@sema-agent/server 7.120.0 → 7.122.0

package/dist/fleet-client.js

@@ -1,6 +1,7 @@
-import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS } from "@sema-agent/settings-schema/fleet";
-import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS, readCapabilityReading } from "@sema-agent/settings-schema/fleet";
+import { drainingFlag, fleetMembershipKeys } from "./fleet/engine-signal.js";
 import { centerFetch, centerLaneConfigured } from "./config-center/center-request.js";
+import { recordFailOpen } from "./observability/fail-open.js";
 export const FLEET_USAGE_KEY_CAP = 1024;
 export const FLEET_CLIENT_FETCH_TIMEOUT_MS = 5000;
 export class FleetUsageAccumulator {
@@ -74,6 +75,16 @@ async function rejectionSnippet(res) {
         return "";
     }
 }
+async function capabilityReadingOf(res) {
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch (err) {
+        return { kind: "unreadable", why: "body", detail: err instanceof Error ? err.message : String(err) };
+    }
+    return readCapabilityReading(body);
+}
 export function startFleetClient(opts) {
     const f = opts.fetchImpl ?? fetch;
     const heartbeatMs = opts.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
@@ -81,28 +92,55 @@ export function startFleetClient(opts) {
     const send = (route, method, json) => centerFetch(opts.center, { kind: route }, { method, json, timeoutMs: FLEET_CLIENT_FETCH_TIMEOUT_MS, fetchImpl: f });
     let stopped = false;
     let failStreak = 0;
+    let unreadableStreak = 0;
     const address = opts.advertiseAddress;
     const announceOnce = async () => {
         if (stopped || address === undefined)
             return;
         try {
-            const verdict = opts.readiness();
-            const restart = opts.restart();
+            const signal = opts.signal();
             const modelRefusals = opts.modelRefusals();
             const body = {
                 instanceId: opts.instanceId,
                 worker: opts.center.worker,
                 address,
                 version: opts.version,
-                ready: verdict.ready,
-                draining: !verdict.ready && verdict.reasons.includes("draining"),
+                ready: signal.verdict.ready,
+                draining: drainingFlag(signal),
                 heartbeatMs,
-                ...(restart !== undefined ? { restart } : {}),
+                ...(signal.restart !== undefined ? { restart: signal.restart } : {}),
                 ...(modelRefusals !== undefined ? { modelRefusals } : {}),
+                ...fleetMembershipKeys(signal),
             };
             const { res } = await send("fleet-instances", "POST", body);
             if (!res.ok)
                 throw new Error(`announce ${res.status}${await rejectionSnippet(res)}`);
+            if (opts.onCenterCapabilities !== undefined) {
+                const reading = await capabilityReadingOf(res);
+                switch (reading.kind) {
+                    case "declared":
+                    case "undeclared":
+                        unreadableStreak = 0;
+                        opts.onCenterCapabilities(reading.kind === "declared" ? reading.capabilities : undefined);
+                        break;
+                    case "unreadable":
+                        recordFailOpen("server.fleet.announce-reply-unreadable", `why=${reading.why} leaseState=${signal.lease.state}`);
+                        unreadableStreak += 1;
+                        if (unreadableStreak === 1) {
+                            opts.logger?.warn("fleet_announce_reply_unreadable", {
+                                status: res.status,
+                                why: reading.why,
+                                ...(reading.detail !== undefined ? { error: reading.detail } : {}),
+                                note: "the fleet center's heartbeat reply is not a capability reading (unreadable body, not an object, or a malformed capabilities value) — no reading taken; the last one stands (the serving lease keeps its state and outage clock)",
+                            });
+                        }
+                        break;
+                    default: {
+                        const unhandled = reading;
+                        throw new Error(`heartbeat reply: unknown capability reading ${JSON.stringify(unhandled)}`);
+                    }
+                }
+            }
             if (failStreak > 0)
                 opts.logger?.info("fleet_announce_recovered", { after: failStreak });
             failStreak = 0;
@@ -156,7 +194,7 @@ export function startFleetClient(opts) {
     };
     const announcing = address !== undefined;
     if (announcing)
-        void announceNow();
+        queueMicrotask(() => void announceNow());
     const hb = announcing ? setInterval(() => void announceNow(), heartbeatMs) : undefined;
     hb?.unref?.();
     const uw = opts.usage ? setInterval(() => void flushUsage(), usageWindowMs) : undefined;
@@ -190,29 +228,15 @@ export function startFleetClient(opts) {
     };
     return { announceNow, stopRouting, flushFinalUsage };
 }
-export function startFleetClientFromEnv(cfg, opts) {
+export function startFleetClientFromConfig(cfg, opts) {
     const cc = cfg.configCenter;
-    const raw = opts.advertiseAddress ?? process.env.FLEET_ADVERTISE_ADDRESS;
-    const address = raw === undefined || raw === "" ? undefined : raw;
-    if (address !== undefined && cc?.baseUrl && cc.credential.declared) {
-        let parsed;
-        try {
-            parsed = new URL(address);
-        }
-        catch {
-            parsed = undefined;
-        }
-        if (parsed === undefined || (parsed.protocol !== "http:" && parsed.protocol !== "https:")) {
-            throw new Error(`FLEET_ADVERTISE_ADDRESS must be a parseable http(s) base URL (e.g. "http://10.0.0.5:8090"); got "${buildDisplaySafeUrl(address)}" — the fleet center rejects any other shape on every announce`);
-        }
-    }
+    const address = cfg.fleetAdvertiseAddress;
     if (!centerLaneConfigured(cfg)) {
         if (address !== undefined && cc?.baseUrl && cc.credential.declared) {
             opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
         }
         return undefined;
     }
-    const lane = cfg.configCenter;
-    return startFleetClient({ ...opts, center: { baseUrl: lane.baseUrl, credential: lane.credential, worker: lane.worker }, advertiseAddress: address });
+    return startFleetClient({ ...opts, center: cfg.configCenter, advertiseAddress: address });
 }
 //# sourceMappingURL=fleet-client.js.map

package/dist/governance-overrides.d.ts

@@ -7,13 +7,18 @@
  * 塞 `allowedTools` 的调用点会静默改写请求的表。型上禁掉它(`allowedTools?: never`),写出来就是编译红 —— 比文本扫描的静态门(方括号写法、
  * 展开形会漏)更硬。
  *
+ * 🔴 入参型上同样**没有** `permissionMode`:一条 run 的模式词只有存储的提交体一个源(写者 = 每一个 spec 出生点的盖章 —— 新的持久化写都经 `http/checkpoint-ctx.ts` `buildCheckpointCtx` —— 与 `plan_review` 写回),
+ * 按段的收紧折叠写它就是第二个源 —— 一个被批准的计划会在下一次挂起→续跑被折回 plan。core 对模式词是钳(不会放宽),所以这里不另设运行期守卫:
+ * 型禁就是这条规则的全部(`permissionMode?: never`,写出来就是编译红)。
+ *
  * 🔴 型禁有一个洞([ref] 合并复审 opus 腿):本仓没开 `exactOptionalPropertyTypes`,`{ allowedTools: undefined }` 过型检,而 core 的替换会把 base 上的表
  * 抹成 `undefined`。所以折叠口再加一道**运行期**守卫:入参对象自带 `allowedTools` 键(任何值,含 `undefined`)⇒ 抛(fail-closed:宁多问一次)。
  */
 import { type TaskSpec } from "@sema-agent/core";
-/** 收紧折叠的入参:`TaskSpec` 的字段,`allowedTools` 除外(型上禁)。 */
-export type GovernanceOverrides = Partial<Omit<TaskSpec, "allowedTools">> & {
+/** 收紧折叠的入参:`TaskSpec` 的字段,`allowedTools` 与 `permissionMode` 除外(型上禁)。 */
+export type GovernanceOverrides = Partial<Omit<TaskSpec, "allowedTools" | "permissionMode">> & {
     readonly allowedTools?: never;
+    readonly permissionMode?: never;
 };
 /** 本仓唯一的收紧折叠口(deny-wins 合并;core 在放宽时抛)。 */
 export declare function tightenGoverned(base: TaskSpec, overrides: GovernanceOverrides): TaskSpec;

package/dist/http/admission.js

@@ -2,7 +2,8 @@ import { APPROVAL_REACH, MCP_IMAGE_MAX_BASE64, isApprovalReach, isPermissionMode
 import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { autonomyModeFloor } from "../runtime-governance.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import * as facts from "../capability-facts.js";
@@ -623,19 +624,20 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.precondition_unmet", "cascade requested but no ladder configured — set MODEL_CASCADE_LADDER (catalog model names, cheapest→strongest)");
             return null;
         }
+        const admitted = stampEntryPermissionMode(body, autonomyModeFloor(deps.config.autonomy));
         try {
-            const auth = deps.authorize ? await deps.authorize({ req, body }) : undefined;
+            const auth = deps.authorize ? await deps.authorize({ req, body: admitted }) : undefined;
             const engineNotices = [];
-            const spec = await deps.resolveSpec(body, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n) });
+            const spec = await deps.resolveSpec(admitted, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n) });
             const bindingIntent = await resolveDevicePlacementIntent({
                 config: deps.config,
                 req,
                 rootSessionId: spec.sessionId,
-                deviceId: body.deviceId,
+                deviceId: admitted.deviceId,
                 store: deps.deviceStore,
                 enrollment: deps.deviceEnrollment,
             });
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: body.jobId, body, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(engineNotices.length > 0 ? { engineNotices } : {}) };
+            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(engineNotices.length > 0 ? { engineNotices } : {}) };
         }
         catch (err) {
             if (err instanceof HttpError) {

package/dist/http/approval-sweeps.js

@@ -6,9 +6,9 @@ import { APPROVAL_GATE_KINDS } from "../tool-approval.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import { hasServiceAuth } from "./dispatch.js";
 import { gatedPrincipal } from "./principal-gate.js";
-import { readinessOf, billableRefusalOf } from "./readiness.js";
+import { admissionRefusalOf, readinessOf } from "./readiness.js";
 import { readResumeCtx } from "./resume-ctx-read.js";
-import { storedBodyReplayRefusal } from "./checkpoint-ctx.js";
+import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 const BLOCKED_SCALAR_KEYS = ["errorCode", "blockedBy", "field", "reason", "count", "cap", "index"];
 function blockedScalars(body) {
     const out = {};
@@ -72,7 +72,7 @@ export function createApprovalSweeps(ctx) {
                 return undefined;
             if (read.kind === "absent")
                 return undefined;
-            return storedBodyReplayRefusal(read.ctx);
+            return storedBodyReplayRefusal(read.ctx, deps.config.autonomy);
         };
         let parkedSkipped = 0;
         const replaySkipped = [];
@@ -107,11 +107,9 @@ export function createApprovalSweeps(ctx) {
         if (!hasServiceAuth(deps.config) && !deps.config.allowUnauthedWrites) {
             return { status: 503, body: { error: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions", errorCode: "auth.service_token_required" } };
         }
-        const readiness = readinessOf(deps);
-        if (!readiness.ready) {
-            const refusal = billableRefusalOf(readiness, deps.drainState?.reason);
+        const refusal = admissionRefusalOf(readinessOf(deps), deps.servingLease?.(), "hitl-answer");
+        if (refusal !== undefined)
             return { status: refusal.status, body: refusal.body };
-        }
         if (deps.costQuota && req.httpReq) {
             const quotaPrincipal = gatedPrincipal(req.httpReq, deps.config);
             if (quotaPrincipal !== undefined) {

package/dist/http/checkpoint-ctx.d.ts

@@ -20,8 +20,19 @@
  * 同一面上的第二个「新提交会被拒、存量体重放不能放过」:提交体里技能(顶层 / 子代)的 `disallowedTools` 有引擎读成空的条目(`"Bash "` 这类 7.41 去白后有效、
  * 7.42 什么也不拒的条目)⇒ 提交 400(`resolveSpec`,拒点);存量停驻体重放 ⇒ 409 `resume_blocked_by_policy`。判据函数 = `rule-entry-list.ts` `skillDenyInertEntryOf`。
  *
- * ## 一只判据、五个问点({@link storedBodyReplayRefusal} / {@link storedBodyReplayAnswer})
- * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面两问合在 {@link storedBodyReplayRefusal} 一处,答复合在 {@link storedBodyReplayAnswer} 一处。
+ * ## 第三问(7.122.0):体里模式词的读法记号
+ * 7.122.0 起一条 run 的模式词只有一个源 —— 存储的提交体顶层 `permissionMode`(提交入口把运维 `AUTONOMY=plan` 的地板盖进去一次;`plan_review` 写回改它),
+ * 治理层不再在每一次续跑重钳。更早版本写下的行体里是**请求的原词**,运维的 plan 由治理层每段重新折上(7.121.x 及以前:只读手 + 写面 roots)。
+ * 那种行在本版上按体里的原词重放 = 静默放宽(`acceptEdits` / `bypassPermissions` 原词直接生效;无词 ⇒ 引擎读 checkpoint 记下的词)。
+ * ⇒ 同一条规则:**写模式词的人盖读法记号** —— 模式词的写者:每一个出生点(新的持久化写都经 {@link buildCheckpointCtx})与 `plan_review` 写回(经 {@link withPermissionModeRewritten}),各自写词的同一拍在 ctx 上写记号
+`permissionModeReading`(闭集只有当前一词 {@link PERMISSION_MODE_READINGS});续跑重放之前,**本部署此刻有入口地板**
+ * (`runtime-governance.ts` `autonomyModeFloor`)而行上没有当前记号、且体的生效词被地板钳会变 ⇒ 拒(行字节不动)。没有地板的部署、体的词本就在地板之下(`plan`)的行
+ * 不受影响:那两种行在新旧两种读法下答同一个词。出路:作为新任务重提(仍停驻的先取消),或在它们收尾之前把 `AUTONOMY` 设成 `read-only`(按段的只读围栏,
+ * 与 7.121.x 的 `AUTONOMY=plan` 同一个结局,且没有入口地板 ⇒ 不拒)。删除条件登记在 `plugins/one-time-migrations.ts` 的 M12 行。
+ *
+ * ## 一只判据、五个问点(`http/stored-body-replay.ts` 的 `storedBodyReplayRefusal` / 本模块的 {@link storedBodyReplayAnswer})
+ * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面三问合在 `stored-body-replay.ts` 的 `storedBodyReplayRefusal` 一处(前两问的判据在本模块、第三问读请求设置
+ * 与治理两个属主 —— 本模块的值依赖要留在 node 内建 / 引擎包根之内,随包排空脚本经编译产物读它),答复合在 {@link storedBodyReplayAnswer} 一处。
  * 问点五个,同调同答:续跑驱动段(`resume-legs.ts` `resolveResumeSpecOrBlocked`,另四条腿的唯一判点)· plan_review 的 prepare 段(读类拒,在 nonce 消费之前)·
  * SLA 拒扫腿的跳过臂(`approval-sweeps.ts`)· 终态 run 的 steer 铸唤醒卡之前(`routes/runs.ts`:铸卡前先证明它赎得回,证不出 ⇒ 不铸、当场同一个拒)·
  * `resolveSpec` 本身留作真正的拒点(提交腿 400;续跑腿在到它之前已被本判据答掉)。再开第六个问点必须调这两只,不许各判各的 —— 此前铸卡前只判了
@@ -32,13 +43,19 @@
  * 一次性迁移登记表(本条那一行):所有旧读法下停驻的行都已结束或被收割(停驻行的终局 = 落盘起 `TERMINAL_BACKSTOP_MS`,见
  * `plugins/checkpoint-store-sql.ts`)之后的那个版本。删的时候记号的读者一起删。
  */
+import type { PermissionMode } from "@sema-agent/core";
 import type { CheckpointCtx } from "./route-ctx.js";
 import type { TaskRequestBody } from "./wire-types.js";
-import { type SkillDenyInertEntry } from "../rule-entry-list.js";
+import type { SkillDenyInertEntry } from "../rule-entry-list.js";
 /** 读法记号的闭集(一词 = 当前读法):这一行体里的 `settings.permissions.allow` 是按「交给引擎的 allow 层」写下、也该按它读的
  *  (与能力位 `settings.permissions.allowLayer` 同一个说法)。 */
 export declare const PERMISSIONS_ALLOW_READINGS: readonly ["allow_layer"];
 export type PermissionsAllowReading = (typeof PERMISSIONS_ALLOW_READINGS)[number];
+/** 体里模式词的读法记号闭集(一词 = 当前读法):这一行体的顶层 `permissionMode` 是这条 run 模式词**唯一的源**(提交入口盖过运维地板、`plan_review` 写回改它),
+ *  续跑照它读、不再由治理层按段重钳。写点两个 = {@link buildCheckpointCtx}(每一次新的持久化写都写)与 {@link withPermissionModeRewritten}(`plan_review` 写回改词的那一拍写);
+ *  **不改词**的续跑腿写回传原 ctx ⇒ 记号随行。 */
+export declare const PERMISSION_MODE_READINGS: readonly ["entry_word"];
+export type PermissionModeReading = (typeof PERMISSION_MODE_READINGS)[number];
 /** 被拒的行是在哪种读法下写的(闭集;拒句按它穷举):`list` = 无记号或记号认不得(≤7.114.0 的名单读法;认不得的记号不是任何一代的证据,
  *  按最早那一代说话);`statement` = 7.115.0–7.116.x 写下的表态读法。 */
 export declare const ALLOW_LIST_READING_ERAS: readonly ["list", "statement"];
@@ -53,13 +70,44 @@ export declare function bodyCarriesAllowList(body: TaskRequestBody): boolean;
  *
  * 调用方是「本进程刚按当前读法读过这份体」的写点:fresh 提交(受理门按当前读法读过 `allow`),或已经过了续跑拒臂的重放腿
  * (`startFreshHostTurn` 把宿主的存量体交给 `POST /v1/runs` 同一条链 —— 它在那之前调过 `resolveResumeSpecOrBlocked`,没记号却带 `allow` 的体到不了这里)。
- * 续跑腿的**写回**不经本函数:它传读进来的 ctx(或其展开),记号随行;在写回口重新判会把一条没记号的旧行「洗」成新行。
+ * 续跑腿的**写回**不经本函数:**不改词**的写回传读进来的 ctx(记号随行,不重新判 —— 在写回口重新判会把一条没记号的旧行「洗」成新行);
+ * **改词**的写回(只有 `plan_review` 的批准 / 编辑)经 {@link withPermissionModeRewritten}。
  */
 export declare function buildCheckpointCtx(fields: {
     body: TaskRequestBody;
     memoryScope?: string | undefined;
     unattendedLeg?: true;
 }): CheckpointCtx;
+/**
+ * 模式词的**第二个写者** —— `plan_review` 的批准 / 编辑把这条 run 的体词从 `plan` 写成批准的档(`resume-legs.ts` `drivePlanReview`,调用点只有那一处;
+ * `test/allow-list-reading-park-refusal.test.ts` 枚举调用点,多一处即红)。与 {@link buildCheckpointCtx} **同一条规则**:按当前读法写下的词,盖当前读法记号。
+ *
+ * 为什么记号必须随词一起写,而不是留给读的一侧去豁免:第三问问的是「体的词是不是按当前读法写下的」,记号就是这句话的证据。改写之后体里的词是本版的 `plan_review`
+ * 刚写下的(一个人刚批准的档),它确实是 `entry_word` 读法的词;若只改体、记号缺席,重建段的同一问把它读成「7.121.x 的请求原词」,被地板钳回 `plan` ≠ 所写词 ⇒ 误拒
+ * 一条刚被批准的 run。判据侧(`stored-body-replay.ts`)**不为「plan_review 之后」另开特判臂** —— 读的一侧只有一个读法,写的一侧各自负责盖章。
+ *
+ * 为什么这不是在「洗」旧行:走到写回口的行,其**原体**已过 prepare 段的同一问(词被地板钳不变:词已是 `plan`,或本部署没有地板);原体的词会被地板钳的旧行
+ * (`acceptEdits` / `bypassPermissions` / 无词)在 prepare 段就被拒,到不了这里。入参 `ctx` 的其余位(memoryScope / 无人值守标 / allow 记号)原样随行,只换体与模式词记号。
+ *
+ * 本模块零值依赖的闭包纪律不变(随包排空脚本经编译产物 import;`test/drain-check-local.test.ts`):本函数只用本模块内的东西。
+ */
+export declare function withPermissionModeRewritten(ctx: CheckpointCtx, body: TaskRequestBody): CheckpointCtx;
+/** 行上带的是不是当前的模式词读法记号(第三问的记号那一半;另一半 —— 体的生效词被地板钳会不会变 —— 读请求设置的解析层,住在 `http/stored-body-replay.ts`)。
+ *  记号缺席或认不得 ⇒ 不是「按当前读法写下」的证据,与 allow 记号同一条纪律。 */
+export declare function permissionModeReadingStated(ctx: CheckpointCtx): boolean;
+/**
+ * 第三问的拒答复 —— 码与落点同 allow 记号那一问(`checkpoint.unsupported_version`,409,`retriable:true` = 那张卡仍 pending,**不是**「原样重试会成功」)。
+ * 句子说原因(更早的版本在每次续跑重钳运维的 AUTONOMY、没把它记进任务;本版只在提交时记一次 ⇒ 续跑会按任务提交时的原词跑)与两条出路。
+ * 🔴 形是给冻结门看的:`status: <三位数>, body: { error: "<整句双引号字面>", errorCode: "<码>"`,中间只许有空白。
+ */
+export declare function permissionModeReadingRefusal(): {
+    status: number;
+    body: {
+        error: string;
+        errorCode: string;
+        retriable: true;
+    };
+};
 /**
  * 本行能否被按当前读法重放:体里 `allow` 在生效而行上的记号不是当前这一个词 ⇒ **不能**(`true` = 拒)。
  * 记号缺席、是旧词(`"statement"`)或认不得(手改 / 将来的写者)⇒ 同样拒:只有当前这个词是「按当前读法写下」的证据。
@@ -89,12 +137,11 @@ export type StoredBodyReplayRefusal = {
 } | {
     readonly kind: "skill_deny_inert";
     readonly entry: SkillDenyInertEntry;
+} | {
+    readonly kind: "permission_mode_reading";
+    readonly stored: PermissionMode | undefined;
+    readonly floor: PermissionMode;
 };
-/**
- * 「存量体能否重放」的**唯一**判据(文件头「一只判据、五个问点」):不能 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。
- * 顺序:先 allow 读法记号,再技能拒侧读成空(两问都中时答第一问 —— 任一问中都不重放,句子只需一句)。
- */
-export declare function storedBodyReplayRefusal(ctx: CheckpointCtx): StoredBodyReplayRefusal | undefined;
 /** 续跑家族交回的拒答复形(`{ status, body }`,由 `sendResumeOutcome` / 各路由发送;`body` 至少 `error` + `errorCode`)。 */
 export interface ResumeRefusalAnswer {
     readonly status: number;
@@ -110,17 +157,19 @@ export interface ResumeRefusalAnswer {
  */
 export declare function resumeBlockedByPolicyAnswer(message: string, blockedBy: string, extra?: Record<string, unknown> | undefined): ResumeRefusalAnswer;
 /**
- * {@link storedBodyReplayRefusal} 的**日志字段**(三处问点同一形,各自只再加坐标键 `sessionId` / `taskId`):`kind` 判别,allow 臂带 `era`、技能臂带 `layer`,`note` 一句出路。
+ * `stored-body-replay.ts` `storedBodyReplayRefusal` 的**日志字段**(三处问点同一形,各自只再加坐标键 `sessionId` / `taskId`):`kind` 判别,allow 臂带 `era`、技能臂带 `layer`,`note` 一句出路。
  * 事件名三个(问点各一:`resume_refused_stored_body` / `steer_wake_park_refused_stored_body` / `deny_sweep_stored_body_skipped`),字段形只有这一只。
  */
 export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefusal): {
     kind: StoredBodyReplayRefusal["kind"];
     era?: AllowListReadingEra;
     layer?: SkillDenyInertEntry["layer"];
+    storedMode?: PermissionMode | null;
+    floor?: PermissionMode;
     note: string;
 };
 /**
- * {@link storedBodyReplayRefusal} 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};技能拒侧 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
+ * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};技能拒侧 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
  * `request.field_invalid` 同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
  */
 export declare function storedBodyReplayAnswer(refusal: StoredBodyReplayRefusal): ResumeRefusalAnswer;

package/dist/http/checkpoint-ctx.js

@@ -1,5 +1,5 @@
-import { skillDenyInertEntryOf } from "../rule-entry-list.js";
 export const PERMISSIONS_ALLOW_READINGS = ["allow_layer"];
+export const PERMISSION_MODE_READINGS = ["entry_word"];
 export const ALLOW_LIST_READING_ERAS = ["list", "statement"];
 export function bodyCarriesAllowList(body) {
     const settings = body?.settings;
@@ -17,6 +17,24 @@ export function buildCheckpointCtx(fields) {
         ...(fields.memoryScope !== undefined ? { memoryScope: fields.memoryScope } : {}),
         ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
         ...(bodyCarriesAllowList(fields.body) ? { permissionsAllowReading: "allow_layer" } : {}),
+        permissionModeReading: "entry_word",
+    };
+}
+export function withPermissionModeRewritten(ctx, body) {
+    return { ...ctx, body, permissionModeReading: "entry_word" };
+}
+export function permissionModeReadingStated(ctx) {
+    const reading = ctx.permissionModeReading;
+    return typeof reading === "string" && PERMISSION_MODE_READINGS.includes(reading);
+}
+export function permissionModeReadingRefusal() {
+    return {
+        status: 409,
+        body: {
+            error: "this task was suspended by an earlier server version that re-applied this deployment's AUTONOMY on every resume instead of recording it in the task; this version records the operator's plan floor once, when a task is submitted, so continuing would run this task under the permission mode it was submitted with rather than the one it ran under. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel); to let it finish with read-only hands instead, set AUTONOMY=read-only until it does.",
+            errorCode: "checkpoint.unsupported_version",
+            retriable: true,
+        },
     };
 }
 export function allowListReadingUnstated(ctx) {
@@ -55,14 +73,6 @@ export function allowListReadingRefusal(era) {
         }
     }
 }
-export function storedBodyReplayRefusal(ctx) {
-    if (allowListReadingUnstated(ctx))
-        return { kind: "allow_list_reading", era: allowListReadingEraOf(ctx) };
-    const entry = skillDenyInertEntryOf(ctx.body);
-    if (entry !== undefined)
-        return { kind: "skill_deny_inert", entry };
-    return undefined;
-}
 export function resumeBlockedByPolicyAnswer(message, blockedBy, extra) {
     return {
         status: 409,
@@ -75,6 +85,8 @@ export function storedBodyReplayLogFields(refusal) {
             return { kind: refusal.kind, era: refusal.era, note: "this session's stored request carries settings.permissions.allow written under an earlier reading (list era: a whitelist; statement era: a statement that cleared only the unstated question); it is not replayed under the current reading — the task stays suspended until someone cancels it" };
         case "skill_deny_inert":
             return { kind: refusal.kind, layer: refusal.entry.layer, note: "this session's stored request carries a skill disallowedTools entry the engine now reads as empty (an earlier engine trimmed it into a working deny); it is not replayed — the task stays suspended until someone cancels it and resubmits with the entry fixed" };
+        case "permission_mode_reading":
+            return { kind: refusal.kind, storedMode: refusal.stored ?? null, floor: refusal.floor, note: "this session's stored request was written before the operator's AUTONOMY plan floor was recorded in the task (earlier versions re-applied it on every resume); replaying it now would run under its submitted permission mode — the task stays suspended until someone cancels it, or AUTONOMY is set to read-only so it can finish with read-only hands" };
         default: {
             const unhandled = refusal;
             throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no log fields`);
@@ -87,6 +99,8 @@ export function storedBodyReplayAnswer(refusal) {
             return allowListReadingRefusal(refusal.era);
         case "skill_deny_inert":
             return resumeBlockedByPolicyAnswer(refusal.entry.message, "request.field_invalid");
+        case "permission_mode_reading":
+            return permissionModeReadingRefusal();
         default: {
             const unhandled = refusal;
             throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no answer`);

package/dist/http/dispatch.js

@@ -3,9 +3,11 @@ import { setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isDestructiveSessio
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
-import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath } from "./route-table.js";
-import { sendJson, sendError, isSseResponse } from "./send.js";
-import { readinessOf, healthReadinessKeys, sendReadyz, billableRefusalOf, sendBillableRefusal } from "./readiness.js";
+import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest } from "./route-table.js";
+import { sendJson, sendError, isSseResponse, endSseWithError } from "./send.js";
+import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf } from "./readiness.js";
+import { fleetMembershipKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
+import { buildHealthSelfReport } from "./health-self-report.js";
 import { authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, verifiedIdentitySource } from "./principal-gate.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 export function hasServiceAuth(config) {
@@ -41,6 +43,7 @@ export function createDispatch(ctx) {
     const { deps, noteActivity, routeCtxBase, counters } = ctx;
     const openResponses = new Set();
     let lastAttachEndedAt = 0;
+    const openSubscriptions = new Set();
     if (deps.drainState) {
         deps.drainState.attachedStreams = () => {
             let n = 0;
@@ -50,6 +53,12 @@ export function createDispatch(ctx) {
             return n;
         };
         deps.drainState.lastAttachEndedAt = () => lastAttachEndedAt;
+        deps.drainState.endSubscriptions = () => {
+            const { errorCode, message } = billableRefusalOf("draining").body;
+            for (const r of [...openSubscriptions])
+                if (isSseResponse(r))
+                    endSseWithError(r, { errorCode, message });
+        };
     }
     async function dispatchSegment(rows, req, res, url, search, method, allow, ctx, admit) {
         for (const row of rows) {
@@ -80,10 +89,14 @@ export function createDispatch(ctx) {
         const allow = { pre: [], post: [] };
         noteActivity(url);
         const admitted = method !== "OPTIONS" && !isProbePath(url);
-        if (admitted)
+        const subscription = admitted && isSubscriptionRequest(method, url);
+        const countedInflight = admitted && !subscription;
+        if (countedInflight)
             counters.admittedInflight++;
         if (admitted)
             openResponses.add(res);
+        if (subscription)
+            openSubscriptions.add(res);
         let logged = false;
         const reqState = { streamTaskId: undefined, streamDetached: false, source: null };
         const ctx = { deps: routeCtxBase.deps, registry: routeCtxBase.registry, helpers: routeCtxBase.helpers, local: routeCtxBase.local, legs: routeCtxBase.legs, req: reqState };
@@ -91,8 +104,9 @@ export function createDispatch(ctx) {
             if (logged)
                 return;
             logged = true;
-            if (admitted)
+            if (countedInflight)
                 counters.admittedInflight--;
+            openSubscriptions.delete(res);
             if (openResponses.delete(res) && isSseResponse(res))
                 lastAttachEndedAt = performance.now();
             const route = routeLabel(method, url);
@@ -113,7 +127,7 @@ export function createDispatch(ctx) {
             return;
         }
         if (req.method === "GET" && url === "/health") {
-            const restart = deps.restartState?.();
+            const signal = mintEngineSignal(deps);
             const configHash = createHash("sha256")
                 .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec?.provider, port: deps.config.port }))
                 .digest("hex")
@@ -121,24 +135,26 @@ export function createDispatch(ctx) {
             sendJson(res, 200, {
                 status: "ok",
                 ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
-                ...(deps.drainState?.draining ? { draining: true, ...(deps.drainState.since ? { drainingSince: deps.drainState.since } : {}), ...(deps.drainState.reason ? { drainReason: deps.drainState.reason } : {}) } : {}),
+                ...(deps.drainState?.draining ? { draining: true, ...(deps.drainState.since ? { drainingSince: deps.drainState.since } : {}) } : {}),
                 ...(deps.drainState?.inflight ? { inflight: deps.drainState.inflight() } : {}),
                 ...(deps.storePosture?.degradedReason !== undefined ? { durable: false, storeDegraded: true } : {}),
-                ...healthReadinessKeys(readinessOf(deps)),
+                ...healthReadinessKeys(signal.verdict),
                 model: deps.config.model.id,
                 sessionBackend: deps.sessionStoreLabel ?? deps.config.sessionBackend,
                 sessions: deps.runner.sessions.size,
                 ...(deps.instanceId ? { instanceId: deps.instanceId } : {}),
+                ...fleetMembershipKeys(signal),
                 ...(deps.config.localDataRoot ? { dataRoot: deps.config.localDataRoot } : {}),
                 configHash,
                 pid: process.pid,
                 startedAt: PROCESS_STARTED_AT_MS,
                 port: deps.config.port,
                 ...(deps.config.directDoorActive ? { directDoorActive: true } : {}),
-                ...(restart ? { restartRequired: true, restart } : {}),
+                ...buildHealthSelfReport(deps, hasServiceAuth(deps.config)),
+                ...(signal.restart ? { ...(restartActionable(signal) ? { restartRequired: true } : {}), restart: signal.restart } : {}),
                 ...(() => {
-                    const stuck = deps.planeDeferredState?.();
-                    return stuck ? { modelPlaneDeferred: { version: stuck.version, since: stuck.since, noHandoff: true, ...(stuck.blocked ? { blockedReasons: stuck.blocked } : {}) } } : {};
+                    const configHandoff = deps.configHandoffState?.();
+                    return configHandoff ? { configHandoff } : {};
                 })(),
                 ...(() => {
                     const gen = deps.configApplyState?.();
@@ -173,7 +189,7 @@ export function createDispatch(ctx) {
             return;
         }
         if (req.method === "GET" && url === "/readyz") {
-            sendReadyz(res, readinessOf(deps));
+            sendReadyz(res, mintEngineSignal(deps).verdict);
             return;
         }
         if (req.method === "GET" && (url === "/metrics" || url === "/metrics/summary" || url === "/metrics/plan-cache")) {
@@ -244,10 +260,11 @@ export function createDispatch(ctx) {
             sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions");
             return;
         }
-        if (req.method === "POST" && isBillableSubmitPath(url) && !isMethodDispatchedSubmitPath(url)) {
-            const verdict = readinessOf(deps);
-            if (!verdict.ready) {
-                sendBillableRefusal(res, billableRefusalOf(verdict, deps.drainState?.reason));
+        const billableKind = req.method === "POST" && !isMethodDispatchedSubmitPath(url) ? billableKindOf(url) : undefined;
+        if (billableKind !== undefined) {
+            const refusal = admissionRefusalOf(readinessOf(deps), deps.servingLease?.(), billableKind);
+            if (refusal !== undefined) {
+                sendBillableRefusal(res, refusal);
                 return;
             }
         }

package/dist/http/health-self-report.d.ts

@@ -0,0 +1,60 @@
+/**
+ * `GET /health` 的**自报位**(7.121.0)—— `auth` / `operator` / `center` 三键:壳在**带凭据之前**要知道的三件部署事实
+ * (这台引擎要不要凭据、认哪几类、能不能附着身份;有没有运维方可找;接着哪个中心、会话会不会出现在那个中心的 web 面)。
+ *
+ * ## 规则(一条):自报位是**投影**,不是第二份规则
+ * 每一位读的是**门本身读的那只谓词 / 那只取值口**,本模块不判任何东西:
+ *  · `auth.required` = 全局凭据门的武装谓词(`hasServiceAuth`,由 `dispatch.ts` 交进来 —— 门与本位读同一次求值的同一只函数);
+ *  · `auth.kinds` = {@link IDENTITY_SOURCES}(`verifiedIdentitySource` 的回值闭集)里,这台部署的装配**能**回的那几个词:
+ *    `service_token` ⇐ 全局门武装(`systemFor` 只在配了 service token 时回得出值)· `sso` ⇐ 鉴权桥装了(入口预认证只在
+ *    `registryJwtVerifier` 在场时挂身份)· `direct_door_jwt` ⇐ 直连门开着(`verifiedIdentitySource` 那一臂的第一个合取项);
+ *  · `auth.identityAttach` = kinds 里有没有**带调用方身份**的一类({@link carriesCallerIdentity},穷举):`service_token` 认的是系统
+ *    (`systemFor` 回系统名或 null),不是人;
+ *  · `operator` = 能力事实 `operatorLane`(operator 面族的 501 门读的同一只;名单本身不上 wire);
+ *  · `center.issuer` = 鉴权桥 issuer 的唯一取值 `authBridgeIssuerOf`(装配 `boot/stage-09-leader.ts` 与 caps `centerWiring.issuer` 同读);
+ *  · `center.webBaseUrl` = 运维旋钮 `SEMA_REGISTRY_WEB_URL`(`config.configCenter.webBaseUrl`,接了中心才挂;起服时已判成固定基址);
+ *  · `center.sessionsVisible` = 中心的 web 面能不能列出本引擎的会话 —— 四件接线事实全在才可能:中心车道配齐(`centerLaneConfigured`,
+ *    租约 / 用量 / 公告同一只谓词)∧ 公告地址在(配置席 `fleetAdvertiseAddress`:web 面只拨中心登记过的实例地址)∧ 鉴权桥在(web 面带的是
+ *    中心铸的中继令牌,不带 service token)∧ 会话枚举面在(事实 `sessionList`,web 面中继 `GET /v1/sessions`);缺任一 ⇒ `false`。
+ *    四件齐时:多租户(`REQUIRE_PRINCIPAL`)每条会话都落着验过的属主 ⇒ `true`;单用户形下一条会话归谁取决于提交它的那次请求带没带
+ *    身份(web 面只列调用人自己的会话)—— 部署级答不了 ⇒ `"unknown"`。
+ *
+ * ## 无鉴权面
+ * `/health` 排在凭据门之前、缺省全网卡监听:本模块只出闭集词、布尔与运维要发布的 URL。两只 URL 值都过 display-safe 律
+ * (`buildDisplaySafeUrl`,所有展示面 URL 的同一个铸点):userinfo 落地、query 值成记号、尾斜杠折掉 —— issuer 的来源
+ * (`AUTH_BRIDGE_ISSUER` / `SEMA_REGISTRY_URL`)起服时不判凭据形,这一道是它上无鉴权面的唯一闸。令牌、名单、worker 名、凭证一概不上。
+ *
+ * ## 在场律
+ * 三键**恒在场**;缺席 = 老 worker(≤7.120.x)。`center.issuer` / `center.webBaseUrl` 缺席即缺席(没有鉴权桥 / 没配旋钮),不拼不猜。
+ */
+import type { FlatServiceDeps } from "./server.js";
+import { type IdentitySource } from "./principal-gate.js";
+/** `auth.identityAttach` 的词表。 */
+export declare const IDENTITY_ATTACH_WORDS: readonly ["available", "unavailable"];
+export type IdentityAttach = (typeof IDENTITY_ATTACH_WORDS)[number];
+/** `operator` 的词表。 */
+export declare const OPERATOR_PRESENCE_WORDS: readonly ["present", "absent"];
+export type OperatorPresence = (typeof OPERATOR_PRESENCE_WORDS)[number];
+/** `center.sessionsVisible` 的值域(两个布尔 + 一个词;`"unknown"` = 接线齐了,但会话归谁要看提交它的那次请求)。 */
+export declare const SESSIONS_VISIBLE_VALUES: readonly [true, false, "unknown"];
+export type SessionsVisible = (typeof SESSIONS_VISIBLE_VALUES)[number];
+/** 三键的 wire 形(纯数据)。 */
+export interface HealthSelfReport {
+    readonly auth: {
+        readonly required: boolean;
+        readonly kinds: readonly IdentitySource[];
+        readonly identityAttach: IdentityAttach;
+    };
+    readonly operator: OperatorPresence;
+    readonly center: {
+        readonly issuer?: string;
+        readonly webBaseUrl?: string;
+        readonly sessionsVisible: SessionsVisible;
+    };
+}
+/**
+ * 三键的**唯一铸点**(`build*`:纯数据)。`credentialGateArmed` 由 `dispatch.ts` 交进来 —— 它是全局凭据门自己的那一句
+ * (`hasServiceAuth`),本模块不另求一遍(另求就是第二个写者)。
+ */
+export declare function buildHealthSelfReport(deps: Pick<FlatServiceDeps, "config" | "registryJwtVerifier" | "sessionStorage" | "runStore">, credentialGateArmed: boolean): HealthSelfReport;
+//# sourceMappingURL=health-self-report.d.ts.map