@sema-agent/server 7.128.0 → 7.129.0

package/dist/approval-card.js

@@ -1,7 +1,8 @@
 import { z } from "zod";
-import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, STEER_REPLAY_FACETS, isAskClass, isAskOrigin, isAutoModeFallbackCause, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
+import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, BOUND_GRANT_ABSENCES, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, RESUME_STARTUP_CAUSES, RULE_OFFERS_ABSENCES, STEER_REPLAY_FACETS, isAskClass, isAskOrigin, isAutoModeFallbackCause, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
 import { redactSecrets } from "./trace/redact.js";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { retireParkArmWords, retireStoredCardWords } from "./retired-card-words.js";
 import { PERSISTED_RULE_MATCHES, UNCOVERED_SEGMENT_REASONS } from "./permission-rule-vocab.js";
 export const MAX_AGENT_NAME = 200;
 const MAX_IDENT = 200;
@@ -267,8 +268,7 @@ export function readRuleEvidence(req) {
         ...(raw.personalRuleDotsAbsent !== undefined ? { personalRuleDotsAbsent: raw.personalRuleDotsAbsent } : {}),
     };
 }
-const RULE_OFFERS_ABSENCE_VALUES = ["mandated", "lane_cannot_speak", "shadowed"];
-export const RuleOffersAbsenceSchema = z.enum(RULE_OFFERS_ABSENCE_VALUES);
+export const RuleOffersAbsenceSchema = z.enum(RULE_OFFERS_ABSENCES);
 const RuleOffersAbsenceEnvelopeSchema = z.object({ ruleOffersAbsence: RuleOffersAbsenceSchema.optional() });
 export function readRuleOffersAbsenceSeat(x) {
     const parsed = RuleOffersAbsenceEnvelopeSchema.safeParse(x);
@@ -318,11 +318,21 @@ function isSteerReplayDiffers(v) {
     const facets = STEER_REPLAY_FACETS;
     return Array.isArray(v) && v.length > 0 && v.every((f) => facets.includes(f));
 }
+function isResumeStartupCause(v) {
+    const words = RESUME_STARTUP_CAUSES;
+    return words.includes(v);
+}
+function isBoundGrantAbsence(v) {
+    const words = BOUND_GRANT_ABSENCES;
+    return words.includes(v);
+}
 const CLOSED_WORD_SEAT_GUARDS = {
     mandate: isPersistedRuleMandate,
     origin: isAskOrigin,
     classifierNoRuling: isAutoModeFallbackCause,
+    boundGrantAbsence: isBoundGrantAbsence,
     differs: isSteerReplayDiffers,
+    cause: isResumeStartupCause,
 };
 export function readAskClassPair(carrier) {
     const askClass = "askClass" in carrier ? carrier.askClass : undefined;
@@ -335,13 +345,15 @@ export function readAskClassPair(carrier) {
     recordFailOpen("server.approval-card.closed-word-out-of-set", isAskClass(askClass) ? `classes=${outOfSetDetail(classes)}` : `askClass=${outOfSetDetail(askClass)}`);
     return undefined;
 }
-export function parkRowFacts(pendingAction) {
-    if (typeof pendingAction !== "object" || pendingAction === null || !("kind" in pendingAction) || pendingAction.kind !== "tool_approval")
+export function parkRowFacts(stored) {
+    if (typeof stored !== "object" || stored === null || !("kind" in stored) || stored.kind !== "tool_approval")
         return {};
+    const pendingAction = currentParkArm(stored);
     const ruleOffersAbsence = readRuleOffersAbsence(pendingAction);
     const mandate = readClosedWordSeat(pendingAction, "mandate");
     const origin = readClosedWordSeat(pendingAction, "origin");
     const askClassPair = readAskClassPair(pendingAction);
+    const boundGrantAbsence = readClosedWordSeat(pendingAction, "boundGrantAbsence");
     return {
         ...(readParkRowTrueSeat(pendingAction, "requiresRealApproval") ? { requiresRealApproval: true } : {}),
         ...(readParkRowTrueSeat(pendingAction, "mandated") ? { mandated: true } : {}),
@@ -349,6 +361,7 @@ export function parkRowFacts(pendingAction) {
         ...(origin !== undefined ? { origin } : {}),
         ...(ruleOffersAbsence !== undefined ? { ruleOffersAbsence } : {}),
         ...(askClassPair ?? {}),
+        ...(boundGrantAbsence !== undefined ? { boundGrantAbsence } : {}),
     };
 }
 const DenialLimitFallbackSchema = z
@@ -492,6 +505,22 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
 export function buildApprovalCardEnvelope(approvalId, card) {
     return { schemaVersion: APPROVAL_CARD_SCHEMA_VERSION, approvalId, card };
 }
+export function readStoredCardEnvelope(cardJson) {
+    const stored = retireStoredCardWords(cardJson);
+    if (stored.seats.length > 0)
+        noteRetiredCardWordRead("card_json", stored.seats);
+    const parsed = ApprovalCardEnvelopeSchema.safeParse(stored.value);
+    return parsed.success ? parsed.data : undefined;
+}
+export function currentParkArm(pendingAction) {
+    const arm = retireParkArmWords(pendingAction);
+    if (arm.seats.length > 0)
+        noteRetiredCardWordRead("parked row", arm.seats);
+    return arm.value;
+}
+function noteRetiredCardWordRead(carrier, seats) {
+    recordFailOpen("server.approval-card.retired-card-word-read", `${carrier}: ${seats.join(" / ")}`);
+}
 export function buildApprovalRequestFrame(input) {
     return {
         type: "approval_request",
@@ -510,8 +539,8 @@ export function buildRevokeFrame(batchId, askIds, reason, serverNowMs, originTas
     return { type: "approval_revoke", schemaVersion: 1, batchId, askIds: [...askIds], reason, serverNowMs, taskId: originTaskId };
 }
 export function buildReplayFrame(row, nowMs) {
-    const parsed = ApprovalCardEnvelopeSchema.safeParse(row.cardJson);
-    if (!parsed.success)
+    const parsed = readStoredCardEnvelope(row.cardJson);
+    if (parsed === undefined)
         return undefined;
     return {
         type: "approval_request",
@@ -519,16 +548,16 @@ export function buildReplayFrame(row, nowMs) {
         askId: row.askId,
         taskId: row.taskId,
         kind: "permission",
-        card: parsed.data.card,
+        card: parsed.card,
         expiresAtMs: row.expiresAtMs,
         expiresInMs: Math.max(0, row.expiresAtMs - nowMs),
         serverNowMs: nowMs,
-        approvalId: parsed.data.approvalId,
+        approvalId: parsed.approvalId,
     };
 }
 export function storedCardDemandsAPerson(cardJson) {
-    const parsed = ApprovalCardEnvelopeSchema.safeParse(cardJson);
-    return !parsed.success || parsed.data.card.risk.requiresRealApproval;
+    const parsed = readStoredCardEnvelope(cardJson);
+    return parsed === undefined || parsed.card.risk.requiresRealApproval;
 }
 export function buildApprovalPreamble(rows, nowMs, replayMax) {
     const frames = [];

package/dist/approval-crash-convergence.js

@@ -1,7 +1,7 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { APPROVAL_ASK_AUDIT_DIR, APPROVAL_ASK_AUDIT_LEDGER, FileApprovalAskAuditStore } from "./approval-ask-audit-store.js";
-import { ApprovalCardEnvelopeSchema } from "./approval-card.js";
+import { readStoredCardEnvelope } from "./approval-card.js";
 import { APPROVAL_ENDING_CAUSES } from "./approval-deny-reasons.js";
 import { writerGoneEvidenceFor } from "./user-input-ledger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
@@ -31,12 +31,12 @@ export async function convergeCrashedAsksAtBoot(input) {
                 break;
             for (const row of page) {
                 seen.add(row.askId);
-                const envelope = ApprovalCardEnvelopeSchema.safeParse(row.cardJson);
-                if (!envelope.success) {
+                const envelope = readStoredCardEnvelope(row.cardJson);
+                if (envelope === undefined) {
                     causeUnreadable += 1;
                     recordFailOpen("server.approval-crash-convergence.cause-unreadable", `ask ${row.askId} (task ${row.taskId}): card envelope unreadable — cause defaulted to ${APPROVAL_ENDING_CAUSES.CRASHED_BEFORE_PARK}`);
                 }
-                const reason = envelope.success && input.audit !== undefined ? input.audit.causeFor(envelope.data.approvalId) : APPROVAL_ENDING_CAUSES.CRASHED_BEFORE_PARK;
+                const reason = envelope !== undefined && input.audit !== undefined ? input.audit.causeFor(envelope.approvalId) : APPROVAL_ENDING_CAUSES.CRASHED_BEFORE_PARK;
                 let won;
                 try {
                     won = await store.transitionAsk(row.askId, "STREAM_PENDING", "VOID", { deniedReason: reason, updatedAtMs: now() });

package/dist/bake-runner/main.js

@@ -3,7 +3,7 @@ import { readFile } from "node:fs/promises";
 import { createLogger } from "../observability/logger.js";
 import { logConfigDiagnostics, parseEnvNameAllowlist, parseNumOrFailNonNegative } from "../config.js";
 import { installSecretEnvScrubRecorder } from "../observability/secret-env-scrub.js";
-import { hostSubprocessEnv } from "../server-secret-env.js";
+import { declareServerWithheldEnv, hostSubprocessEnv } from "../server-secret-env.js";
 import { shellQuote as shellSafe } from "../plugins/remote-shell.js";
 import { BakeRunner, } from "./runner.js";
 const BAKE_CLAIM_INGEST_FETCH_TIMEOUT_MS = 30_000;
@@ -256,6 +256,7 @@ function makeClock() {
     };
 }
 async function main() {
+    declareServerWithheldEnv();
     const env = loadEnv();
     const log = createLogger(process.env.LOG_LEVEL || "info");
     logConfigDiagnostics(log);

package/dist/boot/memory-consolidation.d.ts

@@ -1,6 +1,7 @@
+import { type LaneHomeDeployment } from "../execution-lane-caps.js";
 import type { RestartSliceCtx } from "../web-admin-client/restart-signal.js";
 import type { MemoryConsolidationDriverConfig, ServiceConfig } from "../config-types.js";
-import { resolveMemoryConsolidationDriver, type ConsolidationWriteJudge, type EngineNotice, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type MemoryBackend, type MemoryConsolidationDriverDeps, type SessionCaptureRecordStore } from "@sema-agent/core";
+import { resolveMemoryConsolidationDriver, type ConsolidationWriteJudge, type ConsolidationWriteJudgeInput, type EngineNotice, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type MemoryBackend, type MemoryConsolidationDriverDeps, type PermissionRuleStoreProvider, type SessionCaptureRecordStore } from "@sema-agent/core";
 /**
  * 座解析的 options 形 = core 解析器交回的那只(core 7.50.0 起它**不含** `writeJudge`:判官不是模型席的一部分,由调用方在动词上带)。
  * 取解析器的返回型而不是自己写 `Omit<…>`:形的属主是 core 的解析器,本仓不持第二份。
@@ -396,26 +397,55 @@ export declare function assertAutoConsolidationWirable(input: {
     memoryConsolidationWired: boolean;
 }): void;
 /**
- * 运维阀门腿的写判官座(core 7.50.0 起驱动动词必带)。
+ * 运维阀门腿的写判官座的**输入**(core 的判官构造器 `createConsolidationWriteJudge` 的 `input`)。返回值带一只**活的**规则店 provider(有行为,不是纯数据)⇒ `create*`(工厂命名律:`build*` 只产纯数据;不拆店出返回值,因为输入就是引擎构造器要的那一只形,多拆一个函数只会多一个规则)。
  *
- * ## 判官只有一只,这条腿拿不到它
+ * ## 构造器只有引擎那一只,本仓只供部署事实
  *
- * 「这条路径能不能写」在引擎里只有**一只**判官(合成写判官:技能拒行 / 收窄折叠 / 调用方与继承策略 / 人的持久规则车道 /
- * 组织车道,一条走法一个优先序);引擎的自动整理腿把**腿自己的**那只交给驱动。本腿(运维手动阀门)没有腿:没有名册上的
- * `Write` 脸、没有引擎盖的豁免根与工作目录、没有持久规则车道 —— 而引擎包今天不导出那只判官的构造器。在本仓手搭一只
- * 「对部署策略问一次合成 `Write`」的判官 = 把引擎判官的层走法、脸、豁免根、已中止信号的约定与判词读法**再写一份**
- * (第二个读者,与引擎那只迟早分歧,而且分歧是静默的)。所以本腿不造第二只。
+ * 「这条路径能不能写」在引擎里只有**一只**判官(合成写判官:技能拒行 / 收窄折叠 / 调用方与继承策略 / 人的持久规则车道 / 组织车道,一条走法一个优先序)。
+ * 引擎的自动整理腿(有腿:名册上的 `Write` 脸、引擎盖的豁免根、人的持久规则读者)与本腿(运维手动阀门:没有腿)用的是**同一个构造器** ——
+ * 同样的行给同样的答案,本仓不手搭第二只({@link createOperatorValveWriteJudge} 恰一处调用它,见 `test/memory-consolidation-write-judge.test.ts` ⑥)。
  *
- * ## 于是它是一只**响亮的放行座**,登记为保护型欠账
+ * ## 本仓供的两个部署事实(其余键一律缺席,缺席的语义见引擎:那一层不存在)
+ *
+ *  · `ruleStoreProvider` = 部署唯一的那只合成规则店(`RunnerDeps.permissionRuleStore` 的同一个变量,装配第 4 段铸一次)。规则店没装配 ⇒ 缺席 ⇒ 没有规则层。
+ *  · `anchors.home` = `executionLaneHomeDir(config)` —— `~/` 行的基,与引擎执行环境的 `homeDir` 座、下单 422 门、规则基 `taskHome` 是**同一只函数**
+ *    (车道没有自己的 home 时诚实缺席;缺席 ⇒ 引擎读到人持有的 `~/` 收紧行时无处锚定 = 按异议处置,拒闭)。**刻意不另调 `os.homedir()`**:
+ *    那会在非 host 车道上造出第二个读法 —— 阀门答「可解析」而腿内答「读不出」。⚠️ 今天这一键在生产座上**空转**:阀门不带主体(下面的 `principal`),
+ *    引擎读匿名地板、不读任何人的持久行,「`~/` 行无锚 ⇒ 拒闭」走不到;留着它是为了主体有了来源之后不必再回来改这里。
+ *
+ * ## 刻意缺席的键(披露,不是遗漏)—— 三层没喂,所以这条腿仍是**响亮的放行座**(P-DEBT,见 {@link createOperatorValveWriteJudge})
+ *
+ *  · `principal` / `localOwnerDeclared`(人的持久规则层):阀门是 operator 面的一次调用,本仓没有一个能回答「这个库属于谁」的来源 ——
+ *    单用户 + file 后端(阀门结构上能起的唯一形,见 {@link assertConsolidationDriverWirable})里记忆是部署级全局层 / 任务根散列的项目层,principal 标签从不分盘,
+ *    本仓也从不声明 `localOwnerRules`;整理 run 又是按 scope 单飞、可续跑的持久作业,「谁的规则」对并入 / 续跑的调用方没有定义。
+ *  · `callerPolicy`(部署的调用方策略层):`APPROVAL_REQUIRE` / `APPROVAL_DENY` / `AUTONOMY` / 敏感路径守卫集是**每任务现合成**的(`deployment-governance.ts`,
+ *    读热可改的活配置,「禁 memoize」),没有部署级单例;boot 期铸一份喂进来就是冻结一份会过期的策略(收紧不生效 = 静默放行)。喂它需要一份设计:取哪几层、
+ *    活配置怎么读、审批席取什么形;其中敏感路径层还要引擎的豁免根(`RunnerDeps.memoryEngineDir` 盖在每个请求上),而宿主构造器的输入没有这一位 —— 要向 core 请托,
+ *    不在本层造第二条豁免根的读法。
+ *  · `anchors.root`:阀门按 scope 跑,手里没有项目根 —— 项目层 scope 键是任务根的单向散列(`project-identity.ts` 的 `repo:<sha256[:24]>`),反推不出根;
+ *    全局层根本没有根。⇒ 人持有的相对 deny / ask 行无处锚定 = 异议,拒闭(引擎契约:判官不猜一行原本指向哪里)。
+ *
+ *  所以今天这条腿的放行范围与 7.128.x 相同(人的规则、部署的审批名单 / 敏感路径守卫都拦不住手动阀门这一轮折叠);变的只是「判官不再是代答」—— 往后每喂一层,
+ *  只在本函数加键,钉 = `test/memory-consolidation-write-judge.test.ts` ⑦。
  *
- * 答 `no_objection` —— 与 v7.49.x 本腿的行为逐字同(那时驱动根本不问),不回退任何现网能力;每被问一次记一次
- * `server.memory-consolidation.operator-valve-unjudged`(P-DEBT:计数 + 探针行 + 一次性告警),债在遥测里显形。
  * 自动整理腿不受影响:它走引擎腿自己的判官,人的持久规则与部署策略照判。
- * 退役条件:引擎导出宿主可用的写判官构造器(收部署策略 + 一只规则店主体)那一版,本函数换成它、本 tag 删。
- * scope 与人:本仓的文件后端不按请求主体铸 scope(单用户形是部署声明的全局层 `MEMORY_SCOPE` 与按任务根派生的项目层),
- * 所以从 scope 读不出「这是谁的库」;匿名 run 读不读本地属主那只规则桶另候裁定 —— 两件都不在本座里猜。
  */
-export declare function createOperatorValveWriteJudge(): ConsolidationWriteJudge;
+export declare function createOperatorValveJudgeInput(facts: {
+    /** 部署唯一的合成规则店(装配第 4 段铸一次,`RunnerDeps.permissionRuleStore` 与本座读同一只)。缺席 = 规则店没装配。 */
+    readonly ruleStoreProvider: PermissionRuleStoreProvider | undefined;
+    /** 只读 `executionLaneHomeDir` 读的两位(`ServiceConfig` 结构满足)。 */
+    readonly config: LaneHomeDeployment;
+}): ConsolidationWriteJudgeInput;
+/**
+ * 运维阀门腿的写判官座:引擎的判官构造器喂 {@link createOperatorValveJudgeInput},**外加一个响亮的债计数**(P-DEBT)。
+ *
+ * 构造器只有引擎那一只,本函数不判任何东西:`judge(target)` 的答案原样返回。它只在每次被问时记一次
+ * `server.memory-consolidation.operator-valve-layers-unfed`(计数 + 探针行 + 一次性告警)—— 因为人的规则层、部署策略层、项目根三样都没喂
+ * ({@link createOperatorValveJudgeInput} 头注),放行的最坏后果没变:运维手动整理时,一条点名记忆库路径的人的持久规则或部署写策略拦不住这一轮折叠
+ * (与 7.128.x 逐字同)。债在遥测里显形,而不是随着「判官已换成引擎的」这句话消失。自动整理腿不受影响,走引擎腿自己的判官。
+ * 收口 = 三层各自有了来源(人:「读谁的桶」裁定;策略:设计 + 引擎的豁免根入参;根:无来源则永久缺席并改写本债)那一版,本 tag 删。
+ */
+export declare function createOperatorValveWriteJudge(facts: Parameters<typeof createOperatorValveJudgeInput>[0]): ConsolidationWriteJudge;
 /** 两个 admin 口消费的窄能力面(`ServiceDeps.memoryConsolidation` 的实参来源)。 */
 export interface MemoryConsolidationFaces {
     /** D3 的座位自证(投影用;boot 期解析一次,restart-to-apply)。 */
@@ -476,7 +506,7 @@ export declare function createMemoryConsolidationFaces(store: {
      *  早问库目录一次、应用时问每个产物文件,答 `no_objection` 以外一律拒写。装配层给哪一只见 {@link createOperatorValveWriteJudge}。 */
     writeJudge: ConsolidationWriteJudge;
     /** 引擎通告的**运维行**座(与 Runner 的 `onNotice` 同一只转发器)。缺席 ⇒ 通告只在回执上。判官拒的两种时机都经它走一次:
-     *  应用时拒 = 引擎在驱动里铸的 `memory.consolidation_incomplete`;早问拒 = 驱动抛出的拒绝经引擎导出的构造器转成的
+     *  应用时拒 = 引擎在驱动里铸的 `memory.consolidation_incomplete`;早问拒 = 驱动抛出的拒绝经引擎导出的投递口(`deliverWriteRefusal`)转成的
      *  `memory.consolidation_refused`(本仓不读通告名、不自铸通告形)。 */
     onNotice?: (notice: EngineNotice) => void;
 }): MemoryConsolidationFaces;

package/dist/boot/memory-consolidation.js

@@ -1,9 +1,10 @@
 import { redactSecrets } from "../trace/redact.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { memoryMountRootOf } from "../memory-scope.js";
+import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { DEFAULT_MODEL_REF, resolveMainModel } from "../model-select.js";
 import { backendOwnsControlPlane } from "../memory-operator-faces.js";
-import { CONSOLIDATION_WRITE_REFUSED_CODE, ConsolidationRefusedError, expandTiers, MemoryEngine, memoryConsolidationRefusedNotice, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
+import { createConsolidationWriteJudge, deliverWriteRefusal, expandTiers, MemoryEngine, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
 export function resolveConsolidationDriverSeat(deps) {
     let options;
     try {
@@ -317,10 +318,18 @@ export function assertAutoConsolidationWirable(input) {
         `unset, or set MEMORY_AUTO_CONSOLIDATION=off (unsetting it is NOT the same: the engine's named default is ON as of ` +
         `core 7.21.1).`);
 }
-export function createOperatorValveWriteJudge() {
-    return () => {
-        recordFailOpen("server.memory-consolidation.operator-valve-unjudged");
-        return { verdict: "no_objection" };
+export function createOperatorValveJudgeInput(facts) {
+    const home = executionLaneHomeDir(facts.config);
+    return {
+        ...(facts.ruleStoreProvider !== undefined ? { ruleStoreProvider: facts.ruleStoreProvider } : {}),
+        anchors: home !== undefined ? { home } : {},
+    };
+}
+export function createOperatorValveWriteJudge(facts) {
+    const judge = createConsolidationWriteJudge(createOperatorValveJudgeInput(facts));
+    return (target) => {
+        recordFailOpen("server.memory-consolidation.operator-valve-layers-unfed");
+        return judge(target);
     };
 }
 export function createMemoryConsolidationFaces(store, input) {
@@ -343,9 +352,7 @@ export function createMemoryConsolidationFaces(store, input) {
                 writeJudge: input.writeJudge,
                 ...(input.onNotice !== undefined ? { onNotice: input.onNotice } : {}),
             }).catch((err) => {
-                if (input.onNotice !== undefined && err instanceof ConsolidationRefusedError && err.code === CONSOLIDATION_WRITE_REFUSED_CODE) {
-                    input.onNotice(memoryConsolidationRefusedNotice({ code: err.code, scope, reason: err.message, ...(err.occurrenceId !== undefined ? { occurrenceId: err.occurrenceId } : {}) }));
-                }
+                deliverWriteRefusal(err, scope, input.onNotice);
                 throw err;
             });
             if (receipt.stopDetail !== undefined) {

package/dist/boot/side-query-lane.d.ts

@@ -26,9 +26,10 @@
  *    降级成**结构性事实**(这条路上根本没有 wrapper);
  *  · `headers` 半边从此有出路(wrapper 形只注得进 `apiKey`,core 的座位 `{apiKey, headers?}` 两半都收);
  *  · 判据(`gatewayBaseUrl`)与 resolver 一样**按调用现取** —— 见下面 `createSideQueryLane` 的注。
- * `createPerModelKeyBrain` **不删**:它仍是 WebFetch 摘要面(`boot/webfetch-summarize-lane.ts`)的
- * key plane —— core 的 `WebFetchSummarizerOptions` 至今只有 `maxContentChars`,那一面没有座位可换
- * (亲验 core 5.46.0 `dist/tools/web.d.ts`)。
+ * `createPerModelKeyBrain` 当时**没删**:它还是 WebFetch 摘要面(`boot/webfetch-summarize-lane.ts`)的 key plane ——
+ * core 的 `WebFetchSummarizerOptions` 那时只有 `maxContentChars`。core 7.51.0 给摘要器补上了同一签名的座
+ * (`WebFetchSummarizerOptions.getApiKeyAndHeaders`)⇒ 包装退役,四面(任务 / side-query / 记忆整理 / WebFetch 摘要)
+ * 都经 core 的座位供给 per-model 凭据,本仓不再在任何一面包 brain。
  *
  * 🔴 **poison(声明的钥匙拿不到)上抛,绝不静默回落网关 key** —— `resolveModelApiKey` 抛
  * `ModelKeyPoisonedError` 是「这个模型配了自己的钥匙(托管密钥解不开 / S-896 起 `apiKeyEnv` 变量缺席)却拿不到」的响亮态;吞成 undefined 等于用共享
@@ -46,8 +47,9 @@
  * 是配对法的单一实现,三只一方 brain(openai / anthropic / open-responses)在 `buildRequest` 里逐次
  * 复判 —— 部署声明了 `config.baseUrl` 而 entry URL 不在那个根上、凭据又只有部署级那一份 ⇒
  * `route.credential_mismatch` 响亮拒;连部署级凭据都没有 ⇒ `route.credential_missing`。**三面同批**
- * (主推理链 / side-query / WebFetch 摘要走的是同一只 brain 栈),旋钮 = 给模型自己的凭据、或不声明
- * `config.baseUrl`(core 的 `"unpinned"` 快速起步姿态)。⇒ [ref] 要的「三面同批 + 旋钮」由上游一次交齐。
+ * (主推理链 / side-query / WebFetch 摘要走的是同一只 brain 栈),旋钮 = 给模型自己的凭据(当年还有第二条:不声明
+ * `config.baseUrl`,走 core 的 `"unpinned"` 快速起步姿态 —— core 7.51.0 #1531 起该姿态退役,一份部署凭据只配一个根)。
+ * ⇒ [ref] 要的「三面同批 + 旋钮」由上游一次交齐。
  *
  * 于是本席的 `isOffRouteBaseUrl` + `recordFailOpen("server.model-key.off-route-model-uses-gateway-key")`
  * 两件**一并撤线**:那条计数的语义是「这一次调用真把网关凭据发给了别家」,而在 5.57 上那次调用根本
@@ -97,21 +99,6 @@ export interface SideQueryLaneCtx {
 export declare function createPerModelAuthSeat(getKeyResolver: () => KeyResolver, opts?: {
     readonly upstream?: SideQuerySpec["getApiKeyAndHeaders"];
 }): PerModelAuthSeat;
-/**
- * per-model key 注入 brain wrapper —— **[ref] 后只服务 WebFetch 摘要面**
- * (`boot/webfetch-summarize-lane.ts`)。side-query 面已换到 core 的 spec 座位(见顶注「[ref] 换装」);
- * core 的 `WebFetchSummarizerOptions` 至今只有 `maxContentChars`(亲验 5.46.0 `dist/tools/web.d.ts`),
- * 那一面**没有座位可换**,只能继续在 brain 层补凭据。
- *
- * 语义(与 `createPerModelAuthSeat` 同一张表,只是注入位在 `options.apiKey`):
- *  · `options.apiKey` **已在场** ⇒ 原样透传(上游/装饰器已经定了凭据,本层不抢);
- *  · resolver 缺席 / 返回 undefined ⇒ 不注入 ⇒ 网关 key(additive 契约);
- *  · resolver 抛(sealed key 中毒)⇒ **上抛**,本次调用整体失败,一个字节都不发。
- *
- * `complete` 在场时同样包一层:core 的 `Brain.complete` 是 compaction/摘要腿的直调口(WebFetch 摘要器
- * 正是**优先**走它),漏包等于给同一个病留第二条路。
- */
-export declare function createPerModelKeyBrain(brain: Brain, getKeyResolver: () => KeyResolver): Brain;
 /**
  * 装配 side-query 执行席 = 真 `runSideQuery` + core 的 per-model auth 座,models/roles 与 Runner 同源。
  *

package/dist/boot/side-query-lane.js

@@ -8,30 +8,6 @@ export function createPerModelAuthSeat(getKeyResolver, opts = {}) {
         return resolve ? await resolve({ name: model.name }) : undefined;
     };
 }
-export function createPerModelKeyBrain(brain, getKeyResolver) {
-    const seat = createPerModelAuthSeat(getKeyResolver);
-    const keyFor = async (model, given) => {
-        if (given !== undefined)
-            return given;
-        return (await seat(model))?.apiKey;
-    };
-    const stream = async (model, context, options) => {
-        const apiKey = await keyFor(model, options?.apiKey);
-        return brain.stream(model, context, apiKey === undefined ? options : { ...options, apiKey });
-    };
-    const complete = brain.complete?.bind(brain);
-    return {
-        stream,
-        ...(complete
-            ? {
-                complete: async (model, context, options) => {
-                    const apiKey = await keyFor(model, options?.apiKey);
-                    return complete(model, context, apiKey === undefined ? options : { ...options, apiKey });
-                },
-            }
-            : {}),
-    };
-}
 export function createSideQueryLane(ctx) {
     return (spec) => runSideQuery({
         ...spec,

package/dist/boot/stage-01-config.js

@@ -14,8 +14,11 @@ import { setRunTerminalLogObserver } from "../observability/run-terminal.js";
 import { setRedactionObserver } from "../trace/redact.js";
 import { installOutboundDispatcher } from "../outbound-dispatcher.js";
 import { provisionSemaConfigDir } from "../sema-config-dir.js";
+import { bindOwnCredentialsConfig, declareServerWithheldEnv } from "../server-secret-env.js";
 export function runStage01() {
+    declareServerWithheldEnv();
     const config = loadConfig();
+    bindOwnCredentialsConfig(config);
     const runStaleFailure = crossInvariant("run-stale-heartbeat").check({ live: config, next: config });
     if (runStaleFailure !== undefined) {
         throw new Error(runStaleFailure);

package/dist/boot/stage-06-runners.js

@@ -76,7 +76,7 @@ export function runStage06(ctx) {
             onIncident: (err) => logger.warn("memory_consolidation_incident", { code: err.code ?? null, detail: err.message }),
             onStopDetail: (audit) => logger.warn("memory_consolidation_stop_detail", audit),
             ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}),
-            writeJudge: createOperatorValveWriteJudge(),
+            writeJudge: createOperatorValveWriteJudge({ ruleStoreProvider: permissionRuleProvider, config }),
             onNotice: createEngineNoticeForwarder(logger, defaultEngineNoticeRouter, metrics),
         })
         : undefined;

package/dist/boot/stores.js

@@ -18,7 +18,7 @@ import { PgRosterStore, TiDBRosterStore, ensurePgRosterSchema, ensureTiDBRosterS
 import { LocalTaskAttachmentStore } from "../plugins/local-task-attachment-store.js";
 import { PgTaskAttachmentStore, TiDBTaskAttachmentStore, ensurePgTaskAttachmentSchema, ensureTiDBTaskAttachmentSchema } from "../plugins/task-attachment-store.js";
 import { createSessionStore } from "../plugins/session-store.js";
-import { logOneTimeMigrations } from "../plugins/one-time-migrations.js";
+import { runAndLogOneTimeMigrations } from "../plugins/one-time-migrations.js";
 import { createTaskListLane } from "./task-list-lane.js";
 import { ensurePgTaskListSchema, ensureTiDBTaskListSchema } from "../plugins/task-list-store-sql.js";
 import { assertDeviceAuditRebindEventSchema, ensurePgDeviceSchema, ensureTiDBDeviceSchema } from "../plugins/device-store-sql.js";
@@ -100,7 +100,7 @@ export async function openStores(ctx) {
             await assertFileHistorySchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
     }
     if (backend)
-        logOneTimeMigrations(logger, backend.kind, await backend.runOneTimeMigrations());
+        await runAndLogOneTimeMigrations(logger, backend);
     if ((process.env.REWIND_SNAPSHOT_MAX_MB ?? "") !== "") {
         logger.warn("rewind_snapshot_max_mb_retired", {
             note: "REWIND_SNAPSHOT_MAX_MB no longer has an effect: the whole-tree snapshot epoch is retired (S-15); per-edited-file history captures only files the agent touches, with no tree walk and no size gate. Remove the env var. Per-blob SQL sizing is governed by SNAPSHOT_BLOB_SQL_MAX_BYTES / object storage as before.",

package/dist/boot/web-admin.js

@@ -19,13 +19,14 @@ import { centerManagedConfigKeys } from "../web-admin-client/apply-effective.js"
 import { createConfigProvider, raceBootFetch, serviceConfigSourceKind, BOOT_FETCH_DEFERRED } from "../config-provider.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { buildSealedKeyPublicFace, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
-import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applySkillsManifest, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, fetchPromptArtifact } from "../web-admin-client/facade.js";
+import { applyEffective, applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, mutateInPlace, logEffectiveDiff, applySkillsManifest, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, fetchPromptArtifact } from "../web-admin-client/facade.js";
 import { buildConfigHandoff, buildRestartSignal, configHandoffMissing } from "../fleet/engine-signal.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../web-admin-client/mcp-revocation.js";
 import { buildUnreadConfigFileFields } from "../web-admin-client/read-warnings.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, candidateRejectionOf, judgeConfigCandidate } from "../web-admin-client/candidate-gate.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../web-admin-client/apply-ledger.js";
+import { buildDeploymentPostureSeats } from "./runner-deps.js";
 function lkgReadNote(scope) {
     switch (scope) {
         case "whole":
@@ -631,7 +632,7 @@ export async function createWebAdminRuntime(ctx) {
         if (!dryRun && cc !== undefined && currentIdentity() !== promptStateIdentity)
             await rebasePromptState(currentIdentity(), "boot-end");
     }
-    const readFaceBaseline = { ...(config.readFace !== undefined ? { readFace: config.readFace } : {}), readFaceSource: config.readFaceSource };
+    const readFaceBaseline = buildReadFaceBaseline(config);
     const readFaceEnvHeld = applyCenterReadFace(config, effective ?? { version: 0, updatedAt: "", models: { models: [], roles: {} } }, effective ? logger : undefined).envHeld;
     if (!modelReadyState.ready)
         logger.warn("model_roster_pending", {
@@ -648,18 +649,21 @@ export async function createWebAdminRuntime(ctx) {
         ...(mcpRevocationWired && mcpRevocations.hasBaseline() ? { mcpRevocationLive: true } : {}),
     });
     const applyLiveReadFace = (eff, swap, phase) => {
-        const before = config.readFace;
-        const beforeSource = config.readFaceSource;
-        const { faceChanged } = applyCenterReadFace(config, eff, logger, { phase: "live", baseline: readFaceBaseline });
-        if (!faceChanged)
+        const before = buildReadFaceBaseline(config);
+        const { changedSeats } = applyCenterReadFace(config, eff, logger, { phase: "live", baseline: readFaceBaseline });
+        if (changedSeats.length === 0)
             return;
         try {
-            swap({ readFace: config.readFace });
-            logger.info("read_face_swapped", { from: before ?? null, to: config.readFace ?? null, phase, note: "hot seat (core swapDeps) — legs that already prepared keep the face they prepared under" });
+            swap(buildReadFaceSwapCandidate(buildDeploymentPostureSeats(config), changedSeats));
+            logger.info("read_face_swapped", {
+                seats: changedSeats,
+                ...(changedSeats.includes("readFace") ? { from: before.readFace ?? null, to: config.readFace ?? null } : {}),
+                phase,
+                note: "hot seats (core swapDeps) — legs that already prepared keep the read posture they prepared under",
+            });
         }
         catch (err) {
-            config.readFace = before;
-            config.readFaceSource = beforeSource;
+            restoreReadFaceBaseline(config, before);
             throw err;
         }
     };
@@ -976,6 +980,9 @@ export async function createWebAdminRuntime(ctx) {
                         if (configProvider.kind === "remote")
                             lastPull = "ok";
                     }
+                    catch (err) {
+                        logger.warn("web_admin_refresh_failed", { err: String(err), leg: "boot-deferred", note: "etag NOT advanced — the refresh cadence re-fetches and re-applies the same candidate" });
+                    }
                     finally {
                         refreshInFlight = false;
                     }

package/dist/boot/webfetch-summarize-lane.d.ts

@@ -21,13 +21,16 @@
  *
  * ## 修形 = 照 [ref] 的配方接第四面(不是新造语义)
  *
- * brain 换成 `createPerModelKeyBrain(brain, getKeyResolver)`:
- *  · 有 per-model key ⇒ 注入 `options.apiKey`,请求带模型自己的凭据;
- *  · 无 ⇒ 不注入 ⇒ 交回 core 按它自己的 key↔URL 配对法判(core 5.57.0 起:部署根声明了而 entry URL
- *    不在那个根上 ⇒ `route.credential_mismatch` 响亮拒;未声明部署根 = `"unpinned"` 快速起步姿态 ⇒
- *    照旧回落网关 key。[ref] 的具名残余与其 P-DEBT 腿已在源头清偿,见 side-query-lane.ts 顶注);
+ * 当年 core 的摘要器没有凭据座,只能在 brain 外面包一层注入 `options.apiKey`(`createPerModelKeyBrain`)。
+ * core 7.51.0 起 `WebFetchSummarizerOptions.getApiKeyAndHeaders` 是与 `TaskSpec` / `SideQuerySpec` 同一签名的座
+ * (每次摘要按摘要器的模型解一次,`{ apiKey, headers }` 两半都收)⇒ 那层包装退役:`RunnerDeps.brain` 原样交给
+ * 摘要器,座位由与 side-query / 记忆整理**同一只**座位工厂(`createPerModelAuthSeat`)填充:
+ *  · 有 per-model key ⇒ 请求带模型自己的凭据;
+ *  · 无 ⇒ 座位回 `undefined` ⇒ 交回 core 按它自己的 key↔URL 配对法判(部署根上的模型带网关 key;
+ *    entry URL 不在部署根上 ⇒ `route.credential_mismatch` 响亮拒 —— core 7.51.0 起没有「未声明部署根」的
+ *    `unpinned` 快速起步姿态了,一份部署凭据只配一个根。[ref] 的具名残余与其 P-DEBT 腿已在源头清偿,
+ *    见 side-query-lane.ts 顶注);
  *  · 毒丸 ⇒ **上抛**,一个字节都不发(CLAUDE.md [ref] 安全轴 fail-closed)。
- * wrapper 只包本席这一只引用,`RunnerDeps.brain` 零扰动(与 side-query 席同形)。
  *
  * ## 为什么住在 `boot/` 而不是继续躺在 `main()` 的闭包里
  *
@@ -49,7 +52,7 @@ import { type KeyResolver } from "./side-query-lane.js";
 /** WebFetch 摘要执行席(= `ScenarioDeps.webFetchSummarize`,core 的 `WebFetchConfig.summarize` 逐字同形)。 */
 export type WebFetchSummarizeLane = NonNullable<NonNullable<WebFetchConfig["summarize"]>>;
 export interface WebFetchSummarizeLaneCtx {
-    /** 与 `RunnerDeps.brain` **同一只**实例(wrapper 在外面包,不改这只)。 */
+    /** 与 `RunnerDeps.brain` **同一只**实例,原样交给摘要器(凭据走摘要器的座位,不包 brain)。 */
     brain: Brain;
     /** 活配置引用:目录/角色表被 web-admin 就地热应用(`mutateInPlace`),按调用取值才跟得上。 */
     config: ServiceConfig;

package/dist/boot/webfetch-summarize-lane.js

@@ -1,7 +1,6 @@
 import { createWebFetchSummarizer, resolveTaskModel as coreResolveTaskModel } from "@sema-agent/core";
-import { createPerModelKeyBrain } from "./side-query-lane.js";
+import { createPerModelAuthSeat } from "./side-query-lane.js";
 export function createWebFetchSummarizeLane(ctx) {
-    const brain = createPerModelKeyBrain(ctx.brain, ctx.getKeyResolver);
     return async (content, prompt, signal) => {
         const model = (() => {
             try {
@@ -14,7 +13,7 @@ export function createWebFetchSummarizeLane(ctx) {
         })();
         if (!model)
             throw new Error("summarize model unresolved for this deployment");
-        return createWebFetchSummarizer(brain, model)(content, prompt, signal);
+        return createWebFetchSummarizer(ctx.brain, model, { getApiKeyAndHeaders: createPerModelAuthSeat(ctx.getKeyResolver) })(content, prompt, signal);
     };
 }
 //# sourceMappingURL=webfetch-summarize-lane.js.map

package/dist/brain.js

@@ -54,11 +54,10 @@ export function createBrainAssembly(config, deps = {}) {
             : {};
     const routes = deploymentGatewayRoots(config);
     const openaiBrains = routes.map((baseUrl, i) => {
+        const gatewayKey = deploymentGatewayKey(config);
         const brain = constructRouteBrain(i === 0 ? "gateway route" : `gateway fallback route[${i - 1}]`, [baseUrl], () => createOpenAIBrain({
             baseUrl,
-            get apiKey() {
-                return deploymentGatewayKey(config);
-            },
+            ...(gatewayKey !== undefined ? { apiKey: gatewayKey } : {}),
             ...retryCap,
             fetchImpl,
             ...timeouts,
@@ -106,16 +105,14 @@ export function createBrainAssembly(config, deps = {}) {
             const ownSealed = credential.sealed !== undefined ? { [fallbackModel.name]: credential.sealed } : {};
             const fbOwnApiKey = () => resolveModelApiKey(fallbackModel.name, ownEnvRef, process.env, ownSealed);
             const anthropicLaneHop = dispatchBrainLane(fallbackModel.provider, anthropicBrain !== undefined) === "anthropic";
+            const fbDeclaredRoot = degradeDeclaredRoot(fallbackModel.baseUrl, config);
+            const fbDeploymentKey = deploymentGatewayKey(config);
             const fallback = anthropicLaneHop && anthropicBrain
                 ?
                     anthropicBrain
                 : constructRouteBrain(`degrade target "${degradeTo}"`, [fallbackModel.baseUrl, config.gatewayBaseUrl], () => createOpenAIBrain({
-                    get baseUrl() {
-                        return degradeDeclaredRoot(fallbackModel.baseUrl, config);
-                    },
-                    get apiKey() {
-                        return deploymentGatewayKey(config) || undefined;
-                    },
+                    ...(fbDeclaredRoot !== undefined ? { baseUrl: fbDeclaredRoot } : {}),
+                    ...(fbDeploymentKey ? { apiKey: fbDeploymentKey } : {}),
                     ...(config.gatewayMaxRetries !== undefined ? { maxRetries: config.gatewayMaxRetries } : {}),
                     fetchImpl,
                     ...timeouts,

package/dist/capabilities/builtin-tools.d.ts

@@ -27,8 +27,8 @@ export interface SubagentExtraToolOptions {
  *
  * core 7.46.0 #1432 —— **工厂与名册一个来源**:返回委派工具的两键,`extraTools`(每次 spawn 交出 `forSpawn` 选中的那几只)与
  * `extraToolNames`(全部可能交出的那几只的名字 / 别名 / 内容来源,从同一批 `ToolSpec` 读出)。名册在场 ⇒ 引擎重新能列出子代的工具池:
- * 定义级 / 工具级 / `TaskSpec.agents` 清单里没有任何工具答应的名字(core 7.49.0 #1623 起含无人挂的名;退役拼法与大小写孪生 7.46.0 起)开跑前拒
- * (`config.agent.unknown_tool`),记忆内容来源读者按声明读这几只。
+ * 定义级 / 工具级 / `TaskSpec.agents` 清单里没有任何工具答应的名字由引擎按名册判(core 7.51.0 #1736 起不拒 run:条目原样保留、告知一次并带该写的拼法;
+ * 7.46.0–7.50.x 曾开跑前拒 `config.agent.unknown_tool`),记忆内容来源读者按声明读这几只。
  * 修前(core 7.32.0–7.45.x)工厂恒在场 ⇒ 池不可静态知 ⇒ 那一族拼法只告不拒、委派结果一律按「外部」读。
  * 工厂**不抛**:各组的 `tools` 是装配期就建好的对象;部署 `forSpawn` 的抛由 core 收成「这一 spawn 什么都不继承 + 模型面披露句」(onExtraToolsError 记 warn)。
  * 一种拼法出现在两只工具上(部署工具与 `Now` 撞名 / 别名撞)⇒ core 在建委派工具处抛 `config.extra_tool_names`(`shape`),不静默取其一。

package/dist/capabilities/engine-capabilities.d.ts

@@ -0,0 +1,14 @@
+/**
+ * 引擎能力词 → `GET /v1/capabilities` 顶层布尔键(core 7.51.1 `ENGINE_CAPABILITIES`;[ref]:词由引擎定,投影形由本仓定)。
+ *
+ * 形:引擎的能力词**原样**作顶层键(`"inherit_env.own_credentials_withheld": true`),值 = 该词在**本进程**为真的事实。键集由 `ENGINE_CAPABILITIES`
+ * 机器派生(一只投影循环,不逐词写键);事实表 {@link ENGINE_CAPABILITY_FACTS} 是 `Record<EngineCapability, …>` 型 —— 引擎加词而本表没跟 = tsc 红,
+ * 本表多一个引擎没有的词 = tsc 红(闭集的双向门),所以「这台引擎说它能,本服务也真接上了」不靠人记得登记。
+ * 壳按词闸(cli 读顶层布尔 `true`),不按版本号猜;契约附录 B.1 与 `test/capabilities-doc-appendix.test.ts` 把这些键与引擎词集对拍。
+ */
+import { type EngineCapability } from "@sema-agent/core";
+/** 投影:引擎词集的每一词 → 本进程的事实(键集恒 = `ENGINE_CAPABILITIES`)。 */
+export declare function engineCapabilityBits(): {
+    readonly [W in EngineCapability]: boolean;
+};
+//# sourceMappingURL=engine-capabilities.d.ts.map

package/dist/capabilities/engine-capabilities.js

@@ -0,0 +1,12 @@
+import { ENGINE_CAPABILITIES } from "@sema-agent/core";
+import { ownCredentialsWithheld } from "../server-secret-env.js";
+const ENGINE_CAPABILITY_FACTS = {
+    "inherit_env.own_credentials_withheld": ownCredentialsWithheld,
+};
+export function engineCapabilityBits() {
+    const out = {};
+    for (const word of ENGINE_CAPABILITIES)
+        out[word] = ENGINE_CAPABILITY_FACTS[word]();
+    return out;
+}
+//# sourceMappingURL=engine-capabilities.js.map