@sema-agent/server 7.131.0 → 7.133.0

package/dist/org-delivery-gate.d.ts

@@ -0,0 +1,81 @@
+/**
+ * 跨主体投递门 —— core `OrgDeliveryGate` 契约的 server 实现([ref] §10.2;core 7.53.0 的 core 半场)。
+ *
+ * ## 规则(一条)
+ * **一封跨主体的信只因这只门把它追加进收件人的 `principal.inbox` 而存在。** 门是唯一的跨 scope 追加持有者:成员判 →
+ * 铸信 → 收件箱上界 → 配额 → 追加,全在 {@link createOrgDeliveryGate} 交出的 `deliverCrossPrincipal` 里一体完成;
+ * 它只有两种答案 —— 一张回执,或 core 闭集 `ORG_DELIVERY_REFUSAL_CODES` 里的一个词。本仓不铸第二只拒绝词。
+ *
+ * 规则因此少了几条(而不是多了几条):
+ *  · **成员判不另立名册**:「谁属于 org:acme」在一个进程里只有一个答案 —— 记忆准入 seam、memory-policy 面、共享记忆读面
+ *    读的那**同一个**目录实例(`boot/org-memory.ts` 装配的 `OrgMemoryDirectory`)。两位主体同属一个 org ⟺ 两人
+ *    `lookup` 的 `org:` 键集合有交集。目录答不上来(`unavailable`)= 「部署说不出他们同 org」⇒ `not_member`
+ *    (core 对这只词的定义逐字含这一臂)。
+ *  · **记录只有一个铸点**:core 的纯函数 `mintCrossPrincipalRecord`(只写 `peerMeta.kind / fromScope / gateReceiptId`
+ *    + 可选 `urgent` 与显示名;不写 `fromSession / fromMode / hopChain`)。本仓不另铸任何记录形。
+ *  · **限流是配额店的两个原子动作,各管一件事**:`admitAttempt` 记发件人的每一次尝试(碰目录之前;界住刷目录的速率),
+ *    `take` 在同一把锁下判并记 (from→to) 对偶界与收件人聚合界(投递额度)。SQL 两方言各是一个事务,见
+ *    `plugins/org-delivery-quota-store.ts` 头注;File / Memory = 单进程。
+ *  · **收件人的 scope 就是收件人主体串本身**:本服务的引擎 scope = `spec.principal`(`resolve-spec.ts` 落
+ *    `auth.principal`;同一事实的推导见 `peer-directory.ts` 的「scope 轴」段)。门不另造编解码。
+ *
+ * ## 次序与理由
+ *  0. **发件人的尝试界**(配额店 `admitAttempt`,成没成都记一笔):满 ⇒ `rate_limited`。它必须在成员判之前 —— 成员判把调用方给的
+ *     收件人串交给组织目录去查,而目录的每主体状态按属主裁定不淘汰、它的量级只在「查的都是验过的主体」时有界(`org-memory-admission.ts`
+ *     的 `PrincipalState` 注);这一界让「一个成员拿任意串去刷目录」的速率与总量随时间线性有界(设计稿收件人查询面第四条:查询限流)。
+ *     与收件人无关 ⇒ 它的 `rate_limited` 不泄露收件人存不存在。
+ *  1. **成员判**(纯读):不同 org / 查无此人 / 目录不可用 / 收件人串过不了主体形判 / 收件人当不了收件箱的身份键(良构 Unicode ∧ 无控制字符 ∧
+ *     UTF-8 字节不超过键列宽 —— 两方言收件箱写面与读面同读的唯一判官 `mailbox-store-sql.ts` 的 `mailboxKeyProblem`)⇒ 同一句 `not_member`,逐字节同 ——
+ *     门永远不是一只存在性探针(core 契约原句),也不说「是长度」。收件人那一判必须在配额之前:第 5 步的追加按同一只判官拒,拒在扣了投递额度之后就是「吃了额度没投到」。
+ *  2. **铸信**(纯函数):放在任何有副作用的步骤之前。发件人的 scope 拼不进信封的发件人位(引擎按百分号编码后 1..190 字节判,抛闭集码
+ *     `cross_session.invalid_from_scope`,`CrossSessionCodecError` 由引擎包根导出)⇒ 同一句 `not_member`、一个配额名额都没吃 —— 发件人这一侧的判官只有引擎这一只,
+ *     本仓不另抄宽度公式。部署没声明收件箱消费方(`no_consumer`)或别的铸信失败 ⇒ 门抛(core:「the gate maps that to its own failure」),HTTP 面答 500,同样没吃额度。
+ *  3. **收件箱上界**(`peekCount` 读):满 ⇒ `inbox_full`,在吃配额之前判,满箱不烧发件人的额度。与引擎同主体车道的
+ *     `maxQueuedPeerMessages` 同一形(入口处读一次占用);两封并发信最多越界并发数那么多,上界由配额再界一次。
+ *  4. **配额**(原子判并记):任一界满 ⇒ `rate_limited`,与第 0 步同一句(不让发件人从拒句里分辨出「收件人这一小时收了多少」)。
+ *  5. **追加**:`append(收件人 scope, PRINCIPAL_INBOX_HANDLE, 记录)`。店的预删除态拒码(`mailbox.recipient_tombstoned`)
+ *     原样转成 `recipient_tombstoned`(core 对这只词的定义:「the store's own pre-delete code, relayed」);其余错误抛。
+ * 被拒的投递在任何地方都不追加任何东西(core 契约原句);投递额度(第 4 步)在之后只有追加失败这一种「吃了额度没投到」—— 方向是收紧;
+ * 尝试界(第 0 步)按定义每次都记。
+ *
+ * ## 不是本门的威胁面(如实,[ref] §10.2-1 原句)
+ * 库内直接持有 `MailboxStore` 的宿主恒能写任何 scope —— 那是同一信任域内的事。本门保证的是**本服务的 wire 面**上没有第二条
+ * 跨 scope 写径:受理口(`POST /v1/principal-inbox/messages`)只调门,本仓源码里拼得出 `principal.inbox` 这只箱址的只有本文件
+ * (`test/org-delivery-gate-single-path.test.ts` 按源码钉)。
+ */
+import { type MailboxStore, type OrgDeliveryGate, type OrgDeliveryRefusalCode, type PrincipalInboxConsumer } from "@sema-agent/core";
+import type { OrgMemoryDirectory } from "./org-memory-admission.js";
+import type { OrgDeliveryQuotaPolicy, OrgDeliveryQuotaStore } from "./plugins/org-delivery-quota-store.js";
+/**
+ * 跨主体配额(**唯一**的数字源;店只按它数)。默认显著紧于同主体车道(引擎 `PEER_LANE_DEFAULTS`:每发件人突发 30、
+ * 每秒回填 0.5):同一对主体每小时 10 封,一位收件人每小时合计 30 封 —— org 里一个吵闹的主体淹不了别人的箱;
+ * 一个发件人每小时 60 次尝试(成没成都算)—— 拿收件人串去问组织目录的速率有界(头注「次序」第 0 步)。
+ */
+export declare const ORG_DELIVERY_QUOTA: OrgDeliveryQuotaPolicy;
+/** 收件箱上界(在箱、未被消费方确认的信封数)。与引擎同主体车道的箱上界缺省(`maxQueuedPeerMessages`)同值。 */
+export declare const PRINCIPAL_INBOX_BOUND = 50;
+/**
+ * 四只拒绝词各自的那**一句**(wire 上的 `error` 就是它,`routes/principal-inbox.ts` 原样中继、不手抄)。
+ * 键集 = core 闭集:core 加词 ⇒ 这张表编译红。
+ * `not_member` 一句同时服务「不同 org / 查无此人 / 目录答不上来 / 收件人串不成形 / 收件人当不了收件箱的键 / 发件人主体拼不进信封的发件人位」—— 改它要保持各臂同字节。
+ */
+export declare const ORG_DELIVERY_REFUSAL_MESSAGES: Readonly<Record<OrgDeliveryRefusalCode, string>>;
+export interface OrgDeliveryGateDeps {
+    /** org 成员目录 —— **必须**与记忆准入 seam / memory-policy / 共享记忆读面同一个实例(头注)。 */
+    readonly directory: OrgMemoryDirectory;
+    /** 收件人箱所在的店(与引擎 `RunnerDeps.mailboxStore` 同一只)。 */
+    readonly mailbox: Pick<MailboxStore, "append" | "peekCount">;
+    /** 配额店(`StoreBackend.orgDeliveryQuota()`)。 */
+    readonly quota: OrgDeliveryQuotaStore;
+    /** 部署声明的收件箱消费方 —— `principalInboxConsumerOf` 读**同一份** `RunnerDeps` 的结果(core 契约:铸信要它)。 */
+    readonly consumer: PrincipalInboxConsumer;
+    /** 信的 `sentAt` 钟(缺省本进程墙钟)。配额窗不读它 —— 窗由配额店自己的钟定。 */
+    readonly nowMs?: () => number;
+    /** 回执 id 铸点(缺省 uuidv7)。 */
+    readonly mintReceiptId?: () => string;
+}
+/**
+ * 活对象(闭包持有目录 / 两只店 / 消费方)⇒ `create*`(CLAUDE.md 工厂命名律)。
+ */
+export declare function createOrgDeliveryGate(deps: OrgDeliveryGateDeps): OrgDeliveryGate;
+//# sourceMappingURL=org-delivery-gate.d.ts.map

package/dist/org-delivery-gate.js

@@ -0,0 +1,59 @@
+import { CrossSessionCodecError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, PRINCIPAL_INBOX_HANDLE, mintCrossPrincipalRecord, uuidv7, } from "@sema-agent/core";
+import { principalShapeProblem } from "./security.js";
+import { mailboxKeyProblem } from "./plugins/mailbox-store-sql.js";
+export const ORG_DELIVERY_QUOTA = Object.freeze({ windowMs: 3_600_000, attemptsPerSender: 60, perPair: 10, perRecipient: 30 });
+export const PRINCIPAL_INBOX_BOUND = 50;
+export const ORG_DELIVERY_REFUSAL_MESSAGES = Object.freeze({
+    "org_delivery.not_member": "the recipient cannot be reached through the organization delivery gate",
+    "org_delivery.rate_limited": "the cross-principal delivery quota is spent for now — try again later",
+    "org_delivery.inbox_full": "the recipient's principal inbox is full — try again after the recipient has read some of it",
+    "org_delivery.recipient_tombstoned": "the recipient is being deleted — nothing was delivered",
+});
+const refuse = (code) => ({ ok: false, code, message: ORG_DELIVERY_REFUSAL_MESSAGES[code] });
+async function shareAnOrg(directory, a, b) {
+    const [la, lb] = await Promise.all([directory.lookup(a), directory.lookup(b)]);
+    if (la.kind !== "granted" || lb.kind !== "granted")
+        return false;
+    return Object.keys(la.scopes).some((org) => Object.hasOwn(lb.scopes, org));
+}
+const principalShaped = (s) => s !== "" && principalShapeProblem(s) === undefined;
+const fitsInboxKey = (recipient) => mailboxKeyProblem("scope", recipient) === undefined;
+export function createOrgDeliveryGate(deps) {
+    const nowMs = deps.nowMs ?? Date.now;
+    const mintReceiptId = deps.mintReceiptId ?? uuidv7;
+    return {
+        async deliverCrossPrincipal(authedFrom, toPrincipal, body) {
+            if (!(await deps.quota.admitAttempt(authedFrom.scope, ORG_DELIVERY_QUOTA)))
+                return refuse("org_delivery.rate_limited");
+            if (!principalShaped(toPrincipal) || !fitsInboxKey(toPrincipal) || !(await shareAnOrg(deps.directory, authedFrom.scope, toPrincipal))) {
+                return refuse("org_delivery.not_member");
+            }
+            const toScope = toPrincipal;
+            const receiptId = mintReceiptId();
+            let record;
+            try {
+                record = mintCrossPrincipalRecord({ from: authedFrom, body, receiptId, sentAt: nowMs(), consumer: deps.consumer });
+            }
+            catch (err) {
+                if (err instanceof CrossSessionCodecError && err.code === "cross_session.invalid_from_scope")
+                    return refuse("org_delivery.not_member");
+                throw err;
+            }
+            if ((await deps.mailbox.peekCount(toScope, PRINCIPAL_INBOX_HANDLE)) >= PRINCIPAL_INBOX_BOUND)
+                return refuse("org_delivery.inbox_full");
+            if (!(await deps.quota.take(authedFrom.scope, toScope, ORG_DELIVERY_QUOTA)))
+                return refuse("org_delivery.rate_limited");
+            let seq;
+            try {
+                seq = await deps.mailbox.append(toScope, PRINCIPAL_INBOX_HANDLE, record);
+            }
+            catch (err) {
+                if (err?.code === MAILBOX_TOMBSTONED_RECIPIENT_CODE)
+                    return refuse("org_delivery.recipient_tombstoned");
+                throw err;
+            }
+            return { ok: true, receipt: { receiptId, seq } };
+        },
+    };
+}
+//# sourceMappingURL=org-delivery-gate.js.map

package/dist/panel-tool-names.d.ts

@@ -0,0 +1,23 @@
+/**
+ * 读面上「一台服务器 / 一个对端挂了哪些工具」的**名单截表律** —— 全仓唯一属主。
+ *
+ * 为什么必须是一处:名单的条数是远端可控且无界的(A2A 卡里的技能条数、MCP 服务器列出的工具条数,core 只限单个名字的
+ * 长度,不限条数),而这些读面都是**只读 GET / 可被反复触发的探测**,多身份可放大。所以读面发的是
+ * **有界表 + 真计数 + 显式旗**,而不是静默截断:一个会撒谎的读面比一个大的读面更贵。
+ * 同一个事实(「名单被截了」)在每一张读面上必须是同一个数、同一个旗键、同一个说法 —— 两处各写一遍,
+ * 下一个人只会改到其中一处。
+ *
+ * ## 契约(所有用到它的读面逐字成立)
+ *  · 名单最多 {@link PANEL_MAX_TOOL_NAMES} 条,**读数序**取前缀;
+ *  · 超出时另发 `toolNamesTruncated: true`;**恰好**在上限上不算截断,旗键缺席(不编 `false`);
+ *  · **真数不在这里**:`toolCount` 是各读面自己的铸点(A2A 面板 = 名单长度;MCP 状态面 = §G.7 的那一只投影),本函数一个字都不碰它 ——
+ *    消费端读数用 `toolCount`,别用 `toolNames.length`。
+ */
+/** 每一台服务器 / 每一个对端最多回多少条工具名。 */
+export declare const PANEL_MAX_TOOL_NAMES = 200;
+/** 一份工具名单的有界出口形(纯数据,`build*`)。入参不被改写。 */
+export declare function buildBoundedToolNames(names: readonly string[]): {
+    toolNames: string[];
+    toolNamesTruncated?: true;
+};
+//# sourceMappingURL=panel-tool-names.d.ts.map

package/dist/panel-tool-names.js

@@ -0,0 +1,8 @@
+export const PANEL_MAX_TOOL_NAMES = 200;
+export function buildBoundedToolNames(names) {
+    return {
+        toolNames: names.slice(0, PANEL_MAX_TOOL_NAMES),
+        ...(names.length > PANEL_MAX_TOOL_NAMES ? { toolNamesTruncated: true } : {}),
+    };
+}
+//# sourceMappingURL=panel-tool-names.js.map

package/dist/parked-decide.d.ts

@@ -9,10 +9,11 @@
  * 行永 parked、生命周期分叉)。
  */
 import type { HostDecision } from "./host-decision.js";
-import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, QuestionAnswer, ResumeOutcome, TaskRegistry, ToolExecuteContext, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
+import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, CheckpointToken, QuestionAnswer, RunInternals, TaskRegistry, ToolExecuteContext, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
 import type { ParkedReviveSurfaceFactory } from "./parked-revive-surface.js";
 import type { RebuiltInheritedGate } from "./boot/parked-revive-gate.js";
 import { type WorkflowRunParkKey, type WorkflowAgentSessionIndex } from "./orchestration/workflow-agent-session-index.js";
+import type { WorkflowParkDecisionStore, WorkflowParkOutcome } from "./orchestration/workflow-park-decision.js";
 import { type SessionFaceReader } from "./session-incarnation.js";
 export interface ParkedAgentMatch {
     handle: string;
@@ -90,6 +91,36 @@ export declare function findParkOrigin(sources: ParkOriginSources, cp: {
     scope: string;
     sessionId: string;
 }): Promise<ParkOrigin | undefined>;
+/** 起跑读者的源(就是 `ServiceDeps` 上那几只;任一缺席 ⇒ 这台部署没有这条车道,读者只交回调用方自己带的那一份)。 */
+export interface HeldWorkflowParkDecisionSources {
+    readonly workflowParkDecisions?: WorkflowParkDecisionStore;
+    readonly checkpointStore?: {
+        get(token: CheckpointToken): Promise<{
+            readonly status: string;
+            readonly scope: string;
+            readonly sessionId: string;
+        } | null>;
+    };
+    readonly workflowAgentSessionIndex?: WorkflowAgentSessionIndex;
+    readonly workflowRunStore?: Pick<WorkflowRunStore, "get">;
+}
+/** `RunInternals.workflowParkedResume` 的一条(形直接取 core 的那一位)。 */
+type ParkedResumeEntry = NonNullable<RunInternals["workflowParkedResume"]>[number];
+/**
+ * 🔴 **决定进引擎的唯一读者** —— 每一只起跑器(durable run 腿、续跑腿流形与 verify 形、同步流腿、同步 JSON 腿)开跑之前调一次,
+ * 产物原样摊进那一跑的 `RunInternals`(部署方铸的 TRUSTED internals:不是 `TaskSpec` 字段、不是工具参数 —— 模型永远不能自己决定一次审批)。
+ *
+ * 产物 = 调用方自己带的那一份(`carried`:`/decide` 的投递跑带着它刚受理、行还没落的那条决定)∪ 这个会话的决定行(律与寿命的属主 =
+ * `orchestration/workflow-park-decision.ts` 文件头),同一张卡以 `carried` 为准(它是要取代行上旧决定的那一个)。行这一侧逐条:
+ *  · 子代卡此刻**仍 pending** 才供:读回 `null` / 状态不是 `pending` ⇒ 不供(引擎对「记着停驻、卡却已不 pending」的序数,有条目 ⇒ 当确认
+ *    结算、没条目 ⇒ 拒续跑 —— 供一条过期条目会把后者改成前者);读卡抛 ⇒ 不供并计 `server.workflow-park-decision.card-unreadable`
+ *    (这一读失败不代表引擎随后的那一读也失败;不供的方向是这一跑不带它、行留着给下一跑 —— 绝不把它变成一次确认);
+ *  · 投递目标 = 这张卡**当下**的持有者 run(`findParkOrigin`,与 `/decide` 路由同一只判官):持有者判不出唯一一条(分叉 / 证不了 / 卡
+ *    已在新 token 下再停)⇒ 不供(引擎只把条目交给 `resumeFromRunId` 恰是持有者的续跑;没有唯一持有者就没有可交付的那一跑)。
+ * 决定店读抛(local 账本闸合上 / SQL 一行坏体)⇒ 与读卡失败同律:这一店当「没有可供的行」,只交回 `carried`,计 `server.workflow-park-decision.store-unreadable`
+ * (不跳过坏行照供其余:读不出的那一行可能正是取代了旧决定的那一笔;不拒起跑:不供是安全方向,卡仍 pending、可再决)。决定的写口照旧由店闸住。
+ */
+export declare function heldWorkflowParkDecisions(sources: HeldWorkflowParkDecisionSources, hostSessionId: string, carried?: readonly ParkedResumeEntry[]): Promise<Pick<RunInternals, "workflowParkedResume">>;
 /**
  * pending checkpoint → parked bg 行匹配。
  *
@@ -217,7 +248,7 @@ export interface ParkedDecideResult {
  *   自铸的结算词是 pre-CAS 响亮拒)。
  * · `answer` 原样透传([ref]:header 逐字匹配等语义校验全在 core,server 不预判)。
  */
-export declare function buildParkedResumeOutcome(req: ParkedDecideRequest): ResumeOutcome;
+export declare function buildParkedResumeOutcome(req: ParkedDecideRequest): WorkflowParkOutcome;
 /**
  * S-185 车CM —— **第三条车道的计划**(纯函数;驱动本身归 resume 家族的那条腿,见下方「为什么不自建驱动」)。
  *
@@ -234,12 +265,13 @@ export declare function buildParkedResumeOutcome(req: ParkedDecideRequest): Resu
  *    decided, the deployment resumes this run (resumeFromRunId: …)」。
  * ⇒ 第三条车道 = **把决定挂在宿主会话的下一跑上**,而那一跑必须走 resume 家族**既有**的那条腿
  * (`notify-wake.ts` 的成文纪律:wake 会烧模型,所以复用 `ctx.legs.resumeWake`,「而不是在本域自建第二条
- * 驱动路径」)。本函数因此只出**计划**:宿主会话 + 要注入的消息 + 要随 internals 走的那一条决定。
+ * 驱动路径」)。本函数因此只出**计划**:宿主会话 + 要注入的消息 + 要落成决定行的那一条决定(调用方受理时落行,宿主会话的每一跑
+ * 开跑前经那一只读者把它放进 internals)。
  *
  * ## 诚实边界(登记,不假装没有)
  * · **模型中介**:决定送达宿主之后,真正的赎回发生在宿主再调一次 `Workflow({resumeFromRunId})` 时。
- *   core 的 park 回执逐字告诉模型这件事,但它不是一条确定性的机器腿。宿主没照做 ⇒ 卡仍 pending、
- *   人可再决(**不会**静默吃掉批准)。
+ *   core 的 park 回执逐字告诉模型这件事,但它不是一条确定性的机器腿。宿主没照做 ⇒ 卡仍 pending、决定行还在:
+ *   宿主会话的下一跑(谁起的都算)照带它,同一个决定重投再触发一次投递(**不会**静默吃掉批准)。
  * · **`inheritedGate` 不供**:那是「跨进程重供 checkpoint 的父约束」的席位,而 wa* 行不带父约束链;
  *   同进程时 core 的内存 registry 自动重供,跨进程且该 cp 带 `requiresParentConstraint` 时 core 响亮拒
  *   (`resume.parent_constraint_missing`)⇒ 该 ordinal 再 park 一次,不会 fail-open。
@@ -257,7 +289,7 @@ export type WorkflowParkedDecidePlan = {
     hostSessionId: string;
     runId: string;
     message: string;
-    outcome: ResumeOutcome;
+    outcome: WorkflowParkOutcome;
 } | {
     ok: false;
     deny: ParkedDecideResult;
@@ -311,4 +343,5 @@ export declare function planWorkflowParkedDecide(origin: Extract<ParkOrigin, {
  * re-park 诚实可见,操作员可再决。
  */
 export declare function decideParkedAgent(deps: ParkedDecideDeps, req: ParkedDecideRequest, match: ParkedAgentMatch): Promise<ParkedDecideResult>;
+export {};
 //# sourceMappingURL=parked-decide.d.ts.map

package/dist/parked-decide.js

@@ -1,9 +1,11 @@
 import { readClosedWordSeat } from "./approval-card.js";
 import { routeWorkflowPark } from "./orchestration/workflow-agent-session-index.js";
+import { recordFailOpen } from "./observability/fail-open.js";
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
-import { backgroundScopesForCheckpointScope, decodeCheckpointScope } from "./security.js";
+import { backgroundScopesForCheckpointScope, decodeCheckpointScope, ownerOfCheckpointScope } from "./security.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 import { sameSessionOccupant } from "./session-incarnation.js";
+import { refusalBody } from "./http/refusal-body.js";
 export async function findParkOrigin(sources, cp) {
     if (sources.agentStore !== undefined) {
         let match;
@@ -51,6 +53,33 @@ export async function findParkOrigin(sources, cp) {
         return undefined;
     }
 }
+export async function heldWorkflowParkDecisions(sources, hostSessionId, carried) {
+    const entries = [...(carried ?? [])];
+    const { workflowParkDecisions: decisions, checkpointStore: cs, workflowAgentSessionIndex: workflowIndex, workflowRunStore } = sources;
+    if (decisions !== undefined && cs !== undefined && workflowIndex !== undefined && workflowRunStore !== undefined) {
+        const own = new Set(entries.map((e) => String(e.token)));
+        const held = await decisions.listByHostSession(hostSessionId).then((rows) => ({ rows }), (err) => ({ err }));
+        if ("err" in held) {
+            recordFailOpen("server.workflow-park-decision.store-unreadable", `hostSessionId=${hostSessionId} err=${held.err instanceof Error ? held.err.message : String(held.err)}`);
+            return entries.length > 0 ? { workflowParkedResume: entries } : {};
+        }
+        for (const row of held.rows) {
+            if (own.has(String(row.token)))
+                continue;
+            const card = await cs.get(row.token).then((cp) => ({ cp }), (err) => ({ err }));
+            if ("err" in card) {
+                recordFailOpen("server.workflow-park-decision.card-unreadable", `runId=${row.runId} err=${card.err instanceof Error ? card.err.message : String(card.err)}`);
+                continue;
+            }
+            if (card.cp === null || card.cp.status !== "pending")
+                continue;
+            const origin = await findParkOrigin({ workflowIndex, workflowRunStore }, { token: row.token, scope: card.cp.scope, sessionId: card.cp.sessionId });
+            if (origin?.kind === "workflow")
+                entries.push({ runId: origin.runId, token: row.token, outcome: row.outcome });
+        }
+    }
+    return entries.length > 0 ? { workflowParkedResume: entries } : {};
+}
 function quiet(warn, event, fields) {
     try {
         warn?.(event, fields);
@@ -106,21 +135,25 @@ export function denyWorkflowParksUnreadable(origin) {
         case "older_engine":
             return {
                 status: 409,
-                body: {
-                    error: "this decision cannot be matched to the pending step it belongs to: the run's record was written by an earlier engine version, which did not record which run is waiting on each pending step — and that record is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resume the run itself instead — `Workflow({resumeFromRunId})` with the runId below — and once the resumed run is waiting on this step again it records itself as the one waiting, after which deciding here works normally. Only if the engine also refuses that resume is the run truly unrecoverable",
+                body: refusalBody({
                     errorCode: "decide.workflow_parks_unreadable",
-                    runId: origin.runId,
-                },
+                    message: "this decision cannot be matched to the pending step it belongs to: the run's record was written by an earlier engine version, which did not record which run is waiting on each pending step — and that record is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resume the run itself instead — `Workflow({resumeFromRunId})` with the runId below — and once the resumed run is waiting on this step again it records itself as the one waiting, after which deciding here works normally. Only if the engine also refuses that resume is the run truly unrecoverable",
+                    facts: {
+                        runId: origin.runId,
+                    },
+                }),
             };
         case "unreadable":
             return {
                 status: 409,
-                body: {
-                    error: "this decision cannot be matched to the pending step it belongs to: this run's record cannot be read (the list of pending steps the run owns is damaged: one of its entries is malformed, or it is not a list at all) — and that list is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resuming does not clear this: the damaged record keeps naming this step whatever runs after it, so the decision stays undeliverable until whoever operates this deployment repairs that record (the runId below); after that, deciding here works normally. When the response also carries readableHolderRunId, that run's record is readable and is the latest one waiting on this step — it is where the work can be carried on, but the damaged record above still keeps this decision from being delivered until that record is fixed",
+                body: refusalBody({
                     errorCode: "decide.workflow_parks_unreadable",
-                    runId: origin.runId,
-                    ...(origin.readableHolderRunId !== undefined ? { readableHolderRunId: origin.readableHolderRunId } : {}),
-                },
+                    message: "this decision cannot be matched to the pending step it belongs to: this run's record cannot be read (the list of pending steps the run owns is damaged: one of its entries is malformed, or it is not a list at all) — and that list is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resuming does not clear this: the damaged record keeps naming this step whatever runs after it, so the decision stays undeliverable until whoever operates this deployment repairs that record (the runId below); after that, deciding here works normally. When the response also carries readableHolderRunId, that run's record is readable and is the latest one waiting on this step — it is where the work can be carried on, but the damaged record above still keeps this decision from being delivered until that record is fixed",
+                    facts: {
+                        runId: origin.runId,
+                        ...(origin.readableHolderRunId !== undefined ? { readableHolderRunId: origin.readableHolderRunId } : {}),
+                    },
+                }),
             };
         default: {
             const unhandled = origin.cause;
@@ -131,11 +164,13 @@ export function denyWorkflowParksUnreadable(origin) {
 export function denyWorkflowParkForked(origin) {
     return {
         status: 409,
-        body: {
-            error: "this decision cannot be delivered: the same run was resumed more than once and every resumed copy listed in runIds is waiting on this same step, so there is no single run to hand the decision to. Nothing was delivered and the approval card stays pending. Resume one of the runs listed in runIds; once that run is waiting on this step again, deciding here works normally",
+        body: refusalBody({
             errorCode: "decide.workflow_park_forked",
-            runIds: [...origin.runIds],
-        },
+            message: "this decision cannot be delivered: the same run was resumed more than once and every resumed copy listed in runIds is waiting on this same step, so there is no single run to hand the decision to. Nothing was delivered and the approval card stays pending. Resume one of the runs listed in runIds; once that run is waiting on this step again, deciding here works normally",
+            facts: {
+                runIds: [...origin.runIds],
+            },
+        }),
     };
 }
 export function planWorkflowParkedDecide(origin, req) {
@@ -144,11 +179,13 @@ export function planWorkflowParkedDecide(origin, req) {
             ok: false,
             deny: {
                 status: 400,
-                body: {
-                    error: "remember:\"session\" is not supported for this approval: accepting it here only means the decision was handed on for delivery, not that the engine has applied it — an exemption granted now could outlive a decision the engine later rejects. Re-issue the decide without `remember`; the decision itself is accepted normally that way.",
+                body: refusalBody({
                     errorCode: "decide.workflow_remember_unsupported",
-                    runId: origin.runId,
-                },
+                    message: "remember:\"session\" is not supported for this approval: accepting it here only means the decision was handed on for delivery, not that the engine has applied it — an exemption granted now could outlive a decision the engine later rejects. Re-issue the decide without `remember`; the decision itself is accepted normally that way.",
+                    facts: {
+                        runId: origin.runId,
+                    },
+                }),
             },
         };
     }
@@ -158,11 +195,13 @@ export function planWorkflowParkedDecide(origin, req) {
             ok: false,
             deny: {
                 status: 409,
-                body: {
-                    error: "this run was started on its own rather than from a session, so this deployment has nowhere to deliver the decision. Nothing was decided and the approval is still pending — resume the run yourself with the runId below and decide it there",
+                body: refusalBody({
                     errorCode: "decide.workflow_host_unknown",
-                    runId: origin.runId,
-                },
+                    message: "this run was started on its own rather than from a session, so this deployment has nowhere to deliver the decision. Nothing was decided and the approval is still pending — resume the run yourself with the runId below and decide it there",
+                    facts: {
+                        runId: origin.runId,
+                    },
+                }),
             },
         };
     }
@@ -181,29 +220,31 @@ export function planWorkflowParkedDecide(origin, req) {
 function sessionGone(taskId) {
     return {
         status: 409,
-        body: {
-            error: "the session this agent belongs to was deleted (or deleted and started again under the same id) while its approval waited, so the approval no longer applies — nothing was resumed",
+        body: refusalBody({
             errorCode: "decide.not_parked",
-            taskId,
-        },
+            message: "the session this agent belongs to was deleted (or deleted and started again under the same id) while its approval waited, so the approval no longer applies — nothing was resumed",
+            facts: {
+                taskId,
+            },
+        }),
     };
 }
 export async function decideParkedAgent(deps, req, match) {
     const row = match.row;
     const rememberRoot = req.grantRemember !== undefined ? grantRootOf(row) : undefined;
     if (req.grantRemember !== undefined && rememberRoot === undefined) {
-        return { status: 400, body: { error: "remember cannot be applied: this parked agent row carries no root/parent session anchor for the exemption", errorCode: "decide.parked_remember_unsupported", taskId: match.handle } };
+        return { status: 400, body: refusalBody({ errorCode: "decide.parked_remember_unsupported", message: "remember cannot be applied: this parked agent row carries no root/parent session anchor for the exemption", facts: { taskId: match.handle } }) };
     }
     const pendingTool = req.pendingAction?.toolName;
     if (pendingTool === ASK_USER_QUESTION_TOOL_NAME && req.decision === "approve" && req.answer === undefined) {
-        return { status: 400, body: { error: "pending action is AskUserQuestion — approve requires body.answer (the operator's answers[]); deny needs none", errorCode: "decide.parked_answer_required", taskId: match.handle } };
+        return { status: 400, body: refusalBody({ errorCode: "decide.parked_answer_required", message: "pending action is AskUserQuestion — approve requires body.answer (the operator's answers[]); deny needs none", facts: { taskId: match.handle } }) };
     }
     if (row.name === undefined) {
-        return { status: 409, body: { error: "parked row carries no agent name — the revive path requires a named agent (row damaged?)", errorCode: "decide.row_unrevivable", taskId: match.handle } };
+        return { status: 409, body: refusalBody({ errorCode: "decide.row_unrevivable", message: "parked row carries no agent name — the revive path requires a named agent (row damaged?)", facts: { taskId: match.handle } }) };
     }
     const root = row.rootSessionId;
     if (root === undefined) {
-        return { status: 409, body: { error: "this agent's row carries no root session anchor — the revive path cannot tell which session this approval belongs to (row damaged?)", errorCode: "decide.row_unrevivable", taskId: match.handle } };
+        return { status: 409, body: refusalBody({ errorCode: "decide.row_unrevivable", message: "this agent's row carries no root session anchor — the revive path cannot tell which session this approval belongs to (row damaged?)", facts: { taskId: match.handle } }) };
     }
     const faceBefore = await deps.sessionFaceOf(root);
     if (faceBefore === undefined)
@@ -214,14 +255,14 @@ export async function decideParkedAgent(deps, req, match) {
     if (!claim.ok) {
         switch (claim.reason) {
             case "store_unreachable":
-                return { status: 503, body: { error: "the durable agent store is unreachable — retry", errorCode: "decide.store_unreachable", taskId: match.handle } };
+                return { status: 503, body: refusalBody({ errorCode: "decide.store_unreachable", message: "the durable agent store is unreachable — retry", facts: { taskId: match.handle } }) };
             case "claim_lost":
-                return { status: 409, body: { error: "the parked agent is already claimed — either a concurrent decide won (re-check the pending list), or a stale claim is pending automatic cleanup (retry after the stale-claim window)", errorCode: "decide.claim_lost", taskId: match.handle } };
+                return { status: 409, body: refusalBody({ errorCode: "decide.claim_lost", message: "the parked agent is already claimed — either a concurrent decide won (re-check the pending list), or a stale claim is pending automatic cleanup (retry after the stale-claim window)", facts: { taskId: match.handle } }) };
             case "binding_broken":
             case "checkpoint_not_pending":
-                return { status: 409, body: { error: "the approval gate moved under this decide (re-parked or already settled) — re-check the pending list", errorCode: "decide.gate_moved", taskId: match.handle } };
+                return { status: 409, body: refusalBody({ errorCode: "decide.gate_moved", message: "the approval gate moved under this decide (re-parked or already settled) — re-check the pending list", facts: { taskId: match.handle } }) };
             default:
-                return { status: 409, body: { error: "the parked agent moved under this decide (stopped or already decided)", errorCode: "decide.not_parked", taskId: match.handle } };
+                return { status: 409, body: refusalBody({ errorCode: "decide.not_parked", message: "the parked agent moved under this decide (stopped or already decided)", facts: { taskId: match.handle } }) };
         }
     }
     const ticket = claim.ticket;
@@ -281,7 +322,7 @@ export async function decideParkedAgent(deps, req, match) {
         toolCallId: `drv-${ticket.claimId}`,
         ...(surface.mountsCallerTool !== undefined ? { mountsCallerTool: surface.mountsCallerTool } : {}),
         ...(deps.approverSeatFor !== undefined && seatRoot !== undefined
-            ? { onAsk: deps.approverSeatFor({ owner: decodeCheckpointScope(req.scope) ?? null, taskId: match.handle, sessionId: seatRoot }) }
+            ? { onAsk: deps.approverSeatFor({ owner: ownerOfCheckpointScope(req.scope), taskId: match.handle, sessionId: seatRoot }) }
             : {}),
         reviveClaim: {
             row: { ...ticket.row, parkClaimId: ticket.claimId },
@@ -302,12 +343,14 @@ export async function decideParkedAgent(deps, req, match) {
         const disp = await rollback("execute_threw");
         return {
             status: 500,
-            body: {
-                error: `revive failed before the resume was driven: ${e instanceof Error ? e.message : String(e)}`,
+            body: refusalBody({
                 errorCode: "decide.revive_failed",
-                taskId: match.handle,
-                rollback: disp,
-            },
+                message: `revive failed before the resume was driven: ${e instanceof Error ? e.message : String(e)}`,
+                facts: {
+                    taskId: match.handle,
+                    rollback: disp,
+                },
+            }),
         };
     }
     const isErr = typeof receipt === "object" && receipt !== null && receipt.isError === true;
@@ -319,23 +362,27 @@ export async function decideParkedAgent(deps, req, match) {
             const cause = readClosedWordSeat(receiptDetails, "cause");
             return {
                 status: 422,
-                body: {
-                    error: typeof content === "string" ? content : "the parked resume failed during startup",
+                body: refusalBody({
                     errorCode: "parked_resume.startup_failed",
-                    taskId: match.handle,
-                    rollback: disp,
-                    ...(cause !== undefined ? { cause } : {}),
-                },
+                    message: typeof content === "string" ? content : "the parked resume failed during startup",
+                    facts: {
+                        taskId: match.handle,
+                        rollback: disp,
+                        ...(cause !== undefined ? { cause } : {}),
+                    },
+                }),
             };
         }
         return {
             status: 409,
-            body: {
-                error: typeof content === "string" ? content : "revive was rejected by the delegation tool",
+            body: refusalBody({
                 errorCode: "decide.revive_rejected",
-                taskId: match.handle,
-                rollback: disp,
-            },
+                message: typeof content === "string" ? content : "revive was rejected by the delegation tool",
+                facts: {
+                    taskId: match.handle,
+                    rollback: disp,
+                },
+            }),
         };
     }
     return { status: 200, body: { taskId: match.handle, status: "resuming", decision: req.decision } };

package/dist/parked-revive-surface.d.ts

@@ -19,15 +19,22 @@
  *    这里的第 ② 条是同一条事实在交座这一处的判据(规则只写在这里,腿只负责读两次)。根删除时把子孙的 parked 卡一并作废 = S-790 件 B
  *    (`boot/session-faces.ts` 的删除协调器)。
  *  · 只对**一层**行填座(`rootSessionId` 在场且 = `parentSessionId`:派它的 run 就是根会话的 run,列表正是那个 run 的挂载)。更深的行
- *    (孙代:派它的是一个子代,它的挂载是继承裁剪后的子集,行上读不出来)不填 —— 用 boot 期那只裸 Agent、无座 = core 的 fail-closed 臂;
+ *    (孙代:派它的是一个子代,它的挂载是继承裁剪后的子集,行上读不出来)不填 —— 无座 = core 的 fail-closed 臂;
  *    行上带继承组成是 core #1112(7.32.x)的半场,到货再改读行。
  * 近似如实记:重解的列表是**部署缺省**那一份,读不回那一 run 的逐请求差异(`settings.webSearch` 后端、center overlay 场景)——
  * 座只判 bundle 实例的成员性,继承面是 `[...web, ...scaffolds]`,那两项差异不改变谁在面内。
+ *
+ * **属主来源(S-1770 / S-1808)与交座是两个独立判据**:赎回工具的停驻挂点(复活的子代再要审批时停驻,`plugins/session-store.ts`)按委派继承律定宿主行属主,
+ * 律要的是**委派树根的见证**:根 id(行上本来就带 `rootSessionId`)+ 判断那一刻读到的根行住客(赎回腿 claim 前后两读的那一位 —— 两读不是同一位时赎回腿整条拒,
+ * 走不到这里;读数缺席 ⇒ 见证不带住客,挂点那一刻根行在 ⇒ 停驻否决)。所以**每一行**都交出它({@link ScenarioContext} 的 `delegationRoot`):交座的一层行以
+ * `{ sessionId: root, delegationRoot }` 重解,不交座的行(更深的行、根住客已变的一层行、读数缺席)以 `{ delegationRoot }` 重解 —— 只喂停驻挂点,不挂任何会话级设施、
+ * 不带 principal,交座判据(上面三条)一个字不动。行上没有根 ⇒ boot 期那只裸 Agent(没有根可交 ⇒ 律给哨兵)。挂点那一刻根行已不在 ⇒ 律给哨兵;在而不是见证的那一位
+ * (批准之后删了、同 id 被重新登记)⇒ 停驻否决 —— 两件都在挂点那一侧判,与这里无关。
  */
 import { type BackgroundAgentRecord, type ToolSpec } from "@sema-agent/core";
 import type { Scenario } from "./capabilities/scenarios.js";
 import { type SessionFace } from "./session-incarnation.js";
-/** 一次赎回用的面:驱动的 Agent 工具 + (一层行时)与它同出一张列表的继承座。 */
+/** 一次赎回用的面:驱动的 Agent 工具(它的停驻挂点绑着行上的根)+ (交座时)与它同出一张列表的继承座。 */
 export interface ParkedReviveSurface {
     readonly reviveTool: ToolSpec;
     /** 缺席 = 不交座(core fail-closed:复活的子代不继承任何场景层工具)。 */

package/dist/parked-revive-surface.js

@@ -7,18 +7,21 @@ export function createParkedReviveSurface(defaultScenario) {
         return undefined;
     return (row, identity) => {
         const root = row.rootSessionId;
-        if (root === undefined || row.parentSessionId !== root)
+        if (root === undefined)
             return { reviveTool: bootTool };
-        const face = identity.root;
-        if (face === undefined || !sameSessionOccupant(face.before, face.after))
-            return { reviveTool: bootTool };
-        if ((face.before.owner ?? undefined) !== identity.principal || (face.after.owner ?? undefined) !== identity.principal)
-            return { reviveTool: bootTool };
-        const tools = defaultScenario({}, identity.principal, { sessionId: root }).tools;
+        const seated = holdsSeat(row.parentSessionId === root, identity);
+        const delegationRoot = { sessionId: root, incarnation: identity.root?.after.incarnation ?? null };
+        const tools = (seated ? defaultScenario({}, identity.principal, { sessionId: root, delegationRoot }) : defaultScenario({}, undefined, { delegationRoot })).tools;
         const reviveTool = agentOf(tools);
         if (reviveTool === undefined)
             return { reviveTool: bootTool };
-        return { reviveTool, mountsCallerTool: (t) => tools.includes(t) };
+        return seated ? { reviveTool, mountsCallerTool: (t) => tools.includes(t) } : { reviveTool };
     };
 }
+function holdsSeat(oneLevel, identity) {
+    const face = identity.root;
+    if (!oneLevel || face === undefined || !sameSessionOccupant(face.before, face.after))
+        return false;
+    return (face.before.owner ?? undefined) === identity.principal && (face.after.owner ?? undefined) === identity.principal;
+}
 //# sourceMappingURL=parked-revive-surface.js.map

package/dist/per-task-image.d.ts

@@ -4,13 +4,19 @@ import type { ImageViewer, ImageIndexEntry } from "./plugins/store-contracts.js"
 export interface SandboxImageResolver {
     latestPublished(profile: string, viewer: ImageViewer): Promise<Pick<ImageIndexEntry, "repo" | "digest" | "capabilities"> | null>;
 }
+/**
+ * 解析失败的机读码(闭集):`not_found.image` = 按调用方的约束(档案 · 本主体可见 · 已发布 · 所需能力)找不到镜像 —— 与 `POST /v1/images/select`
+ * 「没有可见的已发布镜像」同一个码(同一个事实);`request.field_invalid` = `capabilitiesNeeded` 里有不认识的能力词。状态随码,一码一状态。
+ */
+export type SandboxImageRefusalCode = "not_found.image" | "request.field_invalid";
 export type SandboxImageResolution = {
     ok: true;
     ref: string;
     capabilities?: import("./plugins/store-contracts.js").ImageCapabilities;
 } | {
     ok: false;
-    status: number;
+    status: 404 | 400;
+    errorCode: SandboxImageRefusalCode;
     message: string;
 };
 /**