@sema-agent/server 7.131.0 → 7.133.0

package/dist/boot/stores.d.ts

@@ -34,6 +34,6 @@ export declare function openStores(ctx: OpenStoresCtx): Promise<{
     usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
     memoryPosture: import("../memory-posture.js").MemoryPosture;
     taskListLane: import("./task-list-lane.js").TaskListLane;
-    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
 }>;
 //# sourceMappingURL=stores.d.ts.map

package/dist/boot/stores.js

@@ -37,7 +37,7 @@ import { assertFileHistorySchema } from "../plugins/file-history-store-sql.js";
 import { resolveStreamApprovalGate } from "../tool-approval.js";
 import { buildMemoryBoundaryLaneFacts, buildMemoryWriteBoundaryAudit, effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 import { buildMemoryPosture } from "../memory-posture.js";
-import { establishSqlEnginePosture } from "../sql-engine-posture.js";
+import { establishSqlEnginePosture, sqlPoolsOf } from "../sql-engine-posture.js";
 import { buildStorePosture } from "../store-posture.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 const DARK_REASON_PROSE = {
@@ -377,7 +377,7 @@ export async function openStores(ctx) {
                 ...(config.memorySync.maxPushEntries !== undefined ? { maxPushEntries: config.memorySync.maxPushEntries } : {}),
                 ...(config.memorySync.maxPullEntries !== undefined ? { maxPullEntries: config.memorySync.maxPullEntries } : {}),
             });
-            logger.info("memory_sync_enabled", { url: buildDisplaySafeUrl(config.memorySync.url), scope: config.memorySync.scope, cursorPath: memorySyncRunner.cursorPath });
+            logger.info("memory_sync_enabled", { url: buildDisplaySafeUrl(config.memorySync.url), scope: config.memorySync.scope, cursorPath: memorySyncRunner.cursorPathFor(config.memorySync.scope) });
             memorySyncRunner.trigger("boot");
         }
         else {
@@ -393,11 +393,10 @@ export async function openStores(ctx) {
             await ensureTiDBTaskListSchema(mysqlPool);
         return createTaskListLane({ mysqlPool, pgPool, logger });
     })();
-    let sqlEngineFacts;
+    let sqlEngine;
     {
-        const mysqlPool = backend?.mysqlPool?.();
-        const pgPool = backend?.pgPool?.();
-        sqlEngineFacts = await establishSqlEnginePosture({ mysqlPool, pgPool });
+        const { mysqlPool, pgPool } = sqlPoolsOf(backend);
+        sqlEngine = await establishSqlEnginePosture({ mysqlPool, pgPool });
         if (pgPool)
             await ensurePgDeviceSchema(async (text, params) => pgPool.query(text, params));
         if (mysqlPool)
@@ -437,7 +436,7 @@ export async function openStores(ctx) {
     const breakerState = backend?.breaker && config.resilience.circuitBreaker
         ? backend
             .breaker((streak) => {
-            metrics.setGauge("counter_flush_fail_streak", streak, { table: "circuit_breaker", kind: "write_through" });
+            metrics.setGauge("counter_flush_fail_streak", streak, { table: "breaker_state", kind: "write_through" });
             if (streak > 0)
                 metrics.inc("breaker_writethrough_failed_total", { backend: backend.kind });
             if (streak === 3)
@@ -450,7 +449,7 @@ export async function openStores(ctx) {
     return {
         backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, mailboxRecipientLifecycle,
         taskAttachmentStore, mailboxStore, memoryExportBackend, memorySyncRunner, sessionStore, breakerState,
-        usageWindowStore, memoryPosture, taskListLane, sqlEngineFacts,
+        usageWindowStore, memoryPosture, taskListLane, sqlEngine,
     };
 }
 //# sourceMappingURL=stores.js.map

package/dist/boot/web-admin.d.ts

@@ -1,10 +1,10 @@
 import { type ModelRefusalsSignal } from "@sema-agent/settings-schema";
 import { CenterPromptSource, type SwappableDeps } from "@sema-agent/core";
 import { buildPricing } from "../budget.js";
-import { type PromptsDomainFaces } from "../prompts-domain-validate.js";
 import { type Scenario, type ScenarioDeps, type ScenarioDetail } from "../capabilities/scenarios.js";
 import type { LoadedSkill } from "../capabilities/skills.js";
 import { type ServiceConfig } from "../config.js";
+import { type CenterIdentityNotice } from "../center-config-tier.js";
 import { type CenterCredentialHealthView } from "../center-credential-renewer.js";
 import { type ModelKeyRef } from "../key-resolver.js";
 import type { Logger } from "../observability/logger.js";
@@ -84,6 +84,9 @@ export interface WebAdminRuntime {
     stopRefreshLoop(): void;
     /** S-698:`/health.centerCredential` 的取值口 —— 凭证来源的健康态 + 续签器状态;都健康 / 没有中心 ⇒ `undefined`(键缺席)。 */
     centerCredentialState(): CenterCredentialHealthView | undefined;
+    /** S-667:`/health.centerIdentityNotice` 的取值口 —— 中心凭证换人后的**最近一条**通告(`center_identity_demoted` 已降到无中心配置档 / `center_identity_landed`
+     *  新身份的配置已换上;码、冻结句与状态机见 `center-config-tier.ts`)。从未换过人 / 没有中心 ⇒ `undefined`(键缺席)。值形就是 wire 形 `{ code, message, at }`。 */
+    centerIdentityNoticeState(): CenterIdentityNotice | undefined;
     /** [ref](core 5.50 [ref]):mid-turn MCP 撤销台账读口,喂 `RunnerDeps.mcpRevocations` 席。
      *  **取走即声明接线**——调用本方法后,restart 信号的 mcp 片对纯删除向豁免(台账即时承接);
      *  不取 ⇒ 旧 restart 语义逐字保留(fail-closed)。 */
@@ -96,8 +99,6 @@ export interface WebAdminRuntime {
     getKeyResolver(): ((model: ModelKeyRef) => Promise<{
         apiKey: string;
     } | undefined>) | undefined;
-    /** 晚绑取值:center 提示词面(热采用,新任务边界生效)。 */
-    getCenterPrompts(): PromptsDomainFaces | undefined;
     /** boot ready 门:布防(`CONFIG_REQUIRE_ROSTER=true`,远程 registry 非 dryRun)且 roster 未落地 =
      *  计费提交 503 + /health ready:false。缺省未布防 ⇒ 恒 true。 */
     modelReady(): boolean;

package/dist/boot/web-admin.js

@@ -8,25 +8,28 @@ import { buildModelRefusalsSignal } from "../model-entry-refusal.js";
 import { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "@sema-agent/core";
 import { buildPricing } from "../budget.js";
 import { applyCenterPlugins } from "../capabilities/center-plugins.js";
-import { applyCatalogToSource, withPromptArtifactBackfill } from "../capabilities/center-prompts.js";
-import { CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
+import { applyCenterArtifact, centerSourceOnError, withPromptArtifactBackfill } from "../capabilities/center-prompts.js";
 import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
 import { isRosterGateArmed } from "../config.js";
+import { toolsRunOnThisHost } from "../task-cwd.js";
 import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg, legacyV1LkgPath, migrateV1Lkg } from "../config-lkg.js";
 import { answerStillCurrent, centerStateBin, credentialIdentityNow, judgeCenterCredentialAtBoot } from "../center-credential.js";
+import { createCenterConfigTier } from "../center-config-tier.js";
 import { buildCenterCredentialHealthView, createCenterCredentialRenewer } from "../center-credential-renewer.js";
 import { centerManagedConfigKeys } from "../web-admin-client/apply-effective.js";
 import { createConfigProvider, raceBootFetch, serviceConfigSourceKind, BOOT_FETCH_DEFERRED } from "../config-provider.js";
+import { ConfigDirUntrustedError } from "../config-dir-trust.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { buildSealedKeyPublicFace, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
-import { applyEffective, applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, mutateInPlace, logEffectiveDiff, applySkillsManifest, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, fetchPromptArtifact } from "../web-admin-client/facade.js";
+import { applyEffective, applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, mutateInPlace, logEffectiveDiff, applySkillsManifest, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, NO_CENTER_EFFECTIVE, isNoCenterEffective, fetchPromptArtifact } from "../web-admin-client/facade.js";
 import { buildConfigHandoff, buildRestartSignal, configHandoffMissing } from "../fleet/engine-signal.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../web-admin-client/mcp-revocation.js";
-import { buildUnreadConfigFileFields } from "../web-admin-client/read-warnings.js";
+import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "../web-admin-client/read-warnings.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, candidateRejectionOf, judgeConfigCandidate } from "../web-admin-client/candidate-gate.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../web-admin-client/apply-ledger.js";
-import { buildDeploymentPostureSeats } from "./runner-deps.js";
+import { announceReadDenyRows, buildDeploymentPostureSeats } from "./runner-deps.js";
+import { echoCallerText } from "../caller-text-echo.js";
 function lkgReadNote(scope) {
     switch (scope) {
         case "whole":
@@ -87,6 +90,21 @@ export async function createWebAdminRuntime(ctx) {
         ? createCenterCredentialRenewer({ source: cc.credential, centerUrl: cc.baseUrl, leadMs: config.centerCredentialRenewLeadMs, logger })
         : undefined;
     const currentIdentity = () => (cc === undefined ? undefined : credentialIdentityNow(cc.credential));
+    const tier = createCenterConfigTier();
+    const announceTier = (n) => {
+        switch (n.code) {
+            case "center_identity_demoted":
+                logger.warn(n.code, { at: n.at, message: n.message, ...(n.retained !== undefined ? { retained: n.retained } : {}), note: "the credential identity changed: the previous account's center configuration is dropped (every center-supplied hot face is back on its env base, the center prompt layer is withdrawn, the Runners run the env model table) and a pull for the new identity is under way; skills / MCP / A2A / scenarios are baked at boot and stay the previous account's until a restart (see /health.restart)" });
+                return;
+            case "center_identity_landed":
+                logger.info(n.code, { at: n.at, message: n.message });
+                return;
+            default: {
+                const unknownCode = n.code;
+                throw new Error(`announceTier: unknown notice code ${JSON.stringify(unknownCode)}`);
+            }
+        }
+    };
     const candidateIdentity = new WeakMap();
     const candidateIdentityOf = (eff) => candidateIdentity.get(eff);
     const validatorIdentity = new Map();
@@ -134,6 +152,7 @@ export async function createWebAdminRuntime(ctx) {
             ...(config.configProvider ? { provider: config.configProvider } : {}),
             ...(cc ? { webAdmin: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker, dryRun: cc.dryRun } } : {}),
             localDir: localRoot,
+            localOwnerUid: config.configLocalOwnerUid,
             ...(config.configLkgEnabled ? { skillBodyCacheDir: defaultSkillCacheDir(config) } : {}),
         })
         : undefined;
@@ -143,6 +162,8 @@ export async function createWebAdminRuntime(ctx) {
     const warnReadNotices = (r, phase) => {
         for (const f of r.unreadFiles ?? [])
             logger.warn("config_unread_file", buildUnreadConfigFileFields(f, localDirField.dir));
+        for (const k of r.unreadKeys ?? [])
+            logger.warn("config_unread_key", buildUnreadConfigKeyFields(k, localDirField.dir));
         for (const d of r.droppedEntries ?? []) {
             logger.warn("config_entry_dropped", {
                 domain: d.domain,
@@ -202,15 +223,15 @@ export async function createWebAdminRuntime(ctx) {
         applyLedger.recordApply(rep);
         publishModelRefusals(buildModelRefusalsSignal(rep.modelRefusals));
     };
-    let centerPrompts;
-    let pendingCatalogFaces;
+    let adoptedArtifact;
+    let pendingCenterTarget;
     const retryPendingCatalog = async (phase) => {
-        if (!pendingCatalogFaces)
+        if (!pendingCenterTarget)
             return;
-        const { target } = pendingCatalogFaces;
-        if (await applyCatalogToSource(catalogSource, target, centerPrompts, logger, phase)) {
-            centerPrompts = target;
-            pendingCatalogFaces = undefined;
+        const { target } = pendingCenterTarget;
+        if (await applyCenterArtifact(catalogSource, target, adoptedArtifact, logger, phase)) {
+            adoptedArtifact = target;
+            pendingCenterTarget = undefined;
         }
     };
     const promptEpochDir = join(config.localDataRoot ?? localRoot, "prompt-epoch");
@@ -253,6 +274,7 @@ export async function createWebAdminRuntime(ctx) {
         },
     });
     const withByDigestBackfill = (inner) => cc?.baseUrl ? withPromptArtifactBackfill(inner, (d) => fetchPromptArtifact(cc, d), logger) : inner;
+    const sourceOnError = centerSourceOnError(logger);
     const promptSource = (() => {
         try {
             const bootBin = promptStateBin();
@@ -261,15 +283,15 @@ export async function createWebAdminRuntime(ctx) {
             return new CenterPromptSource({
                 store: withByDigestBackfill(new FilePromptArtifactStore(promptEpochDir)),
                 stateStore: recordingStateStore(binnedPromptStateStore(fileStateStoreFor)),
-                engineVersion: CORE_ENGINE_VERSION,
+                onError: sourceOnError,
             });
         }
         catch (e) {
-            logger.warn("center_prompts_store_unwritable", { dir: promptEpochDir, err: String(e), note: "file-backed prompt-epoch store unavailable — memory fallback (catalog candidate not restart-durable); built-ins/declaration axis unaffected" });
+            logger.warn("center_prompts_store_unwritable", { dir: promptEpochDir, err: String(e), note: "file-backed prompt-epoch store unavailable — memory fallback (the center candidate is not restart-durable); built-ins unaffected" });
             return new CenterPromptSource({
                 store: withByDigestBackfill(new MemoryPromptArtifactStore()),
                 stateStore: recordingStateStore(binnedPromptStateStore(storePerBin(() => new MemoryPromptSourceStateStore()))),
-                engineVersion: CORE_ENGINE_VERSION,
+                onError: sourceOnError,
             });
         }
     })();
@@ -281,14 +303,14 @@ export async function createWebAdminRuntime(ctx) {
     };
     const rebasePromptState = async (identity, phase) => {
         promptStateIdentity = identity;
-        centerPrompts = undefined;
-        pendingCatalogFaces = undefined;
+        adoptedArtifact = undefined;
+        pendingCenterTarget = undefined;
         promptPersisted = undefined;
         try {
             await promptSource.restore();
         }
         catch (e) {
-            logger.warn("center_prompts_catalog_restore_failed", { phase, err: String(e), note: "the persisted catalog state for this credential identity could not be loaded — catalog candidate absent until the next adopt; declaration axis and built-ins unaffected" });
+            logger.warn("center_prompts_catalog_restore_failed", { phase, err: String(e), note: "the persisted center-layer state for this credential identity could not be loaded — the center candidate is absent until the next adopt; built-ins unaffected" });
         }
         if (cc !== undefined && identity !== undefined && currentIdentity() !== identity) {
             promptStateIdentity = undefined;
@@ -299,41 +321,42 @@ export async function createWebAdminRuntime(ctx) {
     if (configProvider && !cc?.dryRun)
         await rebasePromptState(promptStateIdentity, "boot");
     const adoptCenterPrompts = async (eff, prompts, phase) => {
+        if (isNoCenterEffective(eff)) {
+            await rebasePromptState(undefined, phase);
+            return;
+        }
         const adoptedIdentity = candidateIdentityOf(eff);
         if (adoptedIdentity !== undefined && adoptedIdentity !== promptStateIdentity) {
             await rebasePromptState(adoptedIdentity, phase);
         }
         if (prompts === undefined) {
-            if (centerPrompts)
-                logger.info("center_prompts_cleared", { phase, note: "effective carries no prompts key (publish gate off) — built-in providers resume" });
-            const cleared = await applyCatalogToSource(catalogSource, undefined, centerPrompts, logger, phase);
+            if (adoptedArtifact)
+                logger.info("center_prompts_cleared", { phase, note: "effective carries no prompts key (publish gate off / nothing published) — the built-in prompt serves new tasks" });
+            const cleared = await applyCenterArtifact(catalogSource, undefined, adoptedArtifact, logger, phase);
             if (cleared) {
-                centerPrompts = undefined;
-                pendingCatalogFaces = undefined;
+                adoptedArtifact = undefined;
+                pendingCenterTarget = undefined;
             }
             else {
-                pendingCatalogFaces = { target: undefined };
+                pendingCenterTarget = { target: undefined };
             }
             return;
         }
-        if (centerPrompts?.identity !== prompts.identity) {
+        if (adoptedArtifact?.artifactDigest !== prompts.artifactDigest) {
             logger.info("center_prompts_adopted", {
                 phase,
-                axes: prompts.axes,
-                ...(prompts.declarations
-                    ? { packId: prompts.declarations.packId, contentDigest: prompts.declarations.contentDigest, sections: prompts.declarations.sections.length, scenarioOverrides: Object.keys(prompts.declarations.scenarioOverrides ?? {}).length }
-                    : {}),
-                ...(prompts.catalog ? { artifactDigest: prompts.catalog.artifact.artifactDigest, catalogDigest: prompts.catalog.artifact.payload.catalogDigest, sourceRevision: prompts.catalog.sourceRevision } : {}),
-                note: "new tasks assemble the new pack (epoch re-pins at the next task boundary); in-flight sessions stay pinned",
+                artifactDigest: prompts.artifactDigest,
+                sourceRevision: prompts.sourceRevision,
+                note: "new sessions adopt this center layer (a session pins it at its first run); in-flight sessions stay pinned",
             });
         }
-        const transitioned = await applyCatalogToSource(catalogSource, prompts, centerPrompts, logger, phase);
+        const transitioned = await applyCenterArtifact(catalogSource, prompts, adoptedArtifact, logger, phase);
         if (transitioned) {
-            centerPrompts = prompts;
-            pendingCatalogFaces = undefined;
+            adoptedArtifact = prompts;
+            pendingCenterTarget = undefined;
         }
         else {
-            pendingCatalogFaces = { target: prompts };
+            pendingCenterTarget = { target: prompts };
         }
     };
     let bootConfigPending;
@@ -349,14 +372,20 @@ export async function createWebAdminRuntime(ctx) {
         return ledger;
     };
     const noteHandoff = (next) => {
-        const applied = next.applied ?? handoff.applied;
+        const applied = next.noneApplied === true ? undefined : (next.applied ?? handoff.applied);
         const durable = next.durable ?? handoff.durable;
         handoff = { ...(applied !== undefined ? { applied } : {}), ...(durable !== undefined ? { durable } : {}) };
         latchHandoff();
     };
-    const markApplied = (gen, version) => {
-        applyLedger.applied(gen, version);
-        noteHandoff({ applied: version });
+    const markApplied = (gen, eff) => {
+        applyLedger.applied(gen, eff.version);
+        if (isNoCenterEffective(eff))
+            noteHandoff({ noneApplied: true });
+        else
+            noteHandoff({ applied: eff.version });
+        const landed = tier.committed(candidateIdentityOf(eff));
+        if (landed !== undefined)
+            announceTier(landed);
     };
     let lkgBooted = false;
     let bootLkgCandidate;
@@ -481,7 +510,7 @@ export async function createWebAdminRuntime(ctx) {
             const lkgIdentity = candidateIdentityOf(lkgR.effective);
             if (lkgSurvivesRestart && lkgIdentity !== undefined)
                 noteHandoff({ durable: { version: lkgR.effective.version, identity: lkgIdentity } });
-            markApplied(lkgGen, lkgR.effective.version);
+            markApplied(lkgGen, lkgR.effective);
             await adoptCenterPrompts(lkgR.effective, lkgR.prompts, "boot-lkg");
             const lkgPlane = modelPlaneCommitted(lkgReport);
             if (lkgPlane)
@@ -586,7 +615,7 @@ export async function createWebAdminRuntime(ctx) {
                                 recordApply(rep);
                             },
                         });
-                        markApplied(bootGen, r.effective.version);
+                        markApplied(bootGen, r.effective);
                         const bootClean = fullyLandedForLkg(r, bootReport);
                         if (bootClean)
                             ccEtag = r.etag;
@@ -623,11 +652,13 @@ export async function createWebAdminRuntime(ctx) {
             }
         }
         catch (err) {
+            if (err instanceof ConfigDirUntrustedError)
+                throw err;
             if (bootApplyPhase)
                 logger.warn("config_apply_refused", { source: configProvider.kind, err: String(err), note: "the pulled candidate failed to apply at boot — falling back to the LKG / env; this is not a reachability failure" });
             else
                 logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
-            await bootFallBackWhole(`${bootApplyPhase ? "boot apply refused" : "boot fetch failed"}: ${String(err).slice(0, 120)}`);
+            await bootFallBackWhole(`${bootApplyPhase ? "boot apply refused" : "boot fetch failed"}: ${echoCallerText(String(err), { maxChars: 120 })}`);
         }
         if (!dryRun && cc !== undefined && currentIdentity() !== promptStateIdentity)
             await rebasePromptState(currentIdentity(), "boot-end");
@@ -666,8 +697,11 @@ export async function createWebAdminRuntime(ctx) {
             restoreReadFaceBaseline(config, before);
             throw err;
         }
+        if (changedSeats.includes("readDenyPatterns"))
+            announceReadDenyRows(config, logger);
     };
     let ccTimer;
+    let unwatchCredential;
     return {
         providerKind: configProvider?.kind,
         sealedKeyPublic: sealedKeys === undefined ? undefined : buildSealedKeyPublicFace(sealedKeys),
@@ -678,7 +712,6 @@ export async function createWebAdminRuntime(ctx) {
         },
         mcpRevocationState: () => (configProvider ? mcpRevocations.view() : undefined),
         getKeyResolver: () => keyResolver,
-        getCenterPrompts: () => centerPrompts,
         modelReady: () => modelReadyState.ready,
         onSelfReportChange: (listener) => {
             selfReportListeners.push(listener);
@@ -707,6 +740,7 @@ export async function createWebAdminRuntime(ctx) {
                 const pluginOut = await applyCenterPlugins(skills, effective, {
                     cacheRoot: join(config.localDataRoot ?? join(homedir(), ".ai-agent"), "plugin-cache"),
                     allowHosts: config.pluginsAllowHosts,
+                    toolsShareThisFilesystem: toolsRunOnThisHost(config),
                     logger,
                 }).catch((err) => {
                     logger.warn("center_plugins_apply_failed", { error: err instanceof Error ? err.message : String(err) });
@@ -839,6 +873,69 @@ export async function createWebAdminRuntime(ctx) {
             if (configProvider) {
                 const ccRef = config.webAdmin;
                 let refreshInFlight = false;
+                let followUp = false;
+                let ownRead = false;
+                const commitHot = async (c) => {
+                    const { eff, prompts, gen, phase } = c;
+                    const noCenter = isNoCenterEffective(eff);
+                    const planeChanged = noCenter || modelPlaneChanged(appliedPlaneEff, eff);
+                    let report;
+                    const committed = applyEffective(config, eff, logger, {
+                        leg: "hot",
+                        checkpointStorePresent,
+                        sealedKeys,
+                        generation: gen,
+                        report: (rep) => {
+                            report = rep;
+                            recordApply(rep);
+                        },
+                        ...(planeChanged ? { swapPlane: swapRunnerDeps } : {}),
+                    });
+                    if (!committed)
+                        return { committed: false, report, planeCommitted: false };
+                    mutateInPlace(pricing, buildPricing(config.models));
+                    keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
+                    limitSync?.sync();
+                    ceilingVerdict?.judge();
+                    if (phase !== "boot-deferred")
+                        mcpRevocations.applyEnabledEntries(enabledMcpEntries(eff.mcp));
+                    applyLiveReadFace(eff, swapRunnerDeps, phase);
+                    markApplied(gen, eff);
+                    const planeCommitted = modelPlaneCommitted(report);
+                    if (planeCommitted)
+                        appliedPlaneEff = noCenter ? undefined : eff;
+                    planeDeferredNoHandoff = undefined;
+                    await adoptCenterPrompts(eff, prompts, phase);
+                    if (planeCommitted)
+                        markRosterLanded(eff);
+                    if (tier.drifted(currentIdentity()))
+                        requestTick();
+                    return { committed: true, report, planeCommitted };
+                };
+                const demoteToNoCenter = async (awaiting) => {
+                    const gen = reserveArrivalGeneration();
+                    applyLedger.seenTarget(gen, NO_CENTER_EFFECTIVE.version);
+                    const hot = await commitHot({ eff: NO_CENTER_EFFECTIVE, prompts: undefined, gen, phase: "no-center" });
+                    if (!hot.committed) {
+                        throw new Error("the no-center tier was refused (the Runners did not accept the env model table) — the previous account's center configuration is still in force; retried next tick");
+                    }
+                    if (hot.report !== undefined && !hot.report.fullyApplied) {
+                        logger.warn("center_identity_demotion_partial", { groups: refusedGroups(hot.report).map((g) => g.group), note: "a group of the no-center tier was refused — that group keeps its previous values (loud; the env base for that group could not be applied)" });
+                    }
+                    noteCandidateVerdict(gen, undefined);
+                    latestEffective = undefined;
+                    ccEtag = undefined;
+                    announceTier(tier.demote(awaiting, hot.report !== undefined ? refusedGroups(hot.report).map((g) => g.group) : []));
+                };
+                const reconcileCenterIdentity = async (identity) => {
+                    if (identity === undefined || !tier.drifted(identity))
+                        return;
+                    if (tier.isDemoted()) {
+                        tier.retarget(identity);
+                        return;
+                    }
+                    await demoteToNoCenter(identity);
+                };
                 const refreshTick = async (arrival) => {
                     if (refreshInFlight)
                         return "ok";
@@ -850,6 +947,15 @@ export async function createWebAdminRuntime(ctx) {
                 const refreshTickRan = async (arrival) => {
                     refreshInFlight = true;
                     try {
+                        let ownIdentity;
+                        ownRead = true;
+                        try {
+                            ownIdentity = currentIdentity();
+                        }
+                        finally {
+                            ownRead = false;
+                        }
+                        await reconcileCenterIdentity(ownIdentity);
                         await retryPendingCatalog("refresh-retry");
                         if (planeDeferredNoHandoff) {
                             metrics.inc("models_tiers_plane_deferred_stuck_total");
@@ -875,6 +981,7 @@ export async function createWebAdminRuntime(ctx) {
                             }
                         }
                         if (r) {
+                            await reconcileCenterIdentity(candidateIdentityOf(r.effective));
                             const tickGen = arrival !== undefined ? useArrivalGeneration(r.effective.version, arrival.ordinal) : generationOf(r.effective.version);
                             applyLedger.seenTarget(tickGen, r.effective.version);
                             const verdict = judgeConfigCandidate(r);
@@ -889,35 +996,10 @@ export async function createWebAdminRuntime(ctx) {
                                 ccEtag = r.etag;
                             }
                             else {
-                                const planeChanged = modelPlaneChanged(appliedPlaneEff, r.effective);
-                                let applyReport;
-                                const committed = applyEffective(config, r.effective, logger, {
-                                    leg: "hot",
-                                    checkpointStorePresent,
-                                    sealedKeys,
-                                    generation: tickGen,
-                                    report: (rep) => {
-                                        applyReport = rep;
-                                        recordApply(rep);
-                                    },
-                                    ...(planeChanged ? { swapPlane: swapRunnerDeps } : {}),
-                                });
-                                if (!committed)
+                                const hot = await commitHot({ eff: r.effective, prompts: verdict.prompts, gen: tickGen, phase: "refresh" });
+                                if (!hot.committed)
                                     return "ok";
-                                mutateInPlace(pricing, buildPricing(config.models));
-                                keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
-                                limitSync?.sync();
-                                ceilingVerdict?.judge();
-                                mcpRevocations.applyEnabledEntries(enabledMcpEntries(r.effective.mcp));
-                                applyLiveReadFace(r.effective, swapRunnerDeps, "refresh");
-                                markApplied(tickGen, r.effective.version);
-                                const tickPlane = modelPlaneCommitted(applyReport);
-                                if (tickPlane)
-                                    appliedPlaneEff = r.effective;
-                                planeDeferredNoHandoff = undefined;
-                                await adoptCenterPrompts(r.effective, verdict.prompts, "refresh");
-                                if (tickPlane)
-                                    markRosterLanded(r.effective);
+                                const applyReport = hot.report;
                                 if (!fullyLandedForLkg(r, applyReport)) {
                                     ccEtag = undefined;
                                     const refused = applyReport ? refusedGroups(applyReport) : [];
@@ -962,13 +1044,39 @@ export async function createWebAdminRuntime(ctx) {
                         return inFlight;
                     const p = refreshTick(arrival).finally(() => {
                         inFlight = undefined;
+                        afterLane();
                     });
                     inFlight = p;
                     return p;
                 };
+                const requestTick = () => {
+                    if (ccTimer === undefined || ownRead)
+                        return;
+                    if (inFlight !== undefined || refreshInFlight) {
+                        followUp = true;
+                        return;
+                    }
+                    queueMicrotask(() => void runTick());
+                };
+                const afterLane = () => {
+                    if (!followUp)
+                        return;
+                    followUp = false;
+                    if (tier.drifted(currentIdentity()))
+                        requestTick();
+                };
+                unwatchCredential =
+                    ccRef !== undefined && !ccRef.dryRun && configProvider.kind === "remote"
+                        ? ccRef.credential.onRead((read) => {
+                            if (tier.drifted(read.identity))
+                                requestTick();
+                        })
+                        : undefined;
                 manualRefresh = runTick;
                 ccTimer = setInterval(() => void runTick(), 60_000);
                 ccTimer.unref?.();
+                if (tier.drifted(currentIdentity()))
+                    requestTick();
                 const deferredBootApply = async (r, arrivalGen) => {
                     if (!r)
                         return;
@@ -985,6 +1093,7 @@ export async function createWebAdminRuntime(ctx) {
                     }
                     finally {
                         refreshInFlight = false;
+                        afterLane();
                     }
                 };
                 const deferredBootApplyInner = async (r, lateGen) => {
@@ -1001,34 +1110,10 @@ export async function createWebAdminRuntime(ctx) {
                         ccEtag = r.etag;
                         return;
                     }
-                    const planeChangedLate = modelPlaneChanged(appliedPlaneEff, r.effective);
-                    let applyReportLate;
-                    const committedLate = applyEffective(config, r.effective, logger, {
-                        leg: "hot",
-                        checkpointStorePresent,
-                        sealedKeys,
-                        generation: lateGen,
-                        report: (rep) => {
-                            applyReportLate = rep;
-                            recordApply(rep);
-                        },
-                        ...(planeChangedLate ? { swapPlane: swapRunnerDeps } : {}),
-                    });
-                    if (!committedLate)
+                    const hotLate = await commitHot({ eff: r.effective, prompts: lateVerdict.prompts, gen: lateGen, phase: "boot-deferred" });
+                    if (!hotLate.committed)
                         return;
-                    mutateInPlace(pricing, buildPricing(config.models));
-                    keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
-                    limitSync?.sync();
-                    ceilingVerdict?.judge();
-                    applyLiveReadFace(r.effective, swapRunnerDeps, "boot-deferred");
-                    markApplied(lateGen, r.effective.version);
-                    const latePlane = modelPlaneCommitted(applyReportLate);
-                    if (latePlane)
-                        appliedPlaneEff = r.effective;
-                    planeDeferredNoHandoff = undefined;
-                    await adoptCenterPrompts(r.effective, lateVerdict.prompts, "boot-deferred");
-                    if (latePlane)
-                        markRosterLanded(r.effective);
+                    const applyReportLate = hotLate.report;
                     if (!fullyLandedForLkg(r, applyReportLate)) {
                         ccEtag = undefined;
                         const refusedLate = applyReportLate ? refusedGroups(applyReportLate) : [];
@@ -1069,10 +1154,13 @@ export async function createWebAdminRuntime(ctx) {
                 ccTimer = undefined;
             }
             credentialRenewer?.stop();
+            unwatchCredential?.();
+            unwatchCredential = undefined;
         },
         centerCredentialState() {
             return cc === undefined ? undefined : buildCenterCredentialHealthView(cc.credential.health(), credentialRenewer);
         },
+        centerIdentityNoticeState: () => tier.notice(),
     };
 }
 //# sourceMappingURL=web-admin.js.map

package/dist/boot/workflow-orchestration.d.ts

@@ -15,6 +15,7 @@ import { type WorkflowRun, type WorkflowRunStore } from "@sema-agent/core";
 import type { ServiceConfig } from "../config.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { type WorkflowAgentSessionIndex } from "../orchestration/workflow-agent-session-index.js";
+import type { WorkflowParkDecisionStore } from "../orchestration/workflow-park-decision.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import { type WorkflowCompletionInbox } from "../orchestration/workflow-completion-inbox.js";
@@ -49,5 +50,6 @@ export declare function createWorkflowOrchestration(ctx: WorkflowOrchestrationCt
         publishTerminalFleetRow?: (id: string, run: WorkflowRun) => void;
     };
     workflowAgentSessionIndex: WorkflowAgentSessionIndex | undefined;
+    workflowParkDecisions: WorkflowParkDecisionStore | undefined;
 };
 //# sourceMappingURL=workflow-orchestration.d.ts.map

package/dist/boot/workflow-orchestration.js

@@ -66,6 +66,7 @@ export function createWorkflowOrchestration(ctx) {
                 ? backend.workflowAgentSessionIndex()
                 : new LocalWorkflowAgentSessionIndex(join(config.localDataRoot ?? localRoot, "workflows"), undefined))
         : undefined;
+    const workflowParkDecisions = config.selfOrchestrationEnabled && backend !== undefined && (sqlWorkflowRunStore !== undefined || backend.kind === "local") ? backend.workflowParkDecisions?.() : undefined;
     const workflowRunStore = baseWorkflowRunStore
         ? new JournalingWorkflowRunStore(baseWorkflowRunStore, workflowNotifyGate, fleetBus, workflowAgentSessionIndex)
         : undefined;
@@ -82,7 +83,7 @@ export function createWorkflowOrchestration(ctx) {
     return {
         sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion,
         workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink,
-        workflowAgentRegistry, subagentSteerRegistry, workflowRecoverOpts, workflowAgentSessionIndex,
+        workflowAgentRegistry, subagentSteerRegistry, workflowRecoverOpts, workflowAgentSessionIndex, workflowParkDecisions,
     };
 }
 //# sourceMappingURL=workflow-orchestration.js.map