@sema-agent/server 7.131.0 → 7.133.0

package/dist/boot/session-faces.d.ts

@@ -69,6 +69,7 @@ export interface SessionFacesCtx {
 export declare function createSessionFaces(ctx: SessionFacesCtx): {
     ownerAware: OwnerAwareSessionStore;
     sessionAudit: ((sessionId: string, opts?: SessionAuditReadOpts) => Promise<{
+        agent?: import("../audit.js").SessionAgent | undefined;
         owner: string | null;
         sessionId: string;
         createdAt: string;
@@ -79,13 +80,7 @@ export declare function createSessionFaces(ctx: SessionFacesCtx): {
             modelId: string;
         } | null;
         messages: unknown[];
-        promptEpoch?: {
-            epoch: number;
-            artifactDigest: string;
-            packId: string;
-            assemblyApi: number;
-            activatedBy: "session_start" | "compaction" | "legacy_migration";
-        };
+        promptEpoch?: import("@sema-agent/core").StoredPromptEpoch;
     } | undefined>) | undefined;
     sessionWatchRegistry: SessionWatchRegistry | undefined;
     purgeSession: ((sessionId: string, owner: string | null) => Promise<{

package/dist/boot/session-faces.js

@@ -1,4 +1,4 @@
-import { buildRewindHandles, buildSessionAudit, buildSessionAuditLocal, buildSessionAuditPg } from "../audit.js";
+import { buildRewindHandles, buildSessionAudit, buildSessionAuditLocal, buildSessionAuditPg, sessionAgentOf } from "../audit.js";
 import { makeDegenerateInstrument } from "../degenerate-instrument.js";
 import { PlanCacheProbe } from "../plan-cache-probe.js";
 import { purgeScratchpadDir } from "../env-facts.js";
@@ -25,7 +25,9 @@ export function createSessionFaces(ctx) {
                     : await buildSessionAuditLocal(auditLocalRoot, sessionId, handles);
             if (!audit)
                 return undefined;
-            return { ...audit, owner: (await ownerAware.ownerOf?.(sessionId)) ?? null };
+            const [owner, placement] = await Promise.all([ownerAware.ownerOf?.(sessionId), opts !== undefined ? ownerAware.placementOf?.(sessionId) : undefined]);
+            const agent = sessionAgentOf(placement);
+            return { ...audit, owner: owner ?? null, ...(agent !== undefined ? { agent } : {}) };
         }
         : undefined;
     const sessionWatchRegistry = ownerAware.getHead && ownerAware.ownerOf

package/dist/boot/stage-02-web-admin-pull.js

@@ -3,6 +3,7 @@ import { createWebAdminRuntime } from "./web-admin.js";
 import { composeExecutionLane, FILE_SOURCED_LANES } from "./execution-lane.js";
 import { serviceConfigSourceKind } from "../config-provider.js";
 import { logConfigDirMigration, migrateLocalConfigDirectory } from "../config-d-migration.js";
+import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "../model-entry-refusal.js";
 import { isRosterGateArmed } from "../config.js";
 import { judgeServedModelRoute } from "../model-route-endpoint.js";
@@ -10,8 +11,10 @@ import { servedModelTableLeg } from "../model-select.js";
 export async function runStage02(ctx) {
     const { config, localRoot, logger, metrics } = ctx;
     const configSource = serviceConfigSourceKind(config);
-    if (configSource === "local")
+    if (configSource === "local") {
+        await assertLocalConfigDirTrusted({ root: localRoot, declaredOwnerUid: config.configLocalOwnerUid });
         logConfigDirMigration(logger, await migrateLocalConfigDirectory(localRoot));
+    }
     await composeExecutionLane(config, { configSource, localRoot, logger, drivesFromFile: FILE_SOURCED_LANES });
     const webAdmin = await createWebAdminRuntime({ config, logger, metrics, localRoot });
     const servedLeg = servedModelTableLeg(config);

package/dist/boot/stage-03-store-backend.d.ts

@@ -19,7 +19,7 @@ export declare function runStage03(ctx: Awaited<ReturnType<typeof runStage02>>):
     sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
     sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
     sessionStore: import("@sema-agent/core").SessionStore;
-    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
     storePosture: import("../store-posture.js").StorePosture;
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;

package/dist/boot/stage-03-store-backend.js

@@ -2,10 +2,10 @@ import { uuidv7 } from "@sema-agent/core";
 import { openStores } from "./stores.js";
 export async function runStage03(ctx) {
     const { config, localRoot, logger, metrics } = ctx;
-    const { backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, mailboxRecipientLifecycle, memoryExportBackend, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, sqlEngineFacts, } = await openStores({ config, logger, metrics, localRoot });
+    const { backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, mailboxRecipientLifecycle, memoryExportBackend, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, sqlEngine, } = await openStores({ config, logger, metrics, localRoot });
     const instanceId = uuidv7();
     const sessionCaptureRecords = backend?.sessionCaptureRecords();
     const sessionCaptureRecordStore = sessionCaptureRecords?.();
-    return { ...ctx, backend, backgroundAgentStore, breakerState, engineDataRoot, instanceId, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memoryExportBackend, memoryPosture, memorySyncCursors, memorySyncRunner, rosterStore, sessionCaptureRecordStore, sessionCaptureRecords, sessionStore, sqlEngineFacts, storePosture, taskAttachmentStore, taskListLane, usageWindowStore };
+    return { ...ctx, backend, backgroundAgentStore, breakerState, engineDataRoot, instanceId, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memoryExportBackend, memoryPosture, memorySyncCursors, memorySyncRunner, rosterStore, sessionCaptureRecordStore, sessionCaptureRecords, sessionStore, sqlEngine, storePosture, taskAttachmentStore, taskListLane, usageWindowStore };
 }
 //# sourceMappingURL=stage-03-store-backend.js.map

package/dist/boot/stage-04-stores.d.ts

@@ -60,7 +60,7 @@ export declare function runStage04(ctx: Awaited<ReturnType<typeof runStage03>>):
     sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
     sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
     sessionStore: import("@sema-agent/core").SessionStore;
-    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
     storePosture: import("../store-posture.js").StorePosture;
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;

package/dist/boot/stage-05-execution-env.d.ts

@@ -1,6 +1,6 @@
 import type { runStage04 } from "./stage-04-stores.js";
-export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>): {
-    deploymentHooks: import("@sema-agent/core").Hooks;
+export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>): Promise<{
+    deploymentMods: readonly import("@sema-agent/core").ModRegistration<import("@sema-agent/core").EngineDollar>[];
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
@@ -75,7 +75,7 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
     sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
     sessionStore: import("@sema-agent/core").SessionStore;
-    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
     storePosture: import("../store-posture.js").StorePosture;
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;
@@ -86,5 +86,5 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;
-};
+}>;
 //# sourceMappingURL=stage-05-execution-env.d.ts.map

package/dist/boot/stage-05-execution-env.js

@@ -1,12 +1,12 @@
-import { createToolTracer, createPermissionDeniedMeter } from "../observability/tool-trace.js";
-import { composeHooks } from "../hooks/hook-runner.js";
+import { assertDeploymentModsAdmitted, createDeploymentMods } from "./deployment-mods.js";
+import { isBrandedDeployment } from "../capabilities/brand-identity.js";
 import { assertDeviceLaneWired, createDeviceLane } from "./device-lane.js";
 import { assertWorkspaceSpaceReadable, createExecutionEnv } from "./execution-env.js";
 import { incarnationReadOf } from "../session-incarnation.js";
 import * as facts from "../capability-facts.js";
 import { sessionStoreLabelOf } from "../store-posture.js";
 import { runStore } from "./late-binds.js";
-export function runStage05(ctx) {
+export async function runStage05(ctx) {
     const { backend, config, instanceId, logger, metrics, sessionStore, taskAttachmentStore } = ctx;
     const deviceLane = config.remoteExec?.provider === "device" ? createDeviceLane({ config, logger, metrics, backend, replicaId: instanceId }) : undefined;
     const incarnationOf = incarnationReadOf(sessionStore);
@@ -14,13 +14,10 @@ export function runStage05(ctx) {
     const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv, fenceSessionOwner, dropSessionScoped, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}), ...(spaceCommits !== undefined ? { spaceCommits } : {}), ...(incarnationOf !== undefined ? { incarnationOf } : {}) });
     assertDeviceLaneWired(config.remoteExec?.provider === "device", deviceLane, executionEnvFactory !== undefined);
     assertWorkspaceSpaceReadable(facts.workspaceSpace(config), { incarnationOf, spaceCommits }, facts.workspaceCache(config), sessionStoreLabelOf(config.sessionBackend, backend?.kind));
-    const toolTracer = config.toolTrace ? createToolTracer(logger) : undefined;
-    if (toolTracer)
+    const deploymentMods = createDeploymentMods({ metrics, ...(config.toolTrace ? { traceLogger: logger } : {}), brandIdentity: isBrandedDeployment(config) });
+    if (config.toolTrace)
         logger.info("tool_trace_enabled", {});
-    const deploymentHooks = {
-        ...(toolTracer ? composeHooks(createPermissionDeniedMeter(metrics), toolTracer) : createPermissionDeniedMeter(metrics)),
-        ...(config.hooksTimeoutMs !== undefined ? { timeoutMs: config.hooksTimeoutMs } : {}),
-    };
-    return { ...ctx, deploymentHooks, deviceLane, dropSessionScoped, executionEnvFactory, fenceSessionOwner, lspManager, spaceReclaimer, perSessionCwd, perTaskImage, sendUserFileTaskEnvs, sessionEnvSelection, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, worktreeReap };
+    await assertDeploymentModsAdmitted(deploymentMods);
+    return { ...ctx, deploymentMods, deviceLane, dropSessionScoped, executionEnvFactory, fenceSessionOwner, lspManager, spaceReclaimer, perSessionCwd, perTaskImage, sendUserFileTaskEnvs, sessionEnvSelection, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, worktreeReap };
 }
 //# sourceMappingURL=stage-05-execution-env.js.map

package/dist/boot/stage-06-runners.d.ts

@@ -51,6 +51,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     workflowCompletionInbox: import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox | undefined;
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
+    workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -60,7 +61,8 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     };
     workflowRunStore: import("../orchestration/workflow-notify-journal.js").JournalingWorkflowRunStore | undefined;
     workflowsCapable: boolean;
-    deploymentHooks: import("@sema-agent/core").Hooks;
+    orgDeliveryGate: import("@sema-agent/core").OrgDeliveryGate | undefined;
+    deploymentMods: readonly import("@sema-agent/core").ModRegistration<import("@sema-agent/core").EngineDollar>[];
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
@@ -135,7 +137,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
     sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
     sessionStore: import("@sema-agent/core").SessionStore;
-    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
     storePosture: import("../store-posture.js").StorePosture;
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;

package/dist/boot/stage-06-runners.js

@@ -4,8 +4,10 @@ import { createSessionTitler } from "../session-titler.js";
 import { cardRuleScopeRoot } from "../task-cwd.js";
 import { ForkRoutingSessionStore } from "../plugins/fork-routing-session-store.js";
 import { withoutHands } from "../capabilities/hands-lane.js";
+import { isBrandedDeployment } from "../capabilities/brand-identity.js";
 import { redactSecrets } from "../trace/redact.js";
 import { hasServiceAuth } from "../http/server.js";
+import { operatorRosterPresent } from "../http/principal-gate.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
 import { createHookLlm, buildHookFailureText } from "../hooks/hook-llm.js";
 import { assertRetentionLaneWirable } from "./retention-lane.js";
@@ -20,11 +22,12 @@ import { defaultEngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { createOrgMemoryAdmissionWiring } from "./org-memory.js";
 import { createGovernanceSeams } from "./governance-seams.js";
 import { createSharedMemoryScopeAuthorizer } from "../shared-memory-scope-authorizer.js";
+import { mountOrgDeliveryGate } from "./org-delivery.js";
 import { parkedAskRedeem, runStore } from "./late-binds.js";
 import { withInternalRunEnvs } from "../internal-run-env.js";
 export function runStage06(ctx) {
-    const { backend, backgroundAgentStore, brain, engineDataRoot, config, webAdmin, consolidationValve, deploymentHooks, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecordStore, sessionCaptureRecords, sessionPolicyStore, sessionStore, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
-    const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
+    const { backend, backgroundAgentStore, brain, engineDataRoot, config, webAdmin, consolidationValve, deploymentMods, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecordStore, sessionCaptureRecords, sessionPolicyStore, sessionStore, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
+    const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, workflowParkDecisions, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
     const parkCommitted = backend?.checkpoint && config.durableApproval ? createParkCommitWatch(backend.checkpoint(logger)) : undefined;
     const checkpointStore = parkCommitted?.store;
     const parkCommits = parkCommitted?.watch;
@@ -45,7 +48,7 @@ export function runStage06(ctx) {
     if (sharedMemoryStore)
         logger.info("shared_memory_stores_enabled", { backend: backend?.kind });
     const runnerOffloadStore = toolResultStore ?? new InMemoryToolResultStore({ maxTotalChars: 64_000_000 });
-    const commitHands = config.configProvider === "local" ? { commitCoAuthor: "Sema <noreply@vivi-ai.com>" } : undefined;
+    const commitHands = isBrandedDeployment(config) ? { commitCoAuthor: "Sema <noreply@vivi-ai.com>" } : undefined;
     const retentionExecutor = backend?.retention?.({ taskAttachmentTable: taskAttachmentStore !== undefined, taskListTables: taskListLane.backend !== "memory", logger });
     const retentionLaneStore = backend?.retentionLane?.();
     assertRetentionLaneWirable({
@@ -82,7 +85,7 @@ export function runStage06(ctx) {
         : undefined;
     for (const w of buildConsolidationValveAudit({
         valve: consolidationValve,
-        operatorPrincipals: config.operatorPrincipals,
+        operatorRosterPresent: operatorRosterPresent(config),
         hasServiceAuth: hasServiceAuth(config),
         allowUnauthedWrites: config.allowUnauthedWrites ?? false,
     }).warnings) {
@@ -120,12 +123,13 @@ export function runStage06(ctx) {
         sessionCaptureRecords,
         memorySyncRunner, toolResultStore: runnerOffloadStore, checkpointStore, sessionPolicyStore, runtimeCapsResolver, fileHistoryStore,
         permissionRuleStore: permissionRuleProvider,
-        executionEnvFactory, lspManager, fleetBus, deploymentHooks, workflowRunStore, workflowJournalStore,
+        executionEnvFactory, lspManager, fleetBus, deploymentMods, workflowRunStore, workflowJournalStore,
         workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, orgMemoryAdmission,
         governanceSeams,
         sharedMemoryStores: sharedMemoryStore ? sharedMemoryStore : undefined,
         getRunStore: () => runStore,
     });
+    const orgDeliveryGate = mountOrgDeliveryGate({ runnerDeps, directory: orgMemoryAdmission.directory, mailboxStore, backend, logger });
     const runner = new Runner(runnerDeps);
     const handslessRunner = new Runner(withoutHands(runnerDeps));
     const { hookModelFor, hookLlm } = createHookLlm({ config, getKeyResolver: () => webAdmin.getKeyResolver(), metrics });
@@ -192,7 +196,7 @@ export function runStage06(ctx) {
             backgroundAgentStore,
             mailboxStore,
             rosterStore,
-            deploymentHooks,
+            deploymentMods,
             toolResultStore: runnerOffloadStore,
             checkpointStore,
             sessionPolicyStore,
@@ -209,6 +213,6 @@ export function runStage06(ctx) {
         onError: runnerDeps.onError ? runnerDeps.onError : undefined,
     };
     const subRunner = new Runner(subRunnerDeps);
-    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable };
+    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowParkDecisions, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate };
 }
 //# sourceMappingURL=stage-06-runners.js.map

package/dist/boot/stage-07-capability-layer.d.ts

@@ -66,6 +66,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     workflowCompletionInbox: import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox | undefined;
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
+    workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -75,7 +76,8 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     };
     workflowRunStore: import("../orchestration/workflow-notify-journal.js").JournalingWorkflowRunStore | undefined;
     workflowsCapable: boolean;
-    deploymentHooks: import("@sema-agent/core").Hooks;
+    orgDeliveryGate: import("@sema-agent/core").OrgDeliveryGate | undefined;
+    deploymentMods: readonly import("@sema-agent/core").ModRegistration<import("@sema-agent/core").EngineDollar>[];
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
@@ -150,7 +152,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
     sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
     sessionStore: import("@sema-agent/core").SessionStore;
-    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
     storePosture: import("../store-posture.js").StorePosture;
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;

package/dist/boot/stage-07-capability-layer.js

@@ -7,12 +7,14 @@ import { ensureChildSessionDurableWithPromotion } from "../plugins/session-store
 import { webSearchConfigFromEnv, createWebSearchBackend, shouldProbeWebSearchOnBoot } from "../plugins/web-search.js";
 import { createAuthorizer } from "../security.js";
 import { buildForceDurableGateInertNotice, buildNoResponderBootWarns, gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
-import { executionLaneOf } from "../execution-lane-caps.js";
+import { executionLaneOf, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { loadDeploymentSkills } from "../capabilities/skills.js";
 import { createRepoClient } from "../capabilities/repo-tools.js";
 import { buildScenarios, builtinScenarioDetails, danglingScenarioRefusal } from "../capabilities/scenarios.js";
+import { isBrandedDeployment } from "../capabilities/brand-identity.js";
 import { RateLimiter } from "../observability/rate-limit.js";
 import { explicitOperatorOk } from "../http/server.js";
+import { buildOperatorUndeclaredNotice } from "../http/principal-gate.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { reclaimOrphansAtBoot } from "../boot-reclaim.js";
@@ -55,6 +57,18 @@ export async function runStage07(ctx) {
         throw new Error(gateRefusal);
     await reclaimOrphansAtBoot(runStore, checkpointStore, logger);
     await runBootCrashConvergence({ backend, runStore, liveAudit: approvalAskAudit, localDataRoot: config.localDataRoot, logger });
+    const adoption = await toolApproval?.adoptOpenAsks();
+    if (adoption !== undefined && (adoption.capped || adoption.cardUnreadable > 0)) {
+        logger.warn("approval_ask_adopted_partially", {
+            adopted: adoption.adopted,
+            cardUnreadable: adoption.cardUnreadable,
+            capped: adoption.capped,
+            note: "some approval asks still pending in the ask ledger were not taken into this replica's live list: unreadable card envelopes are skipped, and only the oldest pending rows up to the adoption cap are taken. The skipped asks stay answerable through POST /v1/tasks/:taskId/asks/:askId/decision and are expired by the reconciler on their own window.",
+        });
+    }
+    else if (adoption !== undefined && adoption.adopted > 0) {
+        logger.info("approval_ask_adopted", { adopted: adoption.adopted, alreadyLive: adoption.alreadyLive });
+    }
     const userInputLedgerStore = backend && runStore ? backend.userInputLedger() : undefined;
     const userInputLedger = backend && runStore && userInputLedgerStore
         ? await (async () => {
@@ -74,7 +88,7 @@ export async function runStage07(ctx) {
         ? selectEnvironmentTool({
             catalog: imageIndex,
             selection: sessionEnvSelection,
-            viewerFor: (principal) => ({ operator: explicitOperatorOk(principal, config.operatorPrincipals), tenantId: principal ?? null }),
+            viewerFor: (principal) => ({ operator: explicitOperatorOk(principal, config), tenantId: principal ?? null }),
         })
         : undefined;
     const imageBakes = backend?.imageBake && config.imageBakes.enabled ? backend.imageBake() : undefined;
@@ -82,6 +96,11 @@ export async function runStage07(ctx) {
         logger.info("image_bakes_enabled", { operators: config.operatorPrincipals.length, runner: config.imageBakes.runnerPrincipal });
     if (durableEnabled)
         logger.info("durable_approval_enabled", { toolApprovalGate: config.approvalRequire.length });
+    {
+        const undeclared = buildOperatorUndeclaredNotice(config, durableEnabled);
+        if (undeclared)
+            logger.warn(undeclared.event, undeclared.fields);
+    }
     if (config.a2aServe) {
         const peer = facts.a2aServe({ config, runStore });
         if (peer.available) {
@@ -133,7 +152,7 @@ export async function runStage07(ctx) {
         ? backend.rateLimiter(config.rateLimitPerMin, counterDegradeHook).startRefresh()
         : new RateLimiter(config.rateLimitPerMin);
     bindRateLimiter(rateLimiter);
-    let skills = loadDeploymentSkills(config);
+    let skills = loadDeploymentSkills(config, logger);
     skills = await webAdmin.applyCenterCapabilities(skills);
     const repoClient = config.gitApiBaseUrl ? createRepoClient(config.gitApiKind, config.gitApiBaseUrl, config.gitApiToken) : undefined;
     const webSearchCfg = webSearchConfigFromEnv();
@@ -150,16 +169,18 @@ export async function runStage07(ctx) {
         })
             .catch((e) => logger.warn("web_search_probe_failed", { provider: webSearchCfg.provider, error: e instanceof Error ? e.message : String(e) }));
     }
-    const ensureChildSessionDurable = checkpointStore && config.sessionBackend === "tidb" ? (sessionId) => ensureChildSessionDurableWithPromotion(sessionStore, subRunnerSessions, sessionId) : undefined;
+    const ensureChildSessionDurable = checkpointStore && config.sessionBackend === "tidb"
+        ? (sessionId, root) => ensureChildSessionDurableWithPromotion(sessionStore, subRunnerSessions, sessionId, root, logger)
+        : undefined;
     const webFetchSummarize = createWebFetchSummarizeLane({ brain, config, getKeyResolver: () => webAdmin.getKeyResolver(), logger });
     const scenarioDeps = {
         runner, subRunner, model: DEFAULT_MODEL_REF, skills, repoClient, requirePrincipal: config.requirePrincipal,
+        handsLane: laneWiresExecutionEnv(executionLaneOf(config.remoteExec?.provider)),
         webSearch: webSearch ? webSearch : undefined, logger, webFetchSummarize,
         backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
         checkpointStore: checkpointStore ? checkpointStore : undefined,
         ensureChildSessionDurable: ensureChildSessionDurable ? ensureChildSessionDurable : undefined,
         taskListStoreFor: taskListLane.storeFor,
-        brandIdentity: config.configProvider === "local",
         subagentExtraTools: sendUserFileToolSpec ? subagentSendUserFileExtraTools({ spec: sendUserFileToolSpec }) : undefined,
     };
     const scenarios = buildScenarios(scenarioDeps);
@@ -174,7 +195,7 @@ export async function runStage07(ctx) {
             autoModeSeatMounted: runnerDeps.autoMode !== undefined,
         })
         : undefined;
-    const scenarioDetails = builtinScenarioDetails(scenarios, scenarioDeps);
+    const scenarioDetails = builtinScenarioDetails(scenarios, scenarioDeps, isBrandedDeployment(config));
     const builtinScenarioNames = Object.keys(scenarioDetails);
     webAdmin.applyCenterScenarios({ scenarioDeps, scenarios, scenarioDetails, builtinScenarioNames });
     const defaultScenarioRefusal = danglingScenarioRefusal(config.defaultScenario, "deployment", Object.keys(scenarios));

package/dist/boot/stage-08-reapers.d.ts

@@ -79,6 +79,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     workflowCompletionInbox: import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox | undefined;
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
+    workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -88,7 +89,8 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     };
     workflowRunStore: import("../orchestration/workflow-notify-journal.js").JournalingWorkflowRunStore | undefined;
     workflowsCapable: boolean;
-    deploymentHooks: import("@sema-agent/core").Hooks;
+    orgDeliveryGate: import("@sema-agent/core").OrgDeliveryGate | undefined;
+    deploymentMods: readonly import("@sema-agent/core").ModRegistration<import("@sema-agent/core").EngineDollar>[];
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
@@ -163,7 +165,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
     sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
     sessionStore: import("@sema-agent/core").SessionStore;
-    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
     storePosture: import("../store-posture.js").StorePosture;
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;

package/dist/boot/stage-08-reapers.js

@@ -5,12 +5,12 @@ import { startRetentionLane, RETENTION_LEASE_TTL_FACTOR } from "./retention-lane
 import { createLimitSync } from "./limit-sync.js";
 import { runDenySweep } from "./late-binds.js";
 export function runStage08(ctx) {
-    const { approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, spaceReclaimer, handslessRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, userInputLedger, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
+    const { approvalAskAudit, approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, spaceReclaimer, handslessRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, userInputLedger, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
     const reaper = startReapers({
         config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits,
         rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap,
         workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore,
-        backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, userInputLedger,
+        backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, userInputLedger, approvalAskAudit,
         getRunDenySweep: () => runDenySweep,
     });
     const ttlMs = config.retentionSweep.intervalSec * 1000 * RETENTION_LEASE_TTL_FACTOR;

package/dist/boot/stage-09-leader.d.ts

@@ -18,6 +18,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     }>) | undefined;
     webAdminJwtVerifier: import("../auth-bridge.js").WebAdminJwtVerifier | undefined;
     sessionAudit: ((sessionId: string, opts?: import("../audit.js").SessionAuditReadOpts) => Promise<{
+        agent?: import("../audit.js").SessionAgent | undefined;
         owner: string | null;
         sessionId: string;
         createdAt: string;
@@ -28,13 +29,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
             modelId: string;
         } | null;
         messages: unknown[];
-        promptEpoch?: {
-            epoch: number;
-            artifactDigest: string;
-            packId: string;
-            assemblyApi: number;
-            activatedBy: "session_start" | "compaction" | "legacy_migration";
-        };
+        promptEpoch?: import("@sema-agent/core").StoredPromptEpoch;
     } | undefined>) | undefined;
     sessionWatchRegistry: import("../session-watch.js").SessionWatchRegistry | undefined;
     staticWiring: import("@sema-agent/core").WiringManifest;
@@ -108,6 +103,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     workflowCompletionInbox: import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox | undefined;
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
+    workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -117,7 +113,8 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     };
     workflowRunStore: import("../orchestration/workflow-notify-journal.js").JournalingWorkflowRunStore | undefined;
     workflowsCapable: boolean;
-    deploymentHooks: import("@sema-agent/core").Hooks;
+    orgDeliveryGate: import("@sema-agent/core").OrgDeliveryGate | undefined;
+    deploymentMods: readonly import("@sema-agent/core").ModRegistration<import("@sema-agent/core").EngineDollar>[];
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
@@ -192,7 +189,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
     sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
     sessionStore: import("@sema-agent/core").SessionStore;
-    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
     storePosture: import("../store-posture.js").StorePosture;
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;

package/dist/boot/stage-10-http-server.d.ts

@@ -17,6 +17,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     }>) | undefined;
     webAdminJwtVerifier: import("../auth-bridge.js").WebAdminJwtVerifier | undefined;
     sessionAudit: ((sessionId: string, opts?: import("../audit.js").SessionAuditReadOpts) => Promise<{
+        agent?: import("../audit.js").SessionAgent | undefined;
         owner: string | null;
         sessionId: string;
         createdAt: string;
@@ -27,13 +28,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
             modelId: string;
         } | null;
         messages: unknown[];
-        promptEpoch?: {
-            epoch: number;
-            artifactDigest: string;
-            packId: string;
-            assemblyApi: number;
-            activatedBy: "session_start" | "compaction" | "legacy_migration";
-        };
+        promptEpoch?: import("@sema-agent/core").StoredPromptEpoch;
     } | undefined>) | undefined;
     sessionWatchRegistry: import("../session-watch.js").SessionWatchRegistry | undefined;
     staticWiring: import("@sema-agent/core").WiringManifest;
@@ -107,6 +102,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     workflowCompletionInbox: import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox | undefined;
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
+    workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -116,7 +112,8 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     };
     workflowRunStore: import("../orchestration/workflow-notify-journal.js").JournalingWorkflowRunStore | undefined;
     workflowsCapable: boolean;
-    deploymentHooks: import("@sema-agent/core").Hooks;
+    orgDeliveryGate: import("@sema-agent/core").OrgDeliveryGate | undefined;
+    deploymentMods: readonly import("@sema-agent/core").ModRegistration<import("@sema-agent/core").EngineDollar>[];
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
@@ -191,7 +188,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
     sessionCaptureRecords: import("../plugins/store-backend.js").SessionCaptureRecordSource | undefined;
     sessionStore: import("@sema-agent/core").SessionStore;
-    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
     storePosture: import("../store-posture.js").StorePosture;
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;

package/dist/boot/stage-10-http-server.js

@@ -9,7 +9,6 @@ import { createHttpServer } from "../http/server.js";
 import { exportMemoryScope } from "../memory-export.js";
 import { performMemorySync } from "../memory-sync.js";
 import { backgroundAgentOutput, taskHandleOutput, taskHandleStop } from "../runs.js";
-import { SQL_BLOB_DEFAULT_MAX_BYTES } from "../plugins/blob-backend.js";
 import { createStoreLiveProbe } from "../store-live-probe.js";
 import { counterStoreLabel } from "../plugins/store-backend.js";
 import { sessionStoreLabelOf } from "../store-posture.js";
@@ -30,7 +29,7 @@ import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export async function runStage10(ctx) {
-    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, parkCommits, config, webAdmin, consolidationValve, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
+    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, parkCommits, config, webAdmin, consolidationValve, costQuota, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
     const stores = {
         runStore,
         resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
@@ -47,6 +46,7 @@ export async function runStage10(ctx) {
         peerDirectory: runnerDeps.peerDirectory,
         workflowRunStore: workflowRunStore ? workflowRunStore : undefined,
         workflowAgentSessionIndex: workflowAgentSessionIndex ? workflowAgentSessionIndex : undefined,
+        workflowParkDecisions: workflowParkDecisions ? workflowParkDecisions : undefined,
         workflowJournalStore: workflowJournalStore ? workflowJournalStore : undefined,
         imageIndex,
         imageBakes,
@@ -99,6 +99,7 @@ export async function runStage10(ctx) {
         memoryConsolidation: memoryConsolidationFaces,
         memoryOptOutGrant: memoryOptOutGrantStore,
         orgMemoryDirectory: orgMemoryAdmission.directory,
+        orgDeliveryGate,
         sharedMemoryStore: sharedMemoryStore ? sharedMemoryStore : undefined,
         sessionMirrorRuling: principalCaps
             ? async (p) => (await principalCaps.executionRuling(p))?.sessionMirror
@@ -162,7 +163,7 @@ export async function runStage10(ctx) {
         workflowModelAllowlist: workflowModelAllowlistSnapshot,
         staticWiring,
         memoryPosture,
-        sqlEngineFacts,
+        sqlEngine,
         writeProtection: buildWriteProtectionPosture(config),
         webSearchProvider,
         sealedKeyPublic: webAdmin.sealedKeyPublic,
@@ -177,6 +178,7 @@ export async function runStage10(ctx) {
         restartState: () => webAdmin.restartState(),
         configApplyState: () => webAdmin.configApplyState(),
         centerCredentialState: () => webAdmin.centerCredentialState(),
+        centerIdentityNoticeState: () => webAdmin.centerIdentityNoticeState(),
         modelRefusalsState: () => webAdmin.modelRefusalsState(),
         candidateRejectionState: () => webAdmin.candidateRejectionState(),
         configHandoffState: () => webAdmin.configHandoffState(),
@@ -191,19 +193,15 @@ export async function runStage10(ctx) {
         storeLiveState: storeLiveProbe ? () => storeLiveProbe.state() : undefined,
     };
     const knobs = {
-        snapshotBlobSqlCapBytes: backend && backend.kind !== "local" && !config.snapshotBlobStore
-            ? (config.snapshotBlobSqlMaxBytes ?? (backend.kind === "mysql" ? SQL_BLOB_DEFAULT_MAX_BYTES : undefined))
-            : undefined,
         sessionEventsMaxConnections: sessionWatchRegistry ? posIntEnv(process.env.SESSION_EVENTS_MAX_CONNS, 256, 100_000) : undefined,
     };
     const resolveSpec = createResolveSpec({
         config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver,
-        getCenterPrompts: () => webAdmin.getCenterPrompts(),
         getKeyResolver: () => webAdmin.getKeyResolver(),
         taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner,
         hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec,
-        selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore,
-        checkpointStore, deploymentHooks, imageIndex, perTaskImage,
+        selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore,
+        checkpointStore, imageIndex, perTaskImage,
         sessionEnvSelection,
         lockedKeys: governanceSeams.lockedKeys,
         liveQuestionFace: question,