@sema-agent/server 7.121.0 → 7.123.0

package/dist/approval-reconciler.js

@@ -6,6 +6,7 @@ import { buildRevokeFrame } from "./approval-card.js";
 import { encodeCheckpointScope } from "./security.js";
 const RECONCILE_STORE_TIMEOUT_MS = 10_000;
 const RECONCILE_SEGMENT_BUDGET_MS = 30_000;
+const PARK_COMMIT_BIND_BUDGET_MS = 2_000;
 function withDeadline(op, label, timeoutMs = RECONCILE_STORE_TIMEOUT_MS) {
     let timer;
     return Promise.race([
@@ -80,6 +81,13 @@ export function decideReconcileAction(input) {
 }
 export function createApprovalReconciler(deps) {
     const { askStore, checkpoints, runs, logger, metrics, batchLimit, pendingGraceMs, adhocGraceMs, orphanTtlMs, unattendedPolicy, emitRevoke } = deps;
+    const warn = (event, fields) => {
+        try {
+            logger.warn(event, fields);
+        }
+        catch {
+        }
+    };
     const revoke = (row, askIds, reason, nowMs) => {
         if (askIds.length === 0 || !emitRevoke)
             return;
@@ -87,39 +95,32 @@ export function createApprovalReconciler(deps) {
             emitRevoke(buildRevokeFrame(row.batchId, askIds, reason, nowMs, row.taskId), { owner: row.owner, sessionId: row.sessionId, taskId: row.taskId });
         }
         catch (err) {
-            try {
-                logger.warn("approval_revoke_emit_failed", { batchId: row.batchId, count: askIds.length, err: err instanceof Error ? err.message : String(err) });
-            }
-            catch {
-            }
+            warn("approval_revoke_emit_failed", { batchId: row.batchId, count: askIds.length, err: err instanceof Error ? err.message : String(err) });
         }
     };
-    const reconcileOne = async (ask, nowMs) => {
+    const bindAtGate = async (ask, nowMs, deadlineMs) => {
+        const expired = () => deadlineMs !== undefined && Date.now() >= deadlineMs;
         const batchRow = await withDeadline(askStore.getBatch(ask.batchId), "getBatch");
         let batchState = batchRow?.state ?? "MISSING";
         let batchBoundAskId = batchRow?.boundAskId ?? null;
         const irreversibleBatch = batchState === "ABORTED" || (batchState === "ROUTING_BOUND" && batchBoundAskId !== null && batchBoundAskId !== ask.askId);
         let gateMatch;
-        if (checkpoints && !irreversibleBatch) {
+        if (checkpoints && !irreversibleBatch && !expired()) {
             const candidates = await withDeadline(checkpoints.findCheckpointCandidatesForAsk(encodeCheckpointScope(ask.owner), ask.sessionId, ask.toolCallId, ask.createdAtMs), "findCheckpointCandidatesForAsk");
             gateMatch = classifyGateMatch(ask, candidates);
             if (gateMatch.kind === "hash_mismatch") {
-                try {
-                    logger.warn("approval_reconcile_hash_mismatch", {
-                        askId: ask.askId,
-                        taskId: ask.taskId,
-                        toolCallId: ask.toolCallId,
-                        candidates: gateMatch.candidates,
-                        reason: "ask and checkpoint minted the same bound input under the same (sourceTaskId, toolCallId) identity but the digests differ — " +
-                            "the known causes are deployment-side (a hook/policy mutating an object it still holds a reference to between the two mints, " +
-                            "or a stateful getter returning a fresh value per read), not out-of-band interference; this ask keeps its fail-safe route (no park, no denial)",
-                    });
-                }
-                catch {
-                }
+                warn("approval_reconcile_hash_mismatch", {
+                    askId: ask.askId,
+                    taskId: ask.taskId,
+                    toolCallId: ask.toolCallId,
+                    candidates: gateMatch.candidates,
+                    reason: "ask and checkpoint minted the same bound input under the same (sourceTaskId, toolCallId) identity but the digests differ — " +
+                        "the known causes are deployment-side (a hook/policy mutating an object it still holds a reference to between the two mints, " +
+                        "or a stateful getter returning a fresh value per read), not out-of-band interference; this ask keeps its fail-safe route (no park, no denial)",
+                });
             }
             const match = gateMatch.kind === "match" ? gateMatch.candidate : undefined;
-            if (match) {
+            if (match && !expired()) {
                 const res = await withDeadline(askStore.bindBatch(ask.batchId, ask.askId, {
                     gateToken: match.token,
                     gateBoundCallId: match.boundCallId,
@@ -127,12 +128,20 @@ export function createApprovalReconciler(deps) {
                 }), "bindBatch");
                 if (res.ok) {
                     revoke(ask, res.voidedSiblings, "superseded_by_park", nowMs);
-                    return { outcome: "parked", match: gateMatch };
+                    return { bound: true, match: gateMatch };
                 }
                 batchState = res.batchState;
                 batchBoundAskId = res.boundAskId ?? null;
             }
         }
+        return { bound: false, ...(gateMatch !== undefined ? { match: gateMatch } : {}), batchState, batchBoundAskId, irreversibleBatch };
+    };
+    const reconcileOne = async (ask, nowMs) => {
+        const attempt = await bindAtGate(ask, nowMs);
+        if (attempt.bound)
+            return { outcome: "parked", match: attempt.match };
+        const { batchState, batchBoundAskId, irreversibleBatch } = attempt;
+        const gateMatch = attempt.match;
         const run = runs && !irreversibleBatch ? ((await withDeadline(runs.getRun(ask.taskId), "getRun")) ?? null) : null;
         const action = decideReconcileAction({ ask, candidates: [], run, batchState, batchBoundAskId, nowMs, adhocGraceMs, orphanTtlMs, allowBind: false });
         switch (action.kind) {
@@ -149,7 +158,7 @@ export function createApprovalReconciler(deps) {
                 if (!won)
                     return { outcome: "held", match: gateMatch };
                 if (action.reason === VOID_REASONS.ORPHAN_TTL_EXCEEDED) {
-                    logger.warn("approval_ask_orphan_voided", { askId: ask.askId, taskId: ask.taskId, ageMs: nowMs - ask.createdAtMs, ttlMs: orphanTtlMs });
+                    warn("approval_ask_orphan_voided", { askId: ask.askId, taskId: ask.taskId, ageMs: nowMs - ask.createdAtMs, ttlMs: orphanTtlMs });
                 }
                 revoke(ask, [ask.askId], action.reason === VOID_REASONS.BATCH_BOUND_ELSEWHERE ? "superseded_by_park" : "aborted", nowMs);
                 return { outcome: "voided", match: gateMatch };
@@ -160,6 +169,37 @@ export function createApprovalReconciler(deps) {
             }
         }
     };
+    const parkCommits = deps.parkCommits;
+    const budgetMs = deps.parkCommitBindBudgetMs ?? PARK_COMMIT_BIND_BUDGET_MS;
+    const bindCommittedPark = async (calls) => {
+        const deadlineMs = Date.now() + budgetMs;
+        const work = (async () => {
+            const rows = await askStore.listParkingBySession(calls.sessionId);
+            for (const ask of rows) {
+                if (!calls.toolCallIds.includes(ask.toolCallId))
+                    continue;
+                if (Date.now() >= deadlineMs) {
+                    warn("approval_park_commit_bind_failed", { askId: ask.askId, taskId: ask.taskId, err: `park-commit bind budget (${budgetMs}ms) spent before this row`, fallback: "periodic_sweep" });
+                    return;
+                }
+                try {
+                    if ((await bindAtGate(ask, Date.now(), deadlineMs)).bound)
+                        metrics?.inc("approval_reconciled_total", { outcome: "parked" }, 1);
+                }
+                catch (err) {
+                    warn("approval_park_commit_bind_failed", { askId: ask.askId, taskId: ask.taskId, err: err instanceof Error ? err.message : String(err), fallback: "periodic_sweep" });
+                }
+            }
+        })();
+        parkCommits?.track(work);
+        try {
+            await withDeadline(work, "bindCommittedPark", budgetMs);
+        }
+        catch (err) {
+            warn("approval_park_commit_bind_failed", { sessionId: calls.sessionId, err: err instanceof Error ? err.message : String(err), fallback: "periodic_sweep" });
+        }
+    };
+    parkCommits?.onParkCommitted(bindCommittedPark);
     return {
         async runOnce(nowMs) {
             const stats = {
@@ -184,11 +224,7 @@ export function createApprovalReconciler(deps) {
             for (const ask of parking) {
                 if (Date.now() >= parkingDeadline) {
                     stats.budgetExhausted += 1;
-                    try {
-                        logger.warn("approval_reconcile_budget_exhausted", { segment: "PARKING", processed: stats.parked + stats.denied + stats.voided + stats.held + stats.failed, scanned: stats.scanned, budgetMs: RECONCILE_SEGMENT_BUDGET_MS });
-                    }
-                    catch {
-                    }
+                    warn("approval_reconcile_budget_exhausted", { segment: "PARKING", processed: stats.parked + stats.denied + stats.voided + stats.held + stats.failed, scanned: stats.scanned, budgetMs: RECONCILE_SEGMENT_BUDGET_MS });
                     break;
                 }
                 if (ask.boundInputHash === null)
@@ -224,11 +260,7 @@ export function createApprovalReconciler(deps) {
                 }
                 catch (err) {
                     stats.failed += 1;
-                    try {
-                        logger.warn("approval_reconcile_row_failed", { askId: ask.askId, taskId: ask.taskId, err: err instanceof Error ? err.message : String(err) });
-                    }
-                    catch {
-                    }
+                    warn("approval_reconcile_row_failed", { askId: ask.askId, taskId: ask.taskId, err: err instanceof Error ? err.message : String(err) });
                 }
             }
             const pending = await withDeadline(askStore.listByState("STREAM_PENDING", batchLimit), "listByState(STREAM_PENDING)");
@@ -236,11 +268,7 @@ export function createApprovalReconciler(deps) {
             for (const row of pending) {
                 if (Date.now() >= orphanDeadline) {
                     stats.budgetExhausted += 1;
-                    try {
-                        logger.warn("approval_reconcile_budget_exhausted", { segment: "STREAM_PENDING", expired: stats.orphansExpired, scanned: pending.length, budgetMs: RECONCILE_SEGMENT_BUDGET_MS });
-                    }
-                    catch {
-                    }
+                    warn("approval_reconcile_budget_exhausted", { segment: "STREAM_PENDING", expired: stats.orphansExpired, scanned: pending.length, budgetMs: RECONCILE_SEGMENT_BUDGET_MS });
                     break;
                 }
                 if (row.expiresAtMs + pendingGraceMs >= nowMs)
@@ -254,23 +282,15 @@ export function createApprovalReconciler(deps) {
                 }
                 catch (err) {
                     stats.failed += 1;
-                    try {
-                        logger.warn("approval_orphan_expire_failed", { askId: row.askId, taskId: row.taskId, policy: unattendedPolicy, err: err instanceof Error ? err.message : String(err) });
-                    }
-                    catch {
-                    }
+                    warn("approval_orphan_expire_failed", { askId: row.askId, taskId: row.taskId, policy: unattendedPolicy, err: err instanceof Error ? err.message : String(err) });
                 }
             }
             if (stats.unmatchableNoHash > 0) {
-                try {
-                    logger.warn("approval_reconcile_rows_unmatchable", {
-                        rows: stats.unmatchableNoHash,
-                        scanned: stats.scanned,
-                        reason: "bound_input_hash is NULL — criterion 1 (identity ∧ hash) cannot match; rows fall through to the run-terminal / adhoc / orphan arms",
-                    });
-                }
-                catch {
-                }
+                warn("approval_reconcile_rows_unmatchable", {
+                    rows: stats.unmatchableNoHash,
+                    scanned: stats.scanned,
+                    reason: "bound_input_hash is NULL — criterion 1 (identity ∧ hash) cannot match; rows fall through to the run-terminal / adhoc / orphan arms",
+                });
             }
             if (stats.parked + stats.denied + stats.voided + stats.orphansExpired > 0) {
                 metrics?.inc("approval_reconciled_total", { outcome: "parked" }, stats.parked);

package/dist/audit.d.ts

@@ -48,7 +48,7 @@ export declare function buildSessionAuditLocal(root: string, sessionId: string):
  * 🔴 **会话视图的读面口 —— `GET /v1/sessions/:id` 的全部取法(整读 / `?tail` / `?before` / `?blobCap` / `?message=N`)共用这一只**。
  * 次序 = **选 → 脱 → 截**(路由 `http/routes/sessions.ts`):整条消息的选窗不切字符串,先选窗不改任何一条的脱敏读数、只把脱敏的量降到选中的那几条;
  * `blobCap` 的截断会切字符串(预览切在密钥中间,半截密钥认不出来)⇒ 截断恒在脱敏之后。
- * `messages` 缺席 ⇒ 不铸键;非数组 ⇒ 深扫;其余键(`owner` / `promptEpoch` / `model` …)逐字。字节没变 ⇒ **同一引用**。
+ * `messages` 缺席 ⇒ 不铸键;非数组 ⇒ 深扫;其余键(`owner` / `promptEpoch` / `model` …)逐字。每条消息都回同一引用 ⇒ **同一引用**(带结构叶的消息恒重建,见 {@link readByTable})。
  */
 export declare function redactSessionViewForRead<V extends object>(view: V): V;
 /** Window `messages` — `tail=N` (last N) or `before=<offset>&limit=N` ([max(0,before-N), before)).

package/dist/audit.js

@@ -45,48 +45,78 @@ async function auditFromStorage(storage, sessionId) {
 }
 const deepScrub = (v) => redactDeepWith(v, redactModelText);
 const textSlot = (v) => (typeof v === "string" ? redactModelText(v) : deepScrub(v));
-function scrubSlot(p, key, scan) {
-    const v = p[key];
-    if (v === undefined)
-        return p;
-    const next = scan(v);
-    return next === v ? p : { ...p, [key]: next };
+function readLeaf(treatment, v) {
+    switch (treatment) {
+        case "text": return textSlot(v);
+        case "structure": return deepScrub(v);
+        case "parts": return readParts(v);
+        case "verbatim": return v;
+        default: {
+            const unhandled = treatment;
+            throw new Error(`unhandled leaf treatment: ${String(unhandled)}`);
+        }
+    }
+}
+const isPlainRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+function readByTable(node, table) {
+    let changed = false;
+    const entries = Object.entries(node).map(([key, v]) => {
+        const next = readLeaf(Object.hasOwn(table, key) ? table[key] : "structure", v);
+        if (next !== v)
+            changed = true;
+        return [key, next];
+    });
+    return changed ? Object.fromEntries(entries) : node;
 }
 const PART_READ_TREATMENT = {
-    text: (p) => scrubSlot(p, "text", textSlot),
-    thinking: (p) => scrubSlot(p, "thinking", textSlot),
-    toolCall: (p) => scrubSlot(p, "arguments", deepScrub),
-    image: (p) => p,
-    document: (p) => p,
+    text: { type: "verbatim", text: "text" },
+    thinking: { type: "verbatim", thinking: "text", thinkingSignature: "verbatim", redacted: "verbatim" },
+    toolCall: { type: "verbatim", id: "verbatim", wireId: "verbatim", name: "verbatim", arguments: "structure", executionMode: "verbatim" },
+    image: { type: "verbatim", data: "verbatim", mimeType: "verbatim" },
+    document: { type: "verbatim", data: "verbatim", mimeType: "verbatim" },
 };
 function readParts(content) {
     if (!Array.isArray(content))
         return textSlot(content);
     const next = content.map((part) => {
-        if (part !== null && typeof part === "object" && !Array.isArray(part)) {
+        if (isPlainRecord(part)) {
             const type = part.type;
             if (typeof type === "string" && Object.hasOwn(PART_READ_TREATMENT, type)) {
-                return PART_READ_TREATMENT[type](part);
+                return readByTable(part, PART_READ_TREATMENT[type]);
             }
         }
         return deepScrub(part);
     });
     return next.every((x, i) => x === content[i]) ? content : next;
 }
-const readContent = (m) => scrubSlot(m, "content", readParts);
 const MESSAGE_READ_TREATMENT = {
-    user: (m) => m,
-    custom: (m) => m,
-    assistant: (m) => readContent(m),
-    toolResult: (m) => scrubSlot(readContent(m), "details", deepScrub),
-    bashExecution: (m) => scrubSlot(scrubSlot(m, "command", textSlot), "output", textSlot),
-    compactionSummary: (m) => scrubSlot(m, "summary", textSlot),
+    user: {
+        role: "verbatim", content: "verbatim", timestamp: "verbatim", enginePrefixChars: "verbatim", engineSegments: "verbatim",
+        engineMinted: "verbatim", engineNoteKey: "verbatim", provenance: "verbatim", actor: "verbatim",
+    },
+    custom: { role: "verbatim", customType: "verbatim", content: "verbatim", display: "verbatim", details: "verbatim", provenance: "verbatim", timestamp: "verbatim" },
+    assistant: {
+        role: "verbatim", content: "parts", errorMessage: "text", diagnostics: "structure", repetition: "structure",
+        api: "verbatim", provider: "verbatim", model: "verbatim", responseModel: "verbatim", responseId: "verbatim", requestId: "verbatim",
+        isApiErrorMessage: "verbatim", apiErrorStatus: "verbatim", apiErrorCode: "verbatim", usage: "verbatim", usageMissing: "verbatim",
+        stopReason: "verbatim", errorKind: "verbatim", inputTooLongRuledOut: "verbatim", partialFinalized: "verbatim",
+        staticReasoningCut: "verbatim", timestamp: "verbatim",
+    },
+    toolResult: { role: "verbatim", toolCallId: "verbatim", toolName: "verbatim", content: "parts", details: "structure", isError: "verbatim", timestamp: "verbatim" },
+    bashExecution: {
+        role: "verbatim", command: "text", output: "text", exitCode: "verbatim", cancelled: "verbatim", truncated: "verbatim",
+        fullOutputPath: "verbatim", timestamp: "verbatim", excludeFromContext: "verbatim",
+    },
+    compactionSummary: {
+        role: "verbatim", summary: "text", details: "structure", tokensBefore: "verbatim", timestamp: "verbatim", elidedMessages: "verbatim",
+        unsummarizedMessages: "verbatim", tokensAfter: "verbatim", firstKeptEntryId: "verbatim",
+    },
 };
 function readMessage(m) {
-    if (m !== null && typeof m === "object" && !Array.isArray(m)) {
+    if (isPlainRecord(m)) {
         const role = m.role;
         if (typeof role === "string" && Object.hasOwn(MESSAGE_READ_TREATMENT, role)) {
-            return MESSAGE_READ_TREATMENT[role](m);
+            return readByTable(m, MESSAGE_READ_TREATMENT[role]);
         }
     }
     return deepScrub(m);

package/dist/auto-mode-face.d.ts

@@ -15,7 +15,9 @@
  *
  * 本模块按**server 侧可知的同三项**算一份「若此刻提交会不会武装」的裁决,供壳(cli `sema doctor permissions`)
  * 与人自查。三项分别对应三个未武装原因(判序 = 谓词的合取序,先判到的先报):
- *  · `mode_not_auto`        —— 本次意图不是 auto(`?permissionMode=` 查询串给的;缺席 = 按 auto 意图答);
+ *  · `mode_not_auto`        —— 本次意图不是 auto(`?permissionMode=` 查询串给的;缺席 = 按 auto 意图答),且原样到得了引擎(本部署的入口地板没改它);
+ *  · `operator_floor`       —— 本部署的运维入口地板(`AUTONOMY=plan`)把本次意图改成了别的词、那个词不是 auto(`runtime-governance.ts`
+ *                              `entryPermissionMode` 的 `clamped`,与受理门同一只函数)—— 到得了引擎的词由运维定,出路在运维换档,不在请求的词;
  *  · `deployment_incapable` —— 装配面没挂 `RunnerDeps.autoMode` 分类器席位(生产装配恒挂;桩/一次性 CLI 不挂);
  *  · `org_denied`           —— per-principal caps 的 `autoMode === false` 且本地 deny 未设(center 显式 deny、center
  *                              硬失败的 fail-closed 拒项);
@@ -34,7 +36,8 @@
  * 规则集少一整支;**不再读任何 dist 文本**。
  *
  * ## 闭集纪律([ref])
- * 六词是 core [ref] seam ⑤ + [ref] PM 裁定的闭集;`AUTO_MODE_UNARMED_REASON_SEMANTICS` 是 `Record<Reason, string>` 锁步表——
+ * 七词:core [ref] seam ⑤ + [ref] PM 裁定的六词 + `operator_floor`(意图被运维入口地板改词;与 `local_denied` / `org_denied` 同理按「指路不同」拆出);
+ * `AUTO_MODE_UNARMED_REASON_SEMANTICS` 是 `Record<Reason, string>` 锁步表——
  * 词表加员而语义表不加、或反之,都是编译红。本面**不**给壳发 prose(机器码上 wire,人话归壳),语义表只
  * 服务于文档/测试对拍。
  *
@@ -75,12 +78,13 @@ export type ClassifierRoute = {
     readonly id: undefined;
     readonly fault: string;
 };
-/** core [ref] seam ⑤ 的未武装原因闭集(六词,[ref] 加 settings_denied;顺序 = 判序)。 */
-export declare const AUTO_MODE_UNARMED_REASONS: readonly ["mode_not_auto", "deployment_incapable", "org_denied", "local_denied", "settings_denied", "resolver_fault"];
+/** 未武装原因闭集(七词:core [ref] seam ⑤ + [ref] settings_denied + 入口地板改词 operator_floor;顺序 = 判序)。 */
+export declare const AUTO_MODE_UNARMED_REASONS: readonly ["mode_not_auto", "operator_floor", "deployment_incapable", "org_denied", "local_denied", "settings_denied", "resolver_fault"];
 export type AutoModeUnarmedReason = (typeof AUTO_MODE_UNARMED_REASONS)[number];
 /** 锁步表:词表与语义一一对应(加员/删员任一侧不同步 = tsc 红)。语义只供文档/测试,不上 wire。 */
 export declare const AUTO_MODE_UNARMED_REASON_SEMANTICS: {
-    readonly mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\")";
+    readonly mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\"),且原样到得了引擎(本部署的运维入口地板没改它)—— 出路是请求 auto";
+    readonly operator_floor: "本部署的运维入口地板(AUTONOMY=plan)把本次意图改成了别的词、那个词不是 auto —— 与受理门同一只函数,提交时到得了引擎的词由运维定;出路是找运维换档,改请求的词到不了 auto";
     readonly deployment_incapable: "装配面没挂 RunnerDeps.autoMode 分类器席位(本部署/本进程形不具备分类器)";
     readonly org_denied: "per-principal caps.autoMode === false 且本地 deny 未设:center 显式 deny / center 硬失败 fail-closed 拒项";
     readonly local_denied: "本地 catalog 键 PERMISSIONS_DISABLE_AUTO_MODE=true(center/settings 键名 permissions.disableAutoMode)把 caps.autoMode 折成 false";
@@ -118,11 +122,18 @@ export type AutoModeVerdict = {
  * 三项合取的 server 侧裁决。`requestedMode` 缺席 = 按 auto 意图答(「若请求会不会武装」);`principal` =
  * 调用方经门验证的身份(匿名 ⇒ undefined ⇒ center 客户端答 undefined,本地 deny 层照样罩)。
  *
+ * 意图那一项判的是**提交之后到得了引擎的那个词**:本次意图先过本部署的运维入口地板(`floor`,调用方传 `runtime-governance.ts`
+ * `autonomyModeFloor(<活 config 的 AUTONOMY>)` —— 与受理门盖章读同一只属主),经 `entryPermissionMode`(受理门盖章调的同一只函数)。
+ * 到得了引擎的词不是 auto ⇒ 未武装,原因按「谁定了那个词」分:地板改了词(`clamped`)⇒ `operator_floor`;词原样 ⇒ `mode_not_auto`。
+ * `AUTONOMY=plan` 部署上意图缺席 / auto / 任何比 plan 松的词 ⇒ `operator_floor`;意图本身是 `plan` ⇒ `mode_not_auto`。
+ *
  * 🔴 resolver 抛错**不吞**:合成腿的每一层都自带 fail-closed/缺席臂(center 客户端 catch-all、grant 腿 onFault),
  * 走到这里还在抛 = 装配缺陷,读面 500 比一句编出来的 reason 诚实。
  */
 export declare function judgeAutoModeArming(face: AutoModeFaceDeps | undefined, input: {
     readonly requestedMode: PermissionMode | undefined;
+    /** 本部署此刻的运维入口地板(`autonomyModeFloor(config.autonomy)`;`undefined` = 没有地板)。必填:不传地板不是「没有地板」的合法拼法。 */
+    readonly floor: PermissionMode | undefined;
     readonly principal: string | undefined;
     /** 本地 `PERMISSIONS_DISABLE_AUTO_MODE`(= catalog/settings 键 `permissions.disableAutoMode`)是否置 true —— caps false 时分词
      *  `local_denied` / `org_denied`(seam ⑤;两者对壳的指路不同:改本机 env vs 找组织)。 */

package/dist/auto-mode-face.js

@@ -1,5 +1,6 @@
 import { classifierSeatModel } from "@sema-agent/core";
 import { resolveMainModel } from "./model-select.js";
+import { entryPermissionMode } from "./runtime-governance.js";
 export function classifierRouteFor(deps) {
     try {
         const main = resolveMainModel(deps);
@@ -9,9 +10,10 @@ export function classifierRouteFor(deps) {
         return { id: undefined, fault: err instanceof Error ? err.message : String(err) };
     }
 }
-export const AUTO_MODE_UNARMED_REASONS = ["mode_not_auto", "deployment_incapable", "org_denied", "local_denied", "settings_denied", "resolver_fault"];
+export const AUTO_MODE_UNARMED_REASONS = ["mode_not_auto", "operator_floor", "deployment_incapable", "org_denied", "local_denied", "settings_denied", "resolver_fault"];
 export const AUTO_MODE_UNARMED_REASON_SEMANTICS = {
-    mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\")",
+    mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\"),且原样到得了引擎(本部署的运维入口地板没改它)—— 出路是请求 auto",
+    operator_floor: "本部署的运维入口地板(AUTONOMY=plan)把本次意图改成了别的词、那个词不是 auto —— 与受理门同一只函数,提交时到得了引擎的词由运维定;出路是找运维换档,改请求的词到不了 auto",
     deployment_incapable: "装配面没挂 RunnerDeps.autoMode 分类器席位(本部署/本进程形不具备分类器)",
     org_denied: "per-principal caps.autoMode === false 且本地 deny 未设:center 显式 deny / center 硬失败 fail-closed 拒项",
     local_denied: "本地 catalog 键 PERMISSIONS_DISABLE_AUTO_MODE=true(center/settings 键名 permissions.disableAutoMode)把 caps.autoMode 折成 false",
@@ -21,8 +23,9 @@ export const AUTO_MODE_UNARMED_REASON_SEMANTICS = {
 export async function judgeAutoModeArming(face, input) {
     const route = face?.seatMounted ? face.classifierModel?.() : undefined;
     const model = route !== undefined ? { model: route } : {};
-    if (input.requestedMode !== undefined && input.requestedMode !== "auto")
-        return { armed: false, reason: "mode_not_auto", ...model };
+    const entry = entryPermissionMode(input.requestedMode ?? "auto", input.floor);
+    if (entry.effective !== "auto")
+        return { armed: false, reason: entry.clamped ? "operator_floor" : "mode_not_auto", ...model };
     if (face === undefined || !face.seatMounted)
         return { armed: false, reason: "deployment_incapable" };
     let caps;

package/dist/bench/s1/live-deps.js

@@ -370,6 +370,7 @@ async function runLeaderForTrap(rt, brain, models, roles, pricing, trap, cellId,
     process.env.LEADER_WORKER_BUDGET_USD = String((rt.maxCostUsd ?? 1.0) / 2);
     const run = createLeaderRunner({
         brain, models, roles, pricing, e2bApiKey: rt.e2bApiKey, workspace: W,
+        autonomy: () => undefined,
         ...(s1DebugGit() ? { logger: { warn: (m, x) => console.error(`[S1_DEBUG_LEADER warn] ${m}`, x ? JSON.stringify(x).slice(0, 300) : ""), info: (m, x) => console.error(`[S1_DEBUG_LEADER info] ${m}`, x ? JSON.stringify(x).slice(0, 200) : "") } } : {}),
     });
     const teamSeedWrite = (trap.seedFiles ?? [])

package/dist/boot/config-center.js

@@ -133,6 +133,7 @@ export async function createConfigCenterRuntime(ctx) {
             logger.warn("config_entry_dropped", {
                 domain: d.domain,
                 entry: d.entry,
+                reasonCode: d.reasonCode,
                 error: d.error,
                 version: r.effective.version,
                 phase,
@@ -419,6 +420,8 @@ export async function createConfigCenterRuntime(ctx) {
                 logger.warn("config_lkg_unusable", { path: lkgPath, reason: "center credential identity changed while the LKG was being read — not used", note: "env fallback serves; the current identity's next pull re-establishes its own LKG" });
                 return null;
             }
+            if (read.migrated !== undefined)
+                logger.info("config_lkg_migrated", { to: lkgPath, note: read.migrated });
             logger.info("config_loaded_lkg", { path: lkgPath, savedAt: read.lkg.savedAt, why, scope, note: lkgReadNote(scope) });
             const lkgEffective = read.lkg.effective;
             candidateIdentity.set(lkgEffective, identity);

package/dist/boot/leader.js

@@ -51,6 +51,7 @@ export function createLeaderFace(ctx) {
                 retentionPolicy: governanceSeams.retentionPolicy,
             },
             deploymentPosture: () => buildDeploymentPostureSeats(config),
+            autonomy: () => config.autonomy,
             ...(ctx.tracer ? { tracer: ctx.tracer } : {}),
             ...(config.usageWindows && ctx.usageWindowStore
                 ? { usageWindows: config.usageWindows, usageWindowStore: ctx.usageWindowStore }

package/dist/boot/reapers.d.ts

@@ -24,6 +24,7 @@ import type { TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import type { FileHistoryErasureFace } from "../file-history-capture.js";
 import type { ApprovalNonceStore, CheckpointStoreFull, CostQuotaStore, ImageBake, RateLimiterStore, ServiceWorkflowJournalStore, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
+import type { ParkCommitWatch } from "../plugins/park-commit-watch.js";
 /** [ref] / [ref]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
  *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
  *  below are correct in DIRECTION (a hiccuping periodic sweep must never crash the whole tick loop — one bad
@@ -68,6 +69,8 @@ export interface ReapersCtx {
     subRunner: Runner;
     runStore: ReturnType<StoreBackend["run"]> | undefined;
     checkpointStore: CheckpointStoreFull | undefined;
+    /** S-1280:checkpoint 店的 park 提交观察层(stage-06 与店同一处铸;在场 ⇔ 有 checkpoint 店)。对账收敛器订阅它,在停车行提交那一拍收口 PARKING。 */
+    parkCommits: ParkCommitWatch | undefined;
     rateLimiter: RateLimiter | RateLimiterStore | undefined;
     costQuota: CostQuota | CostQuotaStore | undefined;
     toolResultStore: ToolResultStoreFull | undefined;

package/dist/boot/reapers.js

@@ -56,7 +56,7 @@ export function createPlacementAwareReapSessions(deps) {
     };
 }
 export function startReapers(ctx) {
-    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, userInputLedger, } = ctx;
+    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits, rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, userInputLedger, } = ctx;
     const leg = (p) => {
         if (p !== undefined)
             trackMaintenanceLeg(p);
@@ -122,6 +122,7 @@ export function startReapers(ctx) {
             orphanTtlMs: config.streamApproval.orphanTtlMs,
             unattendedPolicy: config.unattendedApprovalPolicy,
             ...(toolApproval ? { emitRevoke: (frame, target) => void toolApproval.emitRevoke(frame, target) } : {}),
+            parkCommits,
         });
     })();
     const reapSessions = createPlacementAwareReapSessions({ host: backend?.session(), routed: subRunner.sessions });

package/dist/boot/resolve-spec.js

@@ -26,7 +26,7 @@ import { resourceSuspendOptIn } from "../resource-suspend.js";
 import { isIsolatedExecEnv, routeServiceTask, supPostureOverrides } from "../router/route-orchestration.js";
 import { tightenGoverned } from "../governance-overrides.js";
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
-import { applyRuntimeGovernance, stripDelegationTools } from "../runtime-governance.js";
+import { applyRuntimeGovernance } from "../runtime-governance.js";
 import { HttpError, createCodedHttpError, encodeCheckpointScope } from "../security.js";
 import { memoryProjectKeyFor, memorySpecForRequest } from "../memory-scope.js";
 import { inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
@@ -599,9 +599,6 @@ export function createResolveSpec(ctx) {
                 throw new HttpError(422, `request settings cannot be applied as written: ${e.message}`);
             }
         }
-        if (governed.handsReadOnly === true && Array.isArray(governed.tools)) {
-            governed = { ...governed, tools: stripDelegationTools(governed.tools) };
-        }
         if (shouldDiscloseNoPersistentMemory({
             memoryFaceMounted: memoryFaceMounted(governed.memory),
             declaredCapable: effectiveMemoryPersistenceCapable(config),

package/dist/boot/shutdown.js

@@ -8,7 +8,7 @@ import { installProcessExitBoundary } from "./exit-boundary.js";
 import { createEngineLeaseTracker } from "./engine-lease.js";
 import { writeExitLast, readExitLast, clearExitLast } from "./exit-last.js";
 import { isScriptRealmRejection, describeRejectionReason } from "../orchestration/hardened-vm-runner.js";
-import { DRAIN_CAUSE_COUNTS_AS_FIRST_STOP_SIGNAL, HARD_STOP_ACTION_ID } from "../fleet/drain-entry.js";
+import { DRAIN_CAUSE_COUNTS_AS_FIRST_STOP_SIGNAL, HARD_STOP_ACTION_ID, drainDeadlineBeyondBound } from "../fleet/drain-entry.js";
 const HARD_STOP_GRACE_MS = 10_000;
 const FINAL_EXIT_MS = 15_000;
 export function backgroundGraceRemainingMs(a) {
@@ -140,6 +140,7 @@ export function installShutdownHandlers(ctx) {
         });
         const finalExit = setTimeout(() => { logger.warn("hard_shutdown_final_deadline", { afterMs: FINAL_EXIT_MS }); process.exit(0); }, FINAL_EXIT_MS);
         finalExit.unref?.();
+        drainState.endSubscriptions?.();
         server.closeIdleConnections?.();
         const forceClose = setTimeout(() => server.closeAllConnections?.(), HARD_STOP_GRACE_MS);
         forceClose.unref?.();
@@ -154,6 +155,8 @@ export function installShutdownHandlers(ctx) {
             return { ...current, state: "already_draining" };
         if (closing)
             return { actionId: HARD_STOP_ACTION_ID, since: closingAt, deadlineAt: closingAt + FINAL_EXIT_MS, state: "already_draining" };
+        if (entry.deadlineBoundMs !== undefined && drainDeadlineBeyondBound(entry.deadlineAt, at, entry.deadlineBoundMs))
+            return { state: "deadline_beyond_bound", boundMs: entry.deadlineBoundMs };
         draining = true;
         drainStartedAt = performance.now();
         firstStopSignalAt = bySignal ? drainStartedAt : undefined;
@@ -167,6 +170,7 @@ export function installShutdownHandlers(ctx) {
         const deadlineMono = drainStartedAt + windowMs;
         deviceHub?.beginDrain({ graceMs: () => windowMs });
         drainState.yieldInflight?.();
+        drainState.endSubscriptions?.();
         toolApproval?.beginDrain();
         void fleetClient?.announceNow();
         const inflight = drainState.inflight?.() ?? 0;
@@ -234,6 +238,7 @@ export function installShutdownHandlers(ctx) {
     process.on("SIGINT", onSigint);
     const onSighup = createSighupIdleHandler({
         inflight: () => drainState.inflight?.() ?? 0,
+        attached: () => drainState.attachedStreams?.() ?? 0,
         lastActivityAt: () => drainState.lastActivityAt?.() ?? 0,
         isStopped: () => closing || draining,
         escalate: () => drainOnCause("signal:SIGHUP"),

package/dist/boot/stage-08-reapers.js

@@ -5,9 +5,9 @@ import { startRetentionLane, RETENTION_LEASE_TTL_FACTOR } from "./retention-lane
 import { createLimitSync } from "./limit-sync.js";
 import { runDenySweep } from "./late-binds.js";
 export function runStage08(ctx) {
-    const { approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, config, configCenter, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, handslessRunner, handslessSubRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, userInputLedger, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
+    const { approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, configCenter, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, handslessRunner, handslessSubRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, userInputLedger, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
     const reaper = startReapers({
-        config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore,
+        config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits,
         rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap,
         workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore,
         backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, userInputLedger,

package/dist/capabilities/memory-notice.d.ts

@@ -67,7 +67,7 @@ export interface MemoryFaceFacts {
     /** 本请求命中场景的手带表态([ref] 判别位)。`none` = 该场景跑在不挂 `executionEnvFactory` 的 Runner 上,
      *  core 的手带 band(Bash/Edit/Write/…)整批不 mount。 */
     hands: ScenarioHands;
-    /** 折完 governance+settings 后的最终 `handsReadOnly`(plan 模式 / autonomy 收窄)。手带只剩读腿。 */
+    /** 折完 governance+settings 后的最终 `handsReadOnly`(`AUTONOMY=read-only` 收窄;plan 模式不点亮它 —— plan 的手带照挂、调用时由引擎问)。手带只剩读腿。 */
     handsReadOnly: boolean;
     /** 折完之后的最终 `TaskSpec.excludeAllTools`(S-493;core 7.8.0 [ref])。`true` = **整只**工具面卸空
      *  (core `prepareDeferClassify` 对它直接 `roster.unmountWhere(() => true)`)⇒ 手带在场也一条落盘路都不剩。