 (design/45) + design/80 §3 inv#3 crash-safe backstop: CAS-expire checkpoints past their
         // deadline OR their absolute terminal_at_ms backstop (≈ deny), then fail the suspended run rows whose
         // checkpoint was thereby expired (release task_active = unlock the session). These run EVERY tick,
@@ -256,51 +291,51 @@ export function startReapers(ctx) {
             // 真 pin 只存在于 in-memory TtlSessionStore;本部署 durable checkpoint 恒配 durable session 后端
             // (pin=no-op),deny-sweep 走 resumeCheckpoint=core 内部 unpin ✓。SESSION_BACKEND=memory+durable
             // checkpoint 的 niche dev 组合下 abort-expire 臂会把被钉会话泄到进程终——显式接受,不为 dev 形加腿。
-            void checkpointStore
+            leg(checkpointStore
                 .reapExpired(Date.now())
                 .then(reapCount("checkpoints_reaped_total", {}))
-                .then(() => checkpointsReapExpiredGuard.onSuccess(), checkpointsReapExpiredGuard.onError);
-            void runStore
+                .then(() => checkpointsReapExpiredGuard.onSuccess(), checkpointsReapExpiredGuard.onError));
+            leg(runStore
                 ?.failSuspendedWithExpiredCheckpoint()
                 .then(reapCount("runs_reaped_total", { kind: "expired_checkpoint" }))
-                .then(() => runsFailSuspendedExpiredCheckpointGuard.onSuccess(), runsFailSuspendedExpiredCheckpointGuard.onError);
+                .then(() => runsFailSuspendedExpiredCheckpointGuard.onSuccess(), runsFailSuspendedExpiredCheckpointGuard.onError));
             // D-D SLA-timer: resolve-DENY human/irreversible_ask gates past their deadline (graceful — the model
             // continues with the denial), vs the abort reapExpired gives the other kinds. Bounded per tick.
-            void getRunDenySweep()?.(Date.now())
-                .then(() => runDenySweepGuard.onSuccess(), runDenySweepGuard.onError); // A10 搬运改写:晚绑取值(原 `runDenySweep?.`)
+            leg(getRunDenySweep()?.(Date.now())
+                .then(() => runDenySweepGuard.onSuccess(), runDenySweepGuard.onError)); // A10 搬运改写:晚绑取值(原 `runDenySweep?.`)
         }
         // The finer, OPT-IN time-based suspended-run reaper (APPROVAL_TIMEOUT_SEC). Stays gated — reapSuspended
         // with a 0 TTL would nuke ALL suspended rows (cutoff = now). The absolute backstop above is the safety
         // floor; this is the operator-chosen deadline. ([2354] A-5:F4 轮询店的 expireStale 腿随车道退役。)
         if (config.approvalTimeoutSec > 0) {
-            void runStore
+            leg(runStore
                 ?.reapSuspended(config.approvalTimeoutSec * 1000)
                 .then(reapCount("runs_reaped_total", { kind: "suspended" }))
-                .then(() => runsReapSuspendedGuard.onSuccess(), runsReapSuspendedGuard.onError);
+                .then(() => runsReapSuspendedGuard.onSuccess(), runsReapSuspendedGuard.onError));
         }
         // GC checkpoint_ctx rows whose checkpoint is gone (bound to the checkpoint lifecycle).
-        void checkpointStore
+        leg(checkpointStore
             ?.reapCtx(Date.now() - config.runStaleSec * 1000)
-            .then(() => checkpointReapCtxGuard.onSuccess(), checkpointReapCtxGuard.onError);
+            .then(() => checkpointReapCtxGuard.onSuccess(), checkpointReapCtxGuard.onError));
         rateLimiter?.sweep();
         if (costQuota instanceof CostQuota)
             costQuota.reap(); // TiDB variant self-reaps in its flush loop
-        void toolResultStore
+        leg(toolResultStore
             ?.reapOlderThan?.(Date.now() - config.toolResultTtlSec * 1000)
-            ?.then(() => toolResultReapOlderThanGuard.onSuccess(), toolResultReapOlderThanGuard.onError); // optional extra: SQL twins only (the local FileToolResultStore persists like transcripts)
+            ?.then(() => toolResultReapOlderThanGuard.onSuccess(), toolResultReapOlderThanGuard.onError)); // optional extra: SQL twins only (the local FileToolResultStore persists like transcripts)
         // 2c session-sync: GLOBALLY GC grace-window orphan blobs (standalone /sync/blobs PUTs that were never
         // imported are otherwise collected only on reap()/deleteBySession(), which never fire for a never-imported scope).
         // Bounds the standalone-PUT orphan-blob exhaustion (review finding) to the grace window. Durable twins only (local
         // omits the seam → optional-chained no-op).
-        void fileSnapshotStore
+        leg(fileSnapshotStore
             ?.sweepOrphanBlobs?.()
-            .then(() => fileSnapshotSweepOrphanBlobsGuard.onSuccess(), fileSnapshotSweepOrphanBlobsGuard.onError);
+            .then(() => fileSnapshotSweepOrphanBlobsGuard.onSuccess(), fileSnapshotSweepOrphanBlobsGuard.onError));
         // D-1 附件 TTL:上传后从未被任何 task 引用(session_id NULL)且超过 attachmentUnboundTtlMs 的行收割
         // (绑定行不在此收——随会话 E21 级联删)。best-effort,与其余 reaper 腿同姿。
-        void taskAttachmentStore
+        leg(taskAttachmentStore
             ?.reapUnbound(Date.now() - config.attachmentUnboundTtlMs)
             .then(reapCount("attachments_reaped_total", {}))
-            .then(() => attachmentReapUnboundGuard.onSuccess(), attachmentReapUnboundGuard.onError);
+            .then(() => attachmentReapUnboundGuard.onSuccess(), attachmentReapUnboundGuard.onError));
         // D-1 孤儿**对象**彻底 GC(clay 拍 2026-07-28):对象存储 × meta 行对账,grace 默认 1h(上传先行窗
         // 保护;`ATTACHMENT_ORPHAN_GRACE_MS=0` 关掉本腿——同 tick 邻居都有旋钮,复审 F10)。
         // 列举失败=本轮 warn 跳过(「列不出来」绝不当「没有孤儿」),下轮再试。
@@ -309,7 +344,7 @@ export function startReapers(ctx) {
         // wfRunReap/bgAgentReap 都有同款守卫。
         if (config.attachmentOrphanGraceMs > 0 && !attachmentSweepInFlight && taskAttachmentStore?.sweepOrphanObjects) {
             attachmentSweepInFlight = true;
-            void taskAttachmentStore
+            leg(taskAttachmentStore
                 .sweepOrphanObjects(config.attachmentOrphanGraceMs)
                 .then((n) => { if (n > 0) {
                 metrics.inc("attachment_orphan_objects_swept_total", {}, n);
@@ -329,21 +364,21 @@ export function startReapers(ctx) {
                     // observability must never crash the tick — see comment above.
                 }
             })
-                .finally(() => { attachmentSweepInFlight = false; });
+                .finally(() => { attachmentSweepInFlight = false; }));
         }
         // P1d-β 2c session-sync: GC ABANDONED staged imports — staging-id session_event rows (`%#stg-%`) with NO
         // session_meta whose oldest row is older than the grace window (an in-flight stream stays fresh → never reaped).
         // Bounds the orphan-staging-row growth (a Phase B that opened a staging then never committed). Durable session
         // stores only (the local backend stages in memory → no durable rows; the seam is absent → optional-chained no-op).
-        void backend?.session()?.sweepStagingSessions?.()
-            .then(() => sessionSweepStagingGuard.onSuccess(), sessionSweepStagingGuard.onError);
+        leg(backend?.session()?.sweepStagingSessions?.()
+            .then(() => sessionSweepStagingGuard.onSuccess(), sessionSweepStagingGuard.onError));
         // Bake-runner backstop (§P2.7): fail any `running` bake whose lease went stale (the runner crashed mid-build),
         // append a synthetic terminal `done{failed}` so SSE readers settle, and force-release the single-flight lease.
         // staleMs (≈3× the 30s heartbeat) bounds a healthy slow build so it is never wrongly reaped.
-        void imageBakes
+        leg(imageBakes
             ?.reapStaleBakes(config.imageBakes.staleMs)
             .then(reapCount("bakes_reaped_total", {}))
-            .then(() => imageBakesReapStaleGuard.onSuccess(), imageBakesReapStaleGuard.onError);
+            .then(() => imageBakesReapStaleGuard.onSuccess(), imageBakesReapStaleGuard.onError));
         // SVC-3 worktree isolation: deregister worktrees orphaned by a process crash (the Runner never reached
         // destroy → `git worktree remove` never ran). `git worktree prune` cleans registrations whose dirs are
         // already gone. Best-effort, userland (core ships no post-kill Runner hook); never throws. Unset = no-op.
@@ -353,22 +388,22 @@ export function startReapers(ctx) {
         // 照抄 bgAgentReap 的 in-flight + finally 释放形。
         if (worktreeReap && !worktreeReapInFlight) {
             worktreeReapInFlight = true;
-            void worktreeReap()
+            leg(worktreeReap()
                 .then(() => worktreeReapGuard.onSuccess(), worktreeReapGuard.onError)
-                .finally(() => (worktreeReapInFlight = false));
+                .finally(() => (worktreeReapInFlight = false)));
         }
         // SVC-1 (adversarial-review HIGH): PERIODIC notify-recovery sweep (not just at boot) — re-delivers a terminal
         // run whose in-process notify was lost, AND finalizes-as-abandoned a `running` run orphaned past the grace
         // window (core never resumes/reaps a prior `running` row, so nothing else would). Idempotent; best-effort.
-        void workflowNotifyGate
+        leg(workflowNotifyGate
             ?.recover(workflowRecoverOpts)
-            .then(() => workflowNotifyRecoverGuard.onSuccess(), workflowNotifyRecoverGuard.onError);
+            .then(() => workflowNotifyRecoverGuard.onSuccess(), workflowNotifyRecoverGuard.onError));
         // SVC-2 (adversarial-review HIGH): time-based GC of the workflow_journal table (the heaviest, TaskResult-bearing
         // one) — the per-run deleteByRun has no run-store reap hook, so this bounded sweep is what stops unbounded
         // growth. A resume of a journal older than the retention window re-runs live (resume is an optimization).
-        void workflowJournalStore
+        leg(workflowJournalStore
             ?.reapExpired?.(Date.now(), config.workflowJournalRetentionMs)
-            .then(() => workflowJournalReapExpiredGuard.onSuccess(), workflowJournalReapExpiredGuard.onError);
+            .then(() => workflowJournalReapExpiredGuard.onSuccess(), workflowJournalReapExpiredGuard.onError));
         // Retention (WorkflowRunStore never auto-purges, reap is explicit):
         // age out TERMINAL workflow_run rows across ALL scopes. SQL twins only (reapAllScopes is their DISTINCT-scope
         // extension; the contract itself has no cross-scope enumeration, and the File store keeps the transcripts-like
@@ -379,30 +414,30 @@ export function startReapers(ctx) {
             const sweep = sqlWorkflowRunStore?.reapAllScopes?.(Date.now(), { maxAgeMs: config.workflowRunRetentionMs });
             if (sweep) {
                 wfRunReapInFlight = true;
-                void sweep
+                leg(sweep
                     .then(() => workflowRunReapAllScopesGuard.onSuccess(), workflowRunReapAllScopesGuard.onError)
-                    .finally(() => (wfRunReapInFlight = false));
+                    .finally(() => (wfRunReapInFlight = false)));
             }
             // 1.108: SQL notify-journal retention rides the same knob — ACKED rows are pure history (pending rows are
             // the recovery backlog and are NEVER reaped; the orphan-grace sweep retires a stuck pending run).
-            void workflowNotifyJournal
+            leg(workflowNotifyJournal
                 ?.reapAcked?.(Date.now() - config.workflowRunRetentionMs)
-                .then(() => workflowNotifyJournalReapAckedGuard.onSuccess(), workflowNotifyJournalReapAckedGuard.onError);
+                .then(() => workflowNotifyJournalReapAckedGuard.onSuccess(), workflowNotifyJournalReapAckedGuard.onError));
         }
         // core 1.364 durable bg-agent joint reap(定义在 interval 上方,契约注释在彼)。in-flight 守卫同
         // wfRun sweep(per-scope 串行循环,短 tick + 多 scope 下不叠罗汉)。
         if (reapBgAgents && !bgAgentReapInFlight) {
             bgAgentReapInFlight = true;
-            void reapBgAgents()
+            leg(reapBgAgents()
                 .then(() => bgAgentsReapGuard.onSuccess(), bgAgentsReapGuard.onError)
-                .finally(() => (bgAgentReapInFlight = false));
+                .finally(() => (bgAgentReapInFlight = false)));
         }
         // [1522] MED2:agent_roster TTL 清理(core RB-23②③ 派给部署的半场)——SQL twins 扩展面
         // (reapOlderThan,duck probe;File/Memory 店 core 自带 maxAgeMs,无此面=no-op)。
-        void rosterStore
+        leg(rosterStore
             ?.reapOlderThan?.(Date.now() - config.rosterRetentionMs)
             .then(reapCount("roster_rows_reaped_total", {}))
-            .then(() => rosterReapOlderThanGuard.onSuccess(), rosterReapOlderThanGuard.onError);
+            .then(() => rosterReapOlderThanGuard.onSuccess(), rosterReapOlderThanGuard.onError));
         // 修8(三路复审 absorb-2,接线 (b)):periodic scratchpad sweep — 无 E21 purge 兜到的孤儿目录(session 从未
         // DELETE、purge 当次失败、local 后端无 purge coordinator)按 mtime 过期回收。SCRATCHPAD_SWEEP_TTL_MS
         // (default 7d,0=禁用)。activeSessionIds 不传:活跃判据的诚实边界在 env-facts.ts 的 sweep 文档——TTL 7d
@@ -413,18 +448,40 @@ export function startReapers(ctx) {
         // 库延迟增长,短 REAP_INTERVAL_SEC 下无守卫会逐 tick 叠罗汉压同一批行。
         if (approvalReconciler && !approvalReconcileInFlight) {
             approvalReconcileInFlight = true;
-            void approvalReconciler
+            leg(approvalReconciler
                 .runOnce(Date.now())
                 .then(() => approvalReconcileGuard.onSuccess(), approvalReconcileGuard.onError)
-                .finally(() => (approvalReconcileInFlight = false));
+                .finally(() => (approvalReconcileInFlight = false)));
+        }
+        // A-010.17:规则店的保留期腿。**只删可证已死的行**(过期导入票 + 超期孤儿 pending 记录)——
+        // 谓词、每轮上界、以及「为什么这条腿不需要旋钮」逐字见 `plugins/permission-rule-store-sql.ts`
+        // 的 `reapExpired` / `RULE_REAP_BATCH`。
+        // `?.` 的缺席臂 = File 车道没有这一面(如实登记在 `rules-consent.ts` 的接口注里,不是漏接)。
+        //
+        // 🔴 重入守卫(codex 对抗复审 R2 [high],验真后修):第一版按「两条等值 DELETE,时长不随在飞量增长」
+        // 判定无需守卫 —— 那句话**不成立**。`permission_rule_approval` 按设计永久留审计事实(只增不减),
+        // 而 MySQL 存量库在删库重建之前拿不到新加的清扫索引 ⇒ 这条腿的时长会随**审计史**增长。一旦越过
+        // tick 间隔,下一轮就叠在同一批行上。判据与邻居四腿(attachmentSweep / wfRunReap / bgAgentReap /
+        // worktreeReap)同形。
+        if (!permissionRuleReapInFlight) {
+            permissionRuleReapInFlight = true;
+            leg(permissionRuleStores
+                ?.reapExpired?.(Date.now())
+                .then(reapCount("permission_rules_reaped_total", {}))
+                .then(() => permissionRuleReapGuard.onSuccess(), permissionRuleReapGuard.onError)
+                .finally(() => (permissionRuleReapInFlight = false)));
+            // 店缺席(File 车道 / 关旋钮)⇒ 上面整条求值成 undefined、`finally` 永不跑 ⇒ 守卫要当场归位,
+            // 否则第一轮之后这条腿就被自己的守卫永久锁死(而它本来就该零调用,锁死是静默的)。
+            if (permissionRuleStores?.reapExpired === undefined)
+                permissionRuleReapInFlight = false;
         }
         if (config.scratchpadSweepTtlMs > 0) {
-            void sweepStaleScratchpads(config.localDataRoot ?? localRoot, { olderThanMs: config.scratchpadSweepTtlMs })
+            leg(sweepStaleScratchpads(config.localDataRoot ?? localRoot, { olderThanMs: config.scratchpadSweepTtlMs })
                 .then((removed) => {
                 if (removed > 0)
                     logger.info("scratchpads_swept", { removed });
             })
-                .then(() => scratchpadSweepStaleGuard.onSuccess(), scratchpadSweepStaleGuard.onError);
+                .then(() => scratchpadSweepStaleGuard.onSuccess(), scratchpadSweepStaleGuard.onError));
         }
     }, config.reapIntervalSec * 1000);
     reaper.unref?.();

package/dist/boot/runner-deps.d.ts

@@ -87,6 +87,20 @@ export interface RunnerDepsCtx {
     /** #154 车二:持久化权限规则店 provider(core `RunnerDeps.permissionRuleStore`)。缺席 ⇒ 引擎的
      *  `permissionRules.storeWired` 如实报 false、`AskRequest.ruleSuggestions` 不铸(诚实缺席)。 */
     permissionRuleStore: RunnerDeps["permissionRuleStore"];
+    /**
+     * 交接件⑤ —— commit 尾注的署名座(`RunnerDeps.hands.commitCoAuthor`)。
+     *
+     * 🔴 为什么它属于**共享基座**而不是主 runner 的差异键:署名是**部署身份**([931]① clay 拍:
+     * 「署名 = 产品身份资产,归部署」),不是「哪一只 Runner 在跑」的属性。一个被委派出去的子代
+     * 提交进的是**同一个仓**、代表的是**同一个部署** —— 它的 commit 少一行 trailer 没有任何理由。
+     * 修前两条腿都漏:`main.ts` 与 `run-local.ts` 的 subRunner 都只在主 runner 上写了这一键,而两处
+     * 的「差异键」注释块逐条列了 sessionStore / checkpointStore / 四个座位,**都没提 hands**
+     * —— 也就是说它不是一次有理由的分歧,是漏配(与本函数头注记的 [1543]§三族A 同一个病族)。
+     * 由**调用方**给值(而不是在基座里按 `config` 现算):两条腿的判据本就不同(HTTP 腿按
+     * `configProvider === "local"` 分 branded/非 branded,run-local 恒是 Sema 本地形),
+     * 各自算一次、传进来一次,两只 Runner 自动同源。
+     */
+    hands: RunnerDeps["hands"];
     executionEnvFactory: RunnerDeps["executionEnvFactory"];
     lspManager: RunnerDeps["lspManager"];
     fleetBus: FleetEventBus;
@@ -102,7 +116,7 @@ export interface RunnerDepsCtx {
 }
 /** design/158 A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores">;
 /**
  * design/158 A10 留档发现②(review 2026-07-29,[1543]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -131,7 +145,7 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
 /** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "sessionPolicyStore" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores">;
+export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores">;
 export declare function createSharedRunnerDeps(ctx: SharedRunnerDepsCtx): SharedRunnerDeps;
 export declare function createRunnerDeps(ctx: RunnerDepsCtx): RunnerDeps;
 //# sourceMappingURL=runner-deps.d.ts.map

package/dist/boot/runner-deps.js

@@ -50,6 +50,8 @@ export function createSharedRunnerDeps(ctx) {
         // [1070]① agent-team S1:持久名册 seam(具名 spawn advisory 写入;SendMessage 活注册表 miss 后咨询)。
         rosterStore: ctx.rosterStore ? ctx.rosterStore : undefined,
         hooks: ctx.deploymentHooks,
+        // 交接件⑤:署名座进基座 ⇒ 主/sub 两只 Runner 自动同源(理由见 RunnerDepsCtx.hands 的注)。
+        hands: ctx.hands,
         toolResultStore: ctx.toolResultStore,
         // E6: operator-tightened session tool rules — core folds them into the ToolPolicy FIRST (subtract-only) for tasks
         // carrying a sessionId (a delegated subagent has none → inherits no rules). Opt-in: undefined ⇒ no rules read.
@@ -200,10 +202,9 @@ export function createRunnerDeps(ctx) {
         // toolResultStore/sessionPolicyStore —— 共享基座展开,见 createSharedRunnerDeps 头注
         // (含每键各自的历史 rationale 注释,搬到了那个函数里,不在此重复)。
         ...sharedRunnerDeps,
-        // [931]① clay 拍(core 1.300 BREAKING:缺省不署 Co-Authored-By,署名=产品身份资产归部署):
-        // branded 形态(local provider = Sema 产品线,scenarios brandIdentity 同判据)commit 尾注接 Sema 署名;
-        // 非 brand 部署维持 core 新缺省(不署)。seam=RunnerDeps.hands.commitCoAuthor。
-        hands: config.configProvider === "local" ? { commitCoAuthor: "Sema <noreply@vivi-ai.com>" } : undefined,
+        // 交接件⑤:`hands` 已随共享基座展开(`...sharedRunnerDeps`)—— 这里**不再**手写同名键,
+        // 否则它会 override 展开、把 subRunner 重新甩开(本文件头注写死的那条:「不要再在任一调用点
+        // 手写同名键」)。判据([931]① branded 才署名)搬到了唯一的取值点 main.ts 的 `commitHands`。
         // design/73 §1 (core 1.226 seam, clay 拍 2026-07-04 接): consume mechanical TaskOutcome facts into the
         // outcome ledger — tidb/pg = SQL rows (coreOutcomeToLedgerRow mapping + verbatim `core_outcome` JSON so
         // red-line ② oracleHadRedRun survives lossless), local = owner-only JSONL. Read-only v1: records facts,

package/dist/config-types.d.ts

@@ -552,8 +552,20 @@ export interface ServiceConfigFlat {
     approvalAutoBudget: number;
     /** design/80 D-E (inv#2 — safety asks are never budgetable): gated tools that ALWAYS require a human even when
      *  the auto-budget is on — the "irreversible / never auto-approve" set. empty = the budget may auto-approve any
-     *  required tool. (In-service every gated ask is gate.kind="human", so this set is the ONLY way to keep an
-     *  irreversible tool human-gated under an auto-budget.) `APPROVAL_NEVER_AUTO`.
+     *  required tool THIS layer sees. `APPROVAL_NEVER_AUTO`.
+     *
+     *  🔴 **NOT the only human-gate under an auto-budget**(2026-08-10 修口,#205 件2)。这里原来写的是
+     *  "(In-service every gated ask is gate.kind=\"human\", so this set is the ONLY way to keep an irreversible
+     *  tool human-gated under an auto-budget.)" —— 两句都已过期,且过期方向是**高估本旋钮的责任**:
+     *   · design/80 D-2 起,带 egress / irreversibility 静态标记的工具铸的是 `irreversible_ask`,不是 `human`;
+     *   · core 5.24.0(#130/#131/#120)起,带 `requiresRealApproval` 的 ask 一律铸
+     *     `irreversible_ask` + `gate.realApproval:{origin}` + checkpoint v8 —— **不再铸可预算的 `human`**。
+     *     而 `requiresRealApproval` 的生产者(`createTranscriptIntegrityPolicy` / `createUnverifiableDeletePolicy`)
+     *     被 core 在 `prepare-task.js` 里**无条件**焊进每一条策略链,所以这条路径在**每一个**部署上都活着,
+     *     不是 org 治理部署的专属面。
+     *  ⇒ 本旋钮承担的是**本层**(`createDurableAskPolicy` 的 per-leg 计数预算)的 inv#2;安全类 ask 另有
+     *  core 侧那两层守卫兜底,两层各自独立、不互为前提。消费侧钉:`test/durable-approval-policy.test.ts`
+     *  的「#205 件2」describe(含反向锚:普通调用仍走预算自动批)。
      *
      *  🔴 **NOT required to be a subset of `approvalRequire`**(2026-07-31 修口)。这里原来写的是
      *  "Subset of approvalRequire",而 `approval.ts` 的 inv#2 执行面逐字相反: