@sema-agent/server 7.132.0 → 7.133.0

package/dist/http/route-ctx.d.ts

@@ -16,6 +16,8 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { HostDecision } from "../host-decision.js";
+import type { EntryProblem } from "../entry-problems.js";
+import type { SessionOwnerCell } from "../security.js";
 import type { TaskStream, TaskSpec, TaskResult, QuestionAnswer, Checkpoint, CheckpointToken, ResumeOutcome, RunInternals, Runner, EngineNotice } from "@sema-agent/core";
 import type { FlatServiceDeps, RequestAuth } from "./server.js";
 import type { TaskRequestBody, DecideBinding } from "./wire-types.js";
@@ -75,8 +77,9 @@ export interface RouteHelpers {
     /** run 面的属主门(谓词 `runOwnerReadable`;非属主 ⇒ 404 `not_found.run` + 长文,与 run 读口的 unknown 臂同码同串,[ref])。 */
     runOwnerOk(req: IncomingMessage, res: ServerResponse, owner: string | null): boolean;
     /** 会话面的属主门(谓词 `sessionOwnerReadable`,S-1452:没有身份边界的部署不钉人,与会话列表同读;非属主 ⇒ 404 `not_found.session` +
-     *  {@link SESSION_NOT_FOUND_MESSAGE},与会话读口的 unknown 臂同码同串 —— G52 [ref] / S-989)。每一个按会话寻址的属主判都走它。 */
-    sessionOwnerOk(req: IncomingMessage, res: ServerResponse, owner: string | null): boolean;
+     *  {@link SESSION_NOT_FOUND_MESSAGE},与会话读口的 unknown 臂同码同串 —— G52 [ref] / S-989)。每一个按会话寻址的属主判都走它。
+     *  `cell` = 调用点经 `security.ts` 的 `sessionOwnerCellOf` 读出的那一格(S-1770:无主的委派子代 placed 行只对 fleet 调用方放行,判据 `ownerlessRowOpen`)。 */
+    sessionOwnerOk(req: IncomingMessage, res: ServerResponse, cell: SessionOwnerCell): boolean;
     sessionOwnerScope(req: IncomingMessage): {
         fleetWide: boolean;
         gateOwner: string | null;
@@ -132,6 +135,12 @@ export interface PreparedTaskSubmission {
      *  装配跑在这条腿的通告口开张之前,所以铸点交不出去 —— 由腿在 `registerEngineNoticeLeg` 那一拍
      *  经 `pending` 一起投(投递单点仍是那一只注册助手,不新开第二条机制)。缺席 = 本次装配没铸下任何通告。 */
     engineNotices?: readonly EngineNotice[];
+    /**
+     * 受理时对**放行侧选择器清单**(根 `allowTools`、子代定义的 `allowTools`)的告知(`rule-entry-list.ts` 的 `allowSelectorWarningsOf`):受理了、没拒,但这几条条目什么也不放
+     * (引擎读不出,或名字不在名册)。三条提交腿在各自的受理应答里原样带成 `warnings`(同步腿 200 体 · 流式腿 `meta` 帧 · 异步腿 202 回执);缺席 = 没有话说。
+     * 判的是**这一次提交**的体:幂等重放从 run 记录答,不重判、不带。
+     */
+    warnings?: readonly EntryProblem[];
     /**
      * S-470(device lane 首绑写协议,design §4.3.2 两阶段 placement)—— **已校验、未写库**的 placement 意图。
      *
@@ -191,6 +200,28 @@ export interface CheckpointCtx {
      */
     writerVersion?: string;
 }
+/**
+ * `/decide` 第三条车道交给宿主投递腿(wake:`DriveResumeArgs` / fresh:`DurableRunLegArgs`)的**一件**:这一跑在内存里带着的决定,
+ * 与开跑之前落行的那一笔。两位只能一起给 —— 型上拆不开:送出一条决定的那一跑,开跑之前一定已经把它落成行(律的属主 =
+ * `orchestration/workflow-park-decision.ts` 文件头「先落行、后开跑」)。
+ * 🔴 **TRUSTED**:绝不是 `TaskSpec` 字段、也绝不是工具参数(模型不能决定一次审批)。
+ */
+export interface WorkflowDecisionDelivery {
+    /**
+     * 这一跑在内存里带着的那条决定(`RunInternals.workflowParkedResume` 的元素形,直接取 core 的那一位 —— 手抄一份结构等价的字面会让更宽的
+     * `token: string` 悄悄通过)。为什么要随腿带:起跑读者(`parked-decide.ts` 的 `heldWorkflowParkDecisions`)在落行**之前**读行(wake 腿的
+     * internals 在引擎的 pre-CAS 守卫之前就交进去了),读不到这一笔;读者把两者按 token 合并,同一张卡以它为准(与随后落的是同一条)。
+     */
+    readonly carried: NonNullable<RunInternals["workflowParkedResume"]>;
+    /**
+     * 落行:宿主会话的认领在手、这一跑再没有任何会变成拒绝的判定之后、**开跑之前**调一次,`taskId` = 这一跑(行上的 `deliveredTaskId`)。
+     * wake 腿挂在引擎的 `afterCheckpointResolve` 座(resolve CAS 赢下之后、续跑那一腿开跑之前);fresh 腿在建行、落点、续跑输入之后、起跑之前。
+     * 写在决定店所绑 run 店的认领栅栏里:`taskId` 那一拍已不持有宿主会话的认领(被收割 / 已归别人)⇒ 不写、抛。担保止于栅栏那一拍 —— 写提交之后
+     * 这一跑才失去认领(提交确认迟到 / 进程停顿),它照样开跑、带着这一份(引擎 checkpoint 先 resolve 者赢;店头注「不承诺的半句」)。
+     * 抛 ⇒ 这一跑不开、认领放掉、响亮 500(wake:引擎把抛原样带出 `resumeStream`,普通异常臂终结合成行;fresh:`releaseClaimedRun` 撤行)。
+     */
+    readonly commitBeforeLaunch: (taskId: string) => Promise<void>;
+}
 /** B4①(命名化):`driveResumeIntoRunLog` 的入参形(resume 家族共用)——原为 9 成员内联匿名对象。 */
 export interface DriveResumeArgs {
     token: CheckpointToken;
@@ -265,27 +296,8 @@ export interface DriveResumeArgs {
     mintFreshRun?: {
         source: string;
     };
-    /**
-     * S-185 车CM —— **workflow 出身 park 的决定**,随本次续跑走 core 的可信 run 通道
-     * (`RunInternals.workflowParkedResume`)。
-     *
-     * 为什么是这里、为什么是这个形:core 给部署方留的**唯一**通道就是它(d.ts 逐字:「A host that decided a
-     * workflow child's parked checkpoint **launches the run that re-invokes** `Workflow({resumeFromRunId})`
-     * with the decision here」)。宿主这一跑的模型再调一次 `Workflow({resumeFromRunId})` 时,工具的
-     * `parkedResume` dep 只挑出 `runId` 命中这次 resume 源的条目,交给 `RunWorkflowOptions.parkedResume`,
-     * 于是那个 parked ordinal 带着人的决定继续,而不是再 park 一次。
-     *
-     * 🔴 **TRUSTED**:它绝不是 `TaskSpec` 字段、也绝不是工具参数(模型不能决定一次审批)。唯一的铸点是
-     * `/decide` 的第三条车道(判据属主 = `parked-decide.ts` 的 `planWorkflowParkedDecide` 顶注)。
-     * 缺席 ⇒ 本位对这条腿是完整 no-op,与本批之前逐字相同。
-     *
-     * 🔴 **形不手抄:直接是 core 的那一位**(`NonNullable<RunInternals["workflowParkedResume"]>`)。手抄一份
-     * 结构等价的字面(本位 7.73.0 及以前就是)会让 `token: string` / `inheritedGate: unknown` 这种**更宽**的
-     * 形悄悄通过,再靠下游一个 `as NonNullable<RunInternals[...]>` 把它洗进 core 的 branded 位 —— 那个转型
-     * 正是「边界必 schema、禁自铸」要挡的东西(裸 string 当赎回键传进去,编译期一个字都不响)。派生之后
-     * core 改这一位(本版就把 `WorkflowParkedResume.outcome` 改成了可选)在本仓是**编译事件**,不是靠人去
-     * 对表的一行注。 */
-    workflowParkedResume?: NonNullable<RunInternals["workflowParkedResume"]>;
+    /** `/decide` 第三条车道交给本腿的那一件决定投递(语义属主 = {@link WorkflowDecisionDelivery} 顶注)。缺席 ⇒ 只摊决定行(其余四条 resume 腿恒缺席)。 */
+    workflowDecision?: WorkflowDecisionDelivery;
     /** [ref]([ref] Inkglow 案 → [ref]① 定谳):**200 受理语义**——调用方声明「我的消费方按 poll/SSE 跟
      *  终态,别让 HTTP 等模型往返」。在场为 `true` 时本腿在**受理点**(`resumeStream` 解析之后)立刻把
      *  `200 {taskId, status:"resuming", bindingEnforced:true}` 交回调用方,模型腿(流迭代 + 行驱动)继续
@@ -435,11 +447,9 @@ export interface RouteLegs {
     /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/wake` 腿传 `true`
      *  —— 本腿走 `mintFreshRun`,受理体里的 `taskId` 因此是**新铸的**那个(壳的 poll 锚)。 */
     acceptEarly?: boolean, 
-    /** S-185 车CM:透传给 {@link DriveResumeArgs.workflowParkedResume}(语义与 TRUSTED 纪律的属主在那条
-     *  顶注)。HTTP `/wake` 腿**不设**此位 —— 它是 `/decide` 第三条车道的专用席,而两条腿共用这一条驱动
-     *  路径正是 `notify-wake.ts` 那条「wake 会烧模型,所以复用 resume 家族的同一条腿、不自建第二条驱动
-     *  路径」的成文纪律。 */
-    workflowParkedResume?: DriveResumeArgs["workflowParkedResume"]): Promise<HostLegOutcome>;
+    /** 透传给 {@link DriveResumeArgs.workflowDecision}。HTTP `/wake` 腿**不设**此位 —— 它是 `/decide` 第三条车道投递腿的专用席,
+     *  而两条腿共用这一条驱动路径正是 `notify-wake.ts` 那条「wake 会烧模型,所以复用 resume 家族的同一条腿」的成文纪律。 */
+    workflowDecision?: WorkflowDecisionDelivery): Promise<HostLegOutcome>;
     /**
      * assistant plan_review 三态腿的**纯读段**(S-609,7.97.0):选卡 → 属主轻读 → 载入 → 行级 scope → 门类 → 这条决断
      * 唯一的一次 ctx 读。任何一步拒 ⇒ `{ok:false, answer}`(不改任何状态;端点在消费一次性 nonce **之前**把它答出去);
@@ -722,6 +732,12 @@ export declare function acceptedResumingReceipt(taskId: string, sessionId: strin
     status: number;
     body: object;
 };
+/** 一条腿的结局是不是一张「已受理」回执,是 ⇒ 回执上那一跑的 `taskId`(同一张回执的读法与 {@link acceptedResumingReceipt} 住在一起;
+ *  `/decide` 的 workflow 车道据它把投递那一跑记在决定行上)。 */
+export declare function acceptedTaskIdOf(out: {
+    status: number;
+    body: object;
+}): string | undefined;
 export declare const RUN_NOT_FOUND_MESSAGE = "run not found \u2014 the id belongs to no run in this deployment's run store (a run from another server process, or an in-memory store that did not survive a restart, is not visible here)";
 /**
  * 会话资源面 404 的**唯一一句**(与 {@link RUN_NOT_FOUND_MESSAGE} 同一冻结纪律,常量锚在 `test/api-error-text-freeze.test.ts`)。

package/dist/http/route-ctx.js

@@ -27,6 +27,10 @@ export function buildHostLegOutcome(out) {
 export function acceptedResumingReceipt(taskId, sessionId) {
     return { status: 200, body: { taskId, sessionId, status: "resuming", bindingEnforced: true } };
 }
+export function acceptedTaskIdOf(out) {
+    const body = out.body;
+    return out.status === 200 && "taskId" in body && typeof body.taskId === "string" && body.taskId !== "" ? body.taskId : undefined;
+}
 export const RUN_NOT_FOUND_MESSAGE = "run not found — the id belongs to no run in this deployment's run store (a run from another server process, or an in-memory store that did not survive a restart, is not visible here)";
 export const SESSION_NOT_FOUND_MESSAGE = "session not found";
 export function runNotFoundMessage(id) {

package/dist/http/route-table.js

@@ -14,6 +14,7 @@ import { handleMemoryCompliance, MEMORY_COMPLIANCE_ROUTES } from "./routes/memor
 import { handleMemoryOrigin, MEMORY_ORIGIN_ROUTES } from "./routes/memory-origin.js";
 import { handleMemoryConsolidation, MEMORY_CONSOLIDATION_ROUTES } from "./routes/memory-consolidation.js";
 import { handleSharedMemory, SHARED_MEMORY_ROUTES } from "./routes/shared-memory.js";
+import { handlePrincipalInbox, PRINCIPAL_INBOX_ROUTES } from "./routes/principal-inbox.js";
 import { handleRules, RULES_ROUTES } from "./routes/rules.js";
 import { handleSessionsList, SESSIONS_LIST_ROUTES } from "./routes/sessions-list.js";
 import { handleAgentRoster, AGENT_ROSTER_ROUTES } from "./routes/agents-roster.js";
@@ -71,6 +72,7 @@ export const ROUTES = [
     row({ handler: handleMemoryConsolidation, decls: MEMORY_CONSOLIDATION_ROUTES, position: "post-credential", label: "memory-consolidation" }),
     row({ handler: handleRules, decls: RULES_ROUTES, position: "post-credential", label: "rules" }),
     row({ handler: handleSharedMemory, decls: SHARED_MEMORY_ROUTES, position: "post-credential", label: "shared-memory" }),
+    row({ handler: handlePrincipalInbox, decls: PRINCIPAL_INBOX_ROUTES, position: "post-credential", label: "principal-inbox" }),
     row({ handler: handleSessionsList, decls: SESSIONS_LIST_ROUTES, position: "post-credential", label: "sessions-list" }),
     row({ handler: handleAgentRoster, decls: AGENT_ROSTER_ROUTES, position: "post-credential", label: "agent-roster" }),
     row({ handler: handleSessions, decls: SESSIONS_ROUTES, position: "post-credential", label: "sessions" }),

package/dist/http/routes/a2a-serve.js

@@ -9,6 +9,7 @@ import { isActiveRunConflictBody } from "../active-run-conflict.js";
 import { sendJson, sendError } from "../send.js";
 import { admissionRefusalOf, readinessOf, sendBillableRefusal } from "../readiness.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { readOwnedRun } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { createDurableRun } from "./runs.js";
@@ -241,7 +242,7 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
         .update(contextId ?? "").update("\x1f")
         .update(skillId ?? "")
         .digest("hex");
-    const submitter = caller.principal ?? undefined;
+    const submitter = gatedPrincipal(req, deps.config);
     const idem = { key: idemKeyOf(fingerprint, caller, "run"), bodyFingerprint: fingerprint };
     const body = {
         objective,
@@ -315,11 +316,9 @@ function durableIdempotencyTaskId(scope, messageId) {
 async function handleTasksGet({ req, ctx, params, runStore }) {
     const { deps } = ctx;
     const id = asNonEmptyString(params.id, "params.id", MAX_TASK_ID_CHARS);
-    const run = await runStore.getRun(id);
+    const run = await readOwnedRun(deps.config, runStore, gatedPrincipal(req, deps.config), id, "owner");
     if (!run)
         throw new RpcError(A2A_TASK_NOT_FOUND, A2A_TASK_NOT_FOUND_MESSAGE);
-    if (run.owner !== null && gatedPrincipal(req, deps.config) !== run.owner)
-        throw new RpcError(A2A_TASK_NOT_FOUND, A2A_TASK_NOT_FOUND_MESSAGE);
     return taskFromRun(run, isStaleRun(run, deps.config.runStaleSec));
 }
 const A2A_METHODS = {

package/dist/http/routes/admin-config-refresh.js

@@ -17,7 +17,7 @@ export async function handleAdminConfigRefresh(req, res, match, ctx) {
                 sendOperatorPrincipalsRequired(res);
                 return;
             }
-            if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+            if (!explicitOperatorOk(principal, deps.config)) {
                 sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
                 return;
             }

package/dist/http/routes/admin-drain.js

@@ -21,7 +21,7 @@ export async function handleAdminDrain(req, res, match, ctx) {
                 sendOperatorPrincipalsRequired(res);
                 return;
             }
-            if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+            if (!explicitOperatorOk(principal, deps.config)) {
                 sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
                 return;
             }

package/dist/http/routes/admin-memory-optout.js

@@ -21,7 +21,7 @@ export async function handleMemoryOptOut(req, res, match, ctx) {
         sendOperatorPrincipalsRequired(res);
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+    if (!explicitOperatorOk(principal, deps.config)) {
         sendError(res, 403, "auth.operator_only", "memory opt-out grant administration is operator-only: the caller principal is not in OPERATOR_PRINCIPALS");
         return;
     }
@@ -52,6 +52,10 @@ export async function handleMemoryOptOut(req, res, match, ctx) {
             return;
         case "memory-optout-put-default":
         case "memory-optout-put-override":
+            if (operator === undefined) {
+                sendPrincipalRefusal(res, req, deps.config);
+                return;
+            }
             break;
         default:
             return assertNever(match.decl.id);

package/dist/http/routes/adoption.js

@@ -52,7 +52,7 @@ export async function handleAdoption(req, res, match, ctx) {
         sendOperatorPrincipalsRequired(res);
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+    if (!explicitOperatorOk(principal, deps.config)) {
         sendError(res, 403, "auth.operator_only", "adoption is an operator-only deployment action");
         return;
     }
@@ -86,14 +86,7 @@ export async function handleAdoption(req, res, match, ctx) {
             return;
         }
         case "adoption-submit": {
-            let raw;
-            try {
-                raw = await readJson(req);
-            }
-            catch {
-                sendError(res, 400, "request.invalid_json", "invalid JSON body");
-                return;
-            }
+            const raw = await readJson(req);
             const parsed = AdoptionRequestSchema.safeParse(raw);
             if (!parsed.success) {
                 sendError(res, 400, "request.body_shape", "invalid adoption body — expected {fromPrincipal, toPrincipal} as non-empty strings");

package/dist/http/routes/approvals-assistant.js

@@ -4,7 +4,7 @@ import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
 import { APPROVAL_GATE_KINDS, carriesDeploymentListQuestion, standingAnswerDurablyRecordable } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
-import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
+import { principalFrom, decodeCheckpointScope, ownerOfCheckpointScope, CHECKPOINT_PUBLIC_SCOPE, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
 import { MAX_APPROVAL_REASON_CHARS, projectQuestionAnswer, questionAnswerFromProjection } from "../../approval-hmac.js";
 import { PLAN_APPROVE_PERMISSION_MODES_AFTER, isPlanApprovePermissionModeAfter, planReviewDecisionExitsPlan, storedBodyPermissionMode } from "../../task-settings.js";
@@ -15,7 +15,8 @@ import { buildRunName } from "../../fleet/fleet-bus.js";
 import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sessionCallerOf } from "../principal-gate.js";
+import { readOwnedRun, readOwnedSession } from "../owner-access.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
 import { deploymentListAsks } from "../../approval.js";
 import { callGrantBindingOf, questionGrantBindingOf } from "../../standing-answer-grant.js";
@@ -23,8 +24,11 @@ import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { readResumeCtx } from "../resume-ctx-read.js";
+import { StoreCorruptError } from "../../plugins/sql-json-column.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
+import { durableRowIdentity } from "../../checkpoint-identity.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
+import { fieldConflictFacts } from "../../field-conflict.js";
 const DECIDE_BODY_DECLARED_KEYS = [
     "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decision", "reason", "remember", "updatedInput",
 ];
@@ -268,18 +272,19 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
         }
         const cs = park.checkpointStore;
         const principal = gatedPrincipal(req, deps.config);
-        const operator = isOperator(principal, deps.config.operatorPrincipals);
+        const operator = explicitOperatorOk(principal, deps.config);
+        const ownScope = principal ?? CHECKPOINT_PUBLIC_SCOPE;
         if (match.decl.id === "approvals-stream") {
             const scope = operator
                 ? (new URLSearchParams(match.search).get("owner") ?? undefined)
-                : (principal ?? "__none__");
+                : ownScope;
             await streamApprovals(req, res, cs, deps.toolApproval, scope, deps.config);
             return;
         }
         if (match.decl.id === "approvals-list") {
             const scope = operator
                 ? (new URLSearchParams(match.search).get("owner") ?? undefined)
-                : (principal ?? "__none__");
+                : ownScope;
             sendJson(res, 200, {
                 pending: (await cs.listPending(scope)).map((r) => projectPendingForWire(r, deps.config)),
                 serverNowMs: Date.now(),
@@ -300,17 +305,13 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
                     return;
                 }
-                const operators = deps.config.operatorPrincipals;
-                const isExplicitOperator = explicitOperatorOk(principal, operators);
-                if (!isExplicitOperator) {
+                if (!explicitOperatorOk(principal, deps.config)) {
                     const owned = facts.sessionOwnership(deps);
                     if (!owned.available) {
                         sendError(res, 501, "capability.session_store_required", "approval exemptions require a session-store backend");
                         return;
                     }
-                    const ownerOf = owned.sessionStorage.ownerOf.bind(owned.sessionStorage);
-                    const owner = await ownerOf(exSessionId);
-                    if (owner === undefined || (owner !== null && owner !== principal)) {
+                    if ((await readOwnedSession(deps, owned.sessionStorage, sessionCallerOf(req, deps), exSessionId, "owner")) === undefined) {
                         sendError(res, 404, "not_found.session", "not found");
                         return;
                     }
@@ -329,13 +330,16 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
                 const revoked = await deps.approvalExemptionStore.revoke(exSessionId, exToolName);
-                sendJson(res, revoked ? 200 : 404, revoked ? { revoked: true } : { error: "not found", errorCode: "not_found.exemption" });
+                if (revoked)
+                    sendJson(res, 200, { revoked: true });
+                else
+                    sendError(res, 404, "not_found.exemption", "not found");
                 return;
             }
         }
         if (match.decl.id === "assistant-inbox") {
             const ownerParam = new URLSearchParams(match.search).get("owner") || undefined;
-            const scope = operator && ownerParam ? ownerParam : (principal ?? "__none__");
+            const scope = operator && ownerParam ? ownerParam : ownScope;
             const summaries = await cs.listByScope(scope);
             const inbox = (await Promise.all(summaries.map(async (s) => {
                 const ctxRead = await readResumeCtx(cs.getCtx(s.sessionId));
@@ -345,6 +349,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 const input = s.toolInput != null ? redactedPreview(s.toolInput) : null;
                 return {
                     sessionId: s.sessionId,
+                    ...durableRowIdentity("assistant-inbox", s.checkpointId, s.token),
                     scope: s.scope,
                     createdAt: s.createdAt,
                     ...(s.gateKind !== undefined ? { gateKind: s.gateKind } : {}),
@@ -364,13 +369,14 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     objective,
                     input,
                 };
-            }))).sort((a, b) => (b.severity ?? 0) - (a.severity ?? 0) || (a.createdAt ?? 0) - (b.createdAt ?? 0));
+            })))
+                .sort((a, b) => (b.severity ?? 0) - (a.severity ?? 0) || (a.createdAt ?? 0) - (b.createdAt ?? 0));
             sendJson(res, 200, { inbox });
             return;
         }
         if (match.decl.id === "assistant-tasks") {
             const ownerParam = new URLSearchParams(match.search).get("owner") || undefined;
-            const scope = operator && ownerParam ? ownerParam : (principal ?? "__none__");
+            const scope = operator && ownerParam ? ownerParam : ownScope;
             const ledger = facts.durableRuns(deps);
             if (!ledger.available) {
                 sendJson(res, 200, { tasks: [] });
@@ -379,7 +385,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const runStore = ledger.runStore;
             const summaries = await cs.listByScope(scope);
             const byGate = new Map(summaries.map((s) => [s.sessionId, s]));
-            const runs = await runStore.listRuns({ owner: scope, limit: 100 });
+            const runs = await runStore.listRuns({ owner: ownerOfCheckpointScope(scope), limit: 100 });
             const tasks = runs
                 .filter((r) => r.status === "running" || isParkedRunStatus(r.status))
                 .map((r) => {
@@ -416,17 +422,11 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 return;
             }
             const taskId = match.params.taskId;
-            const run = await runStore.getRun(taskId);
+            const run = await readOwnedRun(deps.config, runStore, principal, taskId, "owner_or_operator");
             if (!run) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
-            const operators = deps.config.operatorPrincipals;
-            const explicitOperator = explicitOperatorOk(principal, operators);
-            if (!explicitOperator && run.owner !== null && run.owner !== principal) {
-                sendError(res, 404, "not_found.run", "task not found");
-                return;
-            }
             if (run.status === "running") {
                 const ownedHere = run.instanceId != null && run.instanceId === deps.instanceId;
                 if (ownedHere && !preemptableRuns.has(taskId)) {
@@ -482,8 +482,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
-            const operators = deps.config.operatorPrincipals;
-            const explicitOperator = explicitOperatorOk(principal, operators);
+            const explicitOperator = explicitOperatorOk(principal, deps.config);
             if (!explicitOperator && run.owner !== null && run.owner !== principal) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
@@ -520,7 +519,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
             }
             if (decision === "edit" && (typeof body.editedPlan !== "string" || body.editedPlan.length === 0)) {
-                sendError(res, 400, "request.field_conflict", "decision 'edit' requires a non-empty editedPlan (the operator's revised plan)");
+                sendError(res, 400, "request.field_conflict", "decision 'edit' requires a non-empty editedPlan (the operator's revised plan)", fieldConflictFacts("plan_edit", ["decision", "editedPlan"]));
                 return;
             }
             const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
@@ -543,7 +542,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 return;
             }
             if (decision !== "edit" && body.editedPlan !== undefined) {
-                sendError(res, 400, "request.field_conflict", `editedPlan is only valid with decision 'edit' (got '${decision}')`);
+                sendError(res, 400, "request.field_conflict", `editedPlan is only valid with decision 'edit' (got '${decision}')`, fieldConflictFacts("plan_edit", ["editedPlan", "decision"]));
                 return;
             }
             if (body.permissionModeAfter !== undefined && !isPlanApprovePermissionModeAfter(body.permissionModeAfter)) {
@@ -551,7 +550,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 return;
             }
             if (!planReviewDecisionExitsPlan(decision) && body.permissionModeAfter !== undefined) {
-                sendError(res, 400, "request.field_conflict", `permissionModeAfter is only valid with a decision that carries the plan out ('approve' or 'edit'; got '${decision}')`);
+                sendError(res, 400, "request.field_conflict", `permissionModeAfter is only valid with a decision that carries the plan out ('approve' or 'edit'; got '${decision}')`, fieldConflictFacts("plan_mode_after", ["permissionModeAfter", "decision"]));
                 return;
             }
             if (body.reason !== undefined && typeof body.reason !== "string") {
@@ -572,7 +571,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
                 if (!deps.config.directDoorActive) {
-                    sendError(res, 400, "request.field_conflict", "boundCallId (the plan_review nonce) is only valid on a direct-door worker — a BFF worker carries no decision proof to bind it to");
+                    sendError(res, 400, "request.field_conflict", "boundCallId (the plan_review nonce) is only valid on a direct-door worker — a BFF worker carries no decision proof to bind it to", fieldConflictFacts("bound_call_door", ["boundCallId"]));
                     return;
                 }
             }
@@ -611,8 +610,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 deciderPrincipal = proof.principal;
                 singleUse = proof.singleUse === undefined ? undefined : { proof: proof.singleUse, store };
             }
-            const operators = deps.config.operatorPrincipals;
-            const explicitOperator = explicitOperatorOk(deciderPrincipal, operators);
+            const explicitOperator = explicitOperatorOk(deciderPrincipal, deps.config);
             if (!explicitOperator && run.owner !== null && run.owner !== deciderPrincipal) {
                 deps.logger?.info?.("decide_404", { reason: "owner-mismatch", taskId, principalPresent: principal !== undefined });
                 sendError(res, 404, "not_found.run", "task not found");
@@ -626,7 +624,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             if (body.permissionModeAfter !== undefined) {
                 const storedCtx = plan.prepared.ctx;
                 if (storedCtx.body !== undefined && storedBodyPermissionMode(storedCtx.body) !== "plan") {
-                    sendError(res, 400, "request.field_conflict", "permissionModeAfter does not apply to this task: it was not started in plan mode (its stored permission mode is not \"plan\"), so approving the plan returns it to the mode it was in before planning");
+                    sendError(res, 400, "request.field_conflict", "permissionModeAfter does not apply to this task: it was not started in plan mode (its stored permission mode is not \"plan\"), so approving the plan returns it to the mode it was in before planning", fieldConflictFacts("plan_mode_after", ["permissionModeAfter"]));
                     return;
                 }
             }
@@ -683,7 +681,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
                 if (decision !== "approve") {
-                    sendError(res, 400, "request.field_conflict", "remember requires decision 'approve'");
+                    sendError(res, 400, "request.field_conflict", "remember requires decision 'approve'", fieldConflictFacts("remember_decision", ["remember", "decision"]));
                     return;
                 }
                 if (deps.config.directDoorActive) {
@@ -770,8 +768,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
                 deciderPrincipal = proof.principal;
             }
-            const operators = deps.config.operatorPrincipals;
-            const explicitOperator = explicitOperatorOk(deciderPrincipal, operators);
+            const explicitOperator = explicitOperatorOk(deciderPrincipal, deps.config);
             if (!explicitOperator) {
                 const cpScope = await cs
                     .peekPendingScope(sessionId, { gateKinds: APPROVAL_GATE_KINDS })
@@ -895,23 +892,27 @@ export async function streamApprovals(req, res, cs, live, scope, governance, pol
     });
     let first = true;
     while (!closed) {
-        let pending;
-        let livePending;
+        let snapshot;
         try {
-            pending = (await cs.listPending(scope)).map((r) => projectPendingForWire(r, governance));
-            livePending = live ? live.listLivePending(scope) : [];
+            const pending = (await cs.listPending(scope)).map((r) => projectPendingForWire(r, governance));
+            snapshot = { pending, livePending: live ? live.listLivePending(scope) : [] };
         }
-        catch {
+        catch (err) {
+            if (err instanceof StoreCorruptError) {
+                if (!res.writableEnded)
+                    res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "approvals.read_corrupt", message: "a stored approval row cannot be read - this stream is closing, and reconnecting will fail the same way until an operator repairs or removes the row" })}\n\n`);
+                break;
+            }
             if (!res.writableEnded)
-                res.write(`event: heartbeat\ndata: ${JSON.stringify({ type: "heartbeat" })}\n\n`);
-            await sleep(pollMs);
-            continue;
+                res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "approvals.read_unavailable", message: "the approvals queue could not be read - this stream stays open and retries on its next poll; until a read succeeds, silence here does not mean nothing is pending" })}\n\n`);
         }
-        durableLane.tick(pending);
-        liveLane.tick(livePending);
-        if (first) {
-            res.write(`event: synced\ndata: ${JSON.stringify({ type: "synced", count: pending.length })}\n\n`);
-            first = false;
+        if (snapshot !== undefined) {
+            durableLane.tick(snapshot.pending);
+            liveLane.tick(snapshot.livePending);
+            if (first) {
+                res.write(`event: synced\ndata: ${JSON.stringify({ type: "synced", count: snapshot.pending.length })}\n\n`);
+                first = false;
+            }
         }
         if (Date.now() - start > SSE_MAX_STREAM_MS) {
             res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "approvals stream reached its 15-minute cap — reconnect to continue" })}\n\n`);

package/dist/http/routes/background.js

@@ -7,6 +7,7 @@ import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../pri
 import {} from "../route-ctx.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
+import { sessionOwnerCellOf } from "../../security.js";
 const LIST_LIMIT = 500;
 export const DESCRIPTION_MAX = 500;
 const ROW_KEY_DISPOSITION = {
@@ -67,8 +68,8 @@ export async function handleBackground(req, res, match, ctx) {
         sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
         return;
     }
-    const isOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-    if (!isOperator && !ctx.helpers.sessionOwnerOk(req, res, owner))
+    const operator = explicitOperatorOk(principal, deps.config);
+    if (!operator && !ctx.helpers.sessionOwnerOk(req, res, await sessionOwnerCellOf(owned.sessionStorage, sessionId, owner)))
         return;
     const scope = owner ?? "default";
     switch (id) {