@sema-agent/server 7.132.0 → 7.133.0

package/dist/http/routes/capabilities.js

@@ -2,6 +2,8 @@ import { PERMISSION_MODES, USER_ATTACHMENT_SEAT, expandTiers, reasoningEffortLev
 import { modelImageInput, modelReasoningDecl, isAtMentionable, selectableCatalog } from "../../model-select.js";
 import { buildDroppedEntriesWire } from "../../web-admin-client/read-warnings.js";
 import { buildCandidateRejectedWire } from "../../web-admin-client/candidate-gate.js";
+import { buildModelPlaneFace } from "../../model-plane-face.js";
+import { isRosterGateArmed } from "../../config.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
@@ -10,7 +12,7 @@ import { leaderEntryRefusal, leaderRunEntry } from "../../leader/run-entry.js";
 import { autonomyKeepsOpenWriteFace, autonomyModeFloor } from "../../runtime-governance.js";
 import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protocol.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
-import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
+import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, McpProbeMisaligned, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
 import { mcpForScenario } from "../../web-admin-client/facade.js";
 import { sendScenarioNotFound } from "../scenario-read-face.js";
 import { sendJson, sendError } from "../send.js";
@@ -21,6 +23,7 @@ import { projectWriteProtectionCapability } from "../../write-protection.js";
 import { projectStoreCapability } from "../../store-posture.js";
 import { projectWebSearchCapability } from "../../plugins/web-search.js";
 import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
+import { MCP_ASSERTION_HEADER_SENT } from "../../mcp-assertion-header.js";
 import { gateCompositeMembers } from "../../capabilities/composite-members.js";
 import { projectApprovalsStreamLiveCapability } from "../../capabilities/approvals-push.js";
 import { workflowModelAllowlistFor } from "../../task-workflow.js";
@@ -29,6 +32,7 @@ import * as facts from "../../capability-facts.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
 import { coercePermissionModeStrict, PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { callerTrust } from "../caller-trust.js";
 function routePairingOf(deps, name, m) {
     if (modelKeyPoisonOf(name, deps.config.modelApiKeyEnv ?? {}, process.env, deps.config.modelApiKeys ?? {}) !== undefined)
         return "unknown";
@@ -72,12 +76,14 @@ export async function handleCapabilities(req, res, match, ctx) {
             if (autoModeFault !== undefined)
                 deps.logger?.warn("auto_mode_face_resolver_fault", { fault: autoModeFault });
             const rulesLaneForCaller = facts.ruleLaneForCaller(deps, gatedPrincipal(req, deps.config)).available;
+            const streamApprovalFact = facts.streamApproval(deps);
             sendJson(res, 200, gateCompositeMembers({
                 ...deps.capabilities,
                 ...facts.engineCapabilityBits(),
                 asyncRuns: facts.durableRuns(deps).available,
                 artifacts: facts.durableRuns(deps).available,
                 approvals: facts.checkpointPark(deps).available,
+                approvalReadRootGrant: facts.readRootGrant(deps).available,
                 sessions: facts.sessionAuditView(deps).available,
                 deviceExecutor: facts.deviceLane(deps).available
                     ? { enabled: true, protocolVersion: DEVICE_PROTOCOL_VERSION, maxInflightPerDevice: deps.config.remoteExec?.provider === "device" ? (deps.config.remoteExec.maxInflightPerDevice ?? 4) : 4, wsPath: DEVICE_WS_PATH, management: facts.deviceManagement(deps).available }
@@ -100,6 +106,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 mcpReconnect: facts.mcpReconnect(deps).available,
                 background: { listFace: facts.sessionOwnership(deps).available, exitFaces: facts.sessionOwnership(deps).available },
                 sharedMemory: facts.sharedMemoryRead(deps).available,
+                principalInboxDelivery: facts.principalInboxDelivery(deps).available,
                 adoption: facts.adoption(deps).available,
                 memoryBundle: facts.memoryBundle(deps).available,
                 memoryCompliance: facts.memoryCompliance(deps).available,
@@ -124,8 +131,8 @@ export async function handleCapabilities(req, res, match, ctx) {
                 scratchpadDir: true,
                 subagentSteer: facts.subagentSteer(deps).available,
                 subagentResume: facts.subagentSteer(deps).available,
-                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: taskHooksHonored(deps.config) },
-                settings: { permissions: { allowGrant: true, allowLayer: true } },
+                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: taskHooksHonored(deps.config), pluginHooks: taskHooksHonored(deps.config), managedHookGroups: taskHooksHonored(deps.config), tightenOnlySeats: true },
+                settings: { permissions: { allowGrant: true, allowLayer: true, callerTrust: callerTrust(req, deps.config).trust } },
                 permissionModeAuto: {
                     accepted: true,
                     classifierSeat: deps.autoModeFace?.seatMounted === true,
@@ -160,11 +167,13 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sessionInit: true,
                 mcp: true,
                 mcpProbe: true,
+                mcpAssertionHeaderSent: MCP_ASSERTION_HEADER_SENT,
                 mcpElicitation: facts.elicitation(deps).available,
                 askUserQuestion: facts.askUserQuestion(deps).available,
                 toolApproval: facts.toolApproval(deps).available,
                 approvalsStreamLive: projectApprovalsStreamLiveCapability(deps),
-                streamApproval: facts.streamApproval(deps).available,
+                streamApproval: streamApprovalFact.available,
+                approvalFrameFamilies: [...facts.approvalFrameFamilies(streamApprovalFact)],
                 approvalDecisionNote: true,
                 approvalDecidedBy: true,
                 permissionModes: [...PERMISSION_MODES],
@@ -273,6 +282,11 @@ export async function handleCapabilities(req, res, match, ctx) {
                 defaultModel: { id: deps.config.model.id, ...(defaultName ? { name: defaultName } : {}) },
                 droppedEntries: buildDroppedEntriesWire(deps.config.droppedCatalogEntries),
                 ...(candidateRejection !== undefined ? { candidateRejected: buildCandidateRejectedWire(candidateRejection) } : {}),
+                modelPlane: buildModelPlaneFace(deps.config, {
+                    envTableIsPlaceholder: isRosterGateArmed(deps.config.webAdmin),
+                    candidateRejection,
+                    modelRefusals: deps.modelRefusalsState?.(),
+                }),
             });
             return;
         }
@@ -330,6 +344,8 @@ async function answerMcpProbe(res, ctx, answer, outcome, declaredBy) {
             sendMcpProbeRefusal(res, ctx, buildMcpProbeIncompleteRefusal(err.boundMs), "failed", Math.ceil(err.boundMs / 1000));
             return;
         }
+        if (err instanceof McpProbeMisaligned)
+            throw err;
         if (declaredBy === "caller") {
             sendMcpProbeRefusal(res, ctx, buildMcpProbeDeclarationRefusal(), "failed");
             return;

package/dist/http/routes/config-catalog.d.ts

@@ -9,9 +9,9 @@
  * 门序 = operator 面口径:身份 → 能力(事实 `configCatalog`,501)→ 授权 → 应答;billable=false,
  * 刻意不吃 drain / roster-pending 两道 503(排障读面在停机窗里恰恰要打得通)。
  *
- * 🔴 鉴权 = `explicitOperatorOk`(空名单=谁都不是)——设计稿 §0.5 点名**禁** `isOperator` 那个
- * 「空名单=人人都是」的 fail-open 谓词:本面是部署事实外泄口(env 在场性/后端形态/限额值),
- * 单用户形也不放宽。
+ * 🔴 鉴权 = `explicitOperatorOk`(「谁是 operator」的唯一读法:空名单 = 谁都不是)—— 设计稿 §0.5 点名禁「空名单 = 人人都是」的 fail-open 读法
+ * (S-1050 起整只删):本面是部署事实外泄口(env 在场性 / 后端形态 / 限额值)。单用户形只在部署方显式声明 `OPERATOR_SINGLE_USER=true`
+ * (每个调用方都是运维)时对调用方开。
  *
  * 🔴 旋钮 `CONFIG_CATALOG_ENABLED=false` / operator 名单空 ⇒ 501(事实 `configCatalog`,与能力位同一只函数):
  * 旋钮关 = `feature.config_catalog_disabled`(合规部署不想让部署事实上 wire 的表态;「去开旋钮」由码与句承担),

package/dist/http/routes/config-catalog.js

@@ -29,7 +29,7 @@ export async function handleConfigCatalog(req, res, match, ctx) {
                         return assertNever(fact.why);
                 }
             }
-            if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+            if (!explicitOperatorOk(principal, deps.config)) {
                 sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
                 return;
             }

package/dist/http/routes/devices.js

@@ -47,14 +47,7 @@ function bodyKeyIssue(body, accepted) {
     return `unknown key(s) in body: ${extra.join(", ")} — this endpoint accepts ${accepted.length === 0 ? "no body keys" : accepted.slice().sort().join(", ")} (a silently dropped key is a declaration that never existed)`;
 }
 async function readClosedBody(req, res, readJson, accepted) {
-    let body;
-    try {
-        body = await readJson(req);
-    }
-    catch {
-        sendError(res, 400, "request.invalid_json", "invalid JSON body");
-        return null;
-    }
+    const body = await readJson(req);
     if (typeof body !== "object" || body === null || Array.isArray(body)) {
         sendError(res, 400, "request.body_shape", "body must be a JSON object");
         return null;
@@ -151,7 +144,7 @@ export async function handleDevices(req, res, match, ctx) {
         }
     }
     const { store, hub, enrollment, runStore } = lane;
-    const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
+    const operator = explicitOperatorOk(principal, deps.config);
     const domain = deviceOwnerDomainOf(req, deps.config);
     if (match.decl.id === "devices-list") {
         if (!operator && domain === undefined) {
@@ -277,14 +270,7 @@ export async function handleDevices(req, res, match, ctx) {
         sendDeviceNotFound(res);
         return;
     }
-    let body;
-    try {
-        body = (await readJson(req));
-    }
-    catch {
-        sendError(res, 400, "request.invalid_json", "invalid JSON body");
-        return;
-    }
+    const body = (await readJson(req));
     if (typeof body !== "object" || body === null || typeof body.toDeviceId !== "string" || body.expectedRev === undefined) {
         sendError(res, 400, "request.body_shape", "body must be { toDeviceId: string, expectedRev: number } — expectedRev is the binding rev read from GET /v1/devices/sessions/{rootSessionId} (explicit prior state; two concurrent operators must not silently stomp each other)");
         return;

package/dist/http/routes/diagnostics.js

@@ -15,24 +15,28 @@ export function buildServerWiringGates(input) {
         parkFacility: input.checkpointStore !== undefined,
     });
     const noCenterArm = (knob) => `this knob has no web-admin arm on this deployment — it is set by ${knob} on this machine, or derived from the deployment posture`;
+    const noLaneArm = (knob) => `this knob has no execution-lane default — ${knob} does not depend on which execution lane this deployment runs`;
     return {
         streamApproval: gate.active ? "active" : gate.reason,
         durableApproval: buildPostureKnobReading(input.durableApproval, {
             knob: "DURABLE_APPROVAL",
             source: input.durableApprovalSource,
             centerMeaning: noCenterArm("DURABLE_APPROVAL"),
+            laneMeaning: noLaneArm("DURABLE_APPROVAL"),
             postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set) composed with a durable store being present: park/resume and the /v1/approvals routes are on by default — set DURABLE_APPROVAL=false to pin them off",
         }),
         streamAskWindowMs: buildPostureKnobReading(input.streamAskWindowMs, {
             knob: "STREAM_ASK_WINDOW_MS",
             source: input.streamAskWindowMsSource,
             centerMeaning: noCenterArm("STREAM_ASK_WINDOW_MS"),
+            laneMeaning: noLaneArm("STREAM_ASK_WINDOW_MS"),
             postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): an approval card waits 24h instead of 5 minutes, so stepping away does not settle the run unattended — set STREAM_ASK_WINDOW_MS to pin your own window",
         }),
         sessionAutoTitle: buildPostureKnobReading(input.sessionAutoTitle, {
             knob: "SESSION_AUTO_TITLE",
             source: input.sessionAutoTitleSource,
             centerMeaning: noCenterArm("SESSION_AUTO_TITLE"),
+            laneMeaning: noLaneArm("SESSION_AUTO_TITLE"),
             postureMeaning: "this knob has no posture arm — its default is the same on every deployment shape",
         }),
         checkpointStore: input.checkpointStore !== undefined,
@@ -93,7 +97,7 @@ export async function handleDiagnostics(req, res, match, ctx) {
                     return;
                 }
                 const principal = gatedPrincipal(req, deps.config);
-                if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+                if (!explicitOperatorOk(principal, deps.config)) {
                     sendError(res, 403, "auth.operator_only", "wiring diagnostics are operator-only on a multi-tenant worker");
                     return;
                 }

package/dist/http/routes/images.js

@@ -49,8 +49,7 @@ export async function handleImages(req, res, match, ctx) {
         const bakes = deps.imageBakes;
         const idx = deps.imageIndex;
         const principal = gatedPrincipal(req, deps.config);
-        const operators = deps.config.operatorPrincipals;
-        const isExplicitOperator = explicitOperatorOk(principal, operators);
+        const isExplicitOperator = explicitOperatorOk(principal, deps.config);
         const operatorLane = facts.operatorLane(deps);
         const cfg = deps.config.imageBakes;
         const isRunner = source !== undefined && source !== null && source === cfg.runnerPrincipal;
@@ -239,12 +238,12 @@ export async function handleImages(req, res, match, ctx) {
             if (line.event === "heartbeat") {
                 const fresh = await bakes.getBake(bakeId);
                 if (!fresh || fresh.status !== "running") {
-                    sendJson(res, 409, { accepted: false, leaseValid: false, cancelRequested: fresh?.cancelRequested ?? false, errorCode: "conflict.bake_not_running" });
+                    sendError(res, 409, "conflict.bake_not_running", "bake is not running", { accepted: false, leaseValid: false, cancelRequested: fresh?.cancelRequested ?? false });
                     return;
                 }
                 const ok = bake.runnerId ? await bakes.heartbeatLease(bakeId, bake.runnerId, cfg.leaseMs) : false;
                 if (!ok) {
-                    sendJson(res, 409, { accepted: false, leaseValid: false, cancelRequested: fresh.cancelRequested, errorCode: "conflict.bake_lease_lost" });
+                    sendError(res, 409, "conflict.bake_lease_lost", "bake lease lost", { accepted: false, leaseValid: false, cancelRequested: fresh.cancelRequested });
                     return;
                 }
                 sendJson(res, 200, { accepted: true, leaseValid: true, cancelRequested: fresh.cancelRequested });
@@ -252,7 +251,7 @@ export async function handleImages(req, res, match, ctx) {
             }
             const fresh = await bakes.getBake(bakeId);
             if (!fresh || fresh.status !== "running") {
-                sendJson(res, 409, { accepted: false, leaseValid: false, cancelRequested: fresh?.cancelRequested ?? false, errorCode: "conflict.bake_not_running" });
+                sendError(res, 409, "conflict.bake_not_running", "bake is not running", { accepted: false, leaseValid: false, cancelRequested: fresh?.cancelRequested ?? false });
                 return;
             }
             if (fresh.runnerId) {
@@ -291,7 +290,7 @@ export async function handleImages(req, res, match, ctx) {
     if (pool.available && isIndexRouteId(match.decl.id)) {
         const idx = pool.imageIndex;
         const principal = gatedPrincipal(req, deps.config);
-        const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
+        const operator = explicitOperatorOk(principal, deps.config);
         const viewer = { operator, tenantId: principal ?? null };
         const q = new URLSearchParams(match.search);
         if (match.decl.id === "images-index") {
@@ -345,7 +344,7 @@ export async function handleImages(req, res, match, ctx) {
                 sendOperatorPrincipalsRequired(res);
                 return;
             }
-            if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+            if (!explicitOperatorOk(principal, deps.config)) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
             }

package/dist/http/routes/leader.js

@@ -30,14 +30,7 @@ export async function handleLeader(req, res, match, ctx) {
     if (match.decl.id === "leader-submit") {
         if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)) || (await usageWindowDenied(req, res)))
             return;
-        let body;
-        try {
-            body = await readJson(req);
-        }
-        catch {
-            sendError(res, 400, "request.invalid_json", "invalid JSON body");
-            return;
-        }
+        const body = await readJson(req);
         const laneRefusal = leaderEntryRefusal(leaderRunEntry(deps.config.autonomy));
         if (laneRefusal !== undefined) {
             sendError(res, 422, "request.autonomy_lane_refused", laneRefusal);

package/dist/http/routes/mcp-reconnect.d.ts

@@ -34,7 +34,7 @@
  * 404 无 oracle,与 `POST /v1/sessions/:id/notify` 逐字同形)→ `getActiveTaskId` 取本会话的活 run →
  * `steerableRuns` 取本副本活流。非 live 的四臂一码 409 `steering.not_running`,判据取词表属主
  * (`isParkedRunStatus` / `isTerminalRunStatus`)与 `runProvenElsewhere`(手抄已收编成一只谓词,S-430 起同住 `plugins/store-contracts.ts`)。
- * 显式 operator 可重拨任何租户的会话(监督动作,与 notify / steer 同臂;**不是** bare `isOperator`)。
+ * 显式 operator 可重拨任何租户的会话(监督动作,与 notify / steer 同臂;「谁是 operator」的唯一读法 `explicitOperatorOk`)。
  *
  * ── 应答期限(S-431)────────────────────────────────────────────────────────────────────────────
  * 修前这一口对 `live.reconnectMcpServer(server)` 是裸 `await`:server 侧没有期限,上界只来自 core 自己的启动期钟

package/dist/http/routes/mcp-reconnect.js

@@ -7,6 +7,7 @@ import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../pri
 import {} from "../route-ctx.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
+import { sessionOwnerCellOf } from "../../security.js";
 const BodySchema = z.object({ server: z.string().min(1).max(190) }).strict();
 const NEUTRALIZED_TEXT_MAX = 200;
 const humanText = (s) => redactSecrets(s).slice(0, NEUTRALIZED_TEXT_MAX);
@@ -93,8 +94,8 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
-            const isOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            if (!isOperator && !ctx.helpers.sessionOwnerOk(req, res, owner))
+            const operator = explicitOperatorOk(principal, deps.config);
+            if (!operator && !ctx.helpers.sessionOwnerOk(req, res, await sessionOwnerCellOf(sessionStorage, sessionId, owner)))
                 return;
             const activeTaskId = await runStore.getActiveTaskId(sessionId);
             const live = activeTaskId === undefined ? undefined : ctx.registry.steerableRuns.get(activeTaskId);

package/dist/http/routes/memory-bundle.js

@@ -73,7 +73,7 @@ export async function handleMemoryBundle(req, res, match, ctx) {
         sendOperatorPrincipalsRequired(res);
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+    if (!explicitOperatorOk(principal, deps.config)) {
         sendError(res, 403, "auth.operator_only", "memory governance bundles are an operator-only deployment action");
         return;
     }

package/dist/http/routes/memory-compliance.js

@@ -29,7 +29,7 @@ export async function handleMemoryCompliance(req, res, match, ctx) {
         sendOperatorPrincipalsRequired(res);
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+    if (!explicitOperatorOk(principal, deps.config)) {
         sendError(res, 403, "auth.operator_only", "memory provenance and erasure are operator-only deployment actions");
         return;
     }

package/dist/http/routes/memory-consolidation.js

@@ -92,7 +92,7 @@ export async function handleMemoryConsolidation(req, res, match, ctx) {
         }
     }
     const faces = fact.valve;
-    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+    if (!explicitOperatorOk(principal, deps.config)) {
         sendError(res, 403, "auth.operator_only", "memory consolidation is operator-only: the caller principal is not in OPERATOR_PRINCIPALS");
         return;
     }

package/dist/http/routes/memory-origin.js

@@ -122,7 +122,7 @@ export async function handleMemoryOrigin(req, res, match, ctx) {
         sendOperatorPrincipalsRequired(res);
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+    if (!explicitOperatorOk(principal, deps.config)) {
         sendError(res, 403, "auth.operator_only", "memory origin marking and clearance are operator-only deployment actions");
         return;
     }

package/dist/http/routes/memory-policy.d.ts

@@ -2,7 +2,7 @@
  * [ref] A9 域模块 —— memory 导出/同步 + 只读策略面。
  *
  * 路由:`GET /v1/memory/export`、`POST /v1/memory/sync/:scope`、`GET /v1/policy`。
- * owner 门 = 「本人 user scope / 显式 operator / `org:` 键的目录成员」(见 {@link gateMemoryScope}),
+ * owner 门 = 「本人 user scope / 本人的项目层 / 显式 operator / `org:` 键的目录成员」(见 {@link gateMemoryScope}),
  * 越界一律 404(零存在性 oracle)。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";

package/dist/http/routes/memory-policy.js

@@ -2,6 +2,7 @@ import { formatUserScope } from "@sema-agent/core";
 import { parseMemorySyncRequest } from "../../memory-sync.js";
 import { sendJson, sendError } from "../send.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
+import { parseProjectLayerKey } from "../../project-layer-key.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 const ORG_PREFIX = "org:";
@@ -33,9 +34,9 @@ function directoryDecidesThisFace(mode) {
     }
 }
 async function gateMemoryScope(deps, principal, scope, need) {
-    if (scope === formatUserScope(principal))
+    if (scope === formatUserScope(principal) || parseProjectLayerKey(scope)?.owner === principal)
         return { kind: "allow" };
-    if (explicitOperatorOk(principal, deps.config.operatorPrincipals))
+    if (explicitOperatorOk(principal, deps.config))
         return { kind: "allow" };
     const directory = deps.orgMemoryDirectory;
     if (!scope.startsWith(ORG_PREFIX) || directory === undefined || !directoryDecidesThisFace(deps.config.memoryOrgAdmissionMode)) {

package/dist/http/routes/notify-wake.js

@@ -1,6 +1,7 @@
-import { taskNotificationInboxEntry } from "../../orchestration/workflow-completion-inbox.js";
+import { externalNotificationInboxEntry } from "../../orchestration/workflow-completion-inbox.js";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sessionCallerOf } from "../principal-gate.js";
+import { ownerlessRowOpen, sessionOwnerCellOf } from "../../security.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -23,14 +24,7 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            let nb;
-            try {
-                nb = (await readJson(req));
-            }
-            catch {
-                sendError(res, 400, "request.body_shape", "body must be JSON: { task_id, status, summary, result?, seq?, source? }");
-                return;
-            }
+            const nb = (await readJson(req));
             if (typeof nb.task_id !== "string" || nb.task_id.trim().length === 0 || nb.task_id.length > 190) {
                 sendError(res, 400, "request.field_invalid", "task_id must be a non-empty string of at most 190 characters");
                 return;
@@ -68,8 +62,8 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
-            const notifyOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            if (!notifyOperator && notifyOwner !== null && notifyOwner !== principal) {
+            const notifyOperator = explicitOperatorOk(principal, deps.config);
+            if (!notifyOperator && notifyOwner !== principal && !ownerlessRowOpen(await sessionOwnerCellOf(owned.sessionStorage, notifySession, notifyOwner), sessionCallerOf(req, deps))) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
@@ -101,7 +95,7 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendError(res, 501, "capability.workflow_store_required", "external notify requires the workflow completion inbox (WORKFLOW_RUN_STORE)");
                 return;
             }
-            await deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(notifySession, notifyOwner ?? principal ?? null, { task_id: payload.task_id, task_type: "external", status: payload.status, summary: payload.summary, ...(payload.result !== undefined ? { result: payload.result } : {}), ...(payload.seq !== undefined ? { seq: payload.seq } : {}), ...(payload.source !== undefined ? { source: payload.source } : {}) }, Date.now()));
+            await deps.workflowCompletionInbox.enqueue(externalNotificationInboxEntry(notifySession, notifyOwner ?? principal ?? null, { task_type: "external", ...payload }, Date.now()));
             sendJson(res, 202, { sessionId: notifySession, delivery: "parked", note: "no live stream — parked in the session inbox; drained as a task_notification on the next stream open" });
             return;
         }
@@ -122,14 +116,7 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            let wakeBody;
-            try {
-                wakeBody = (await readJson(req));
-            }
-            catch {
-                sendError(res, 400, "request.body_shape", "body must be JSON: { message?: string }");
-                return;
-            }
+            const wakeBody = (await readJson(req));
             if (wakeBody.message !== undefined && (typeof wakeBody.message !== "string" || wakeBody.message.length === 0)) {
                 sendError(res, 400, "request.field_invalid", "message must be a non-empty string when present");
                 return;

package/dist/http/routes/observability.js

@@ -1,5 +1,5 @@
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, isOperator, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { quotaWindowResetsAt } from "../../observability/cost-quota.js";
@@ -14,7 +14,7 @@ export async function handleObservability(req, res, match, ctx) {
             }
             if (deps.config.requirePrincipal) {
                 const principal = gatedPrincipal(req, deps.config);
-                if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+                if (!explicitOperatorOk(principal, deps.config)) {
                     sendError(res, 403, "auth.operator_only", "outcomes view is operator-only on a multi-tenant worker");
                     return;
                 }

package/dist/http/routes/principal-inbox.d.ts

@@ -0,0 +1,39 @@
+/**
+ * 跨主体投递门的**受理口**:`POST /v1/principal-inbox/messages`。
+ *
+ * 本口只做三件事,其余全归门(`src/org-delivery-gate.ts`,规则全文在它的头注):
+ *  ① 取发件人 —— **只**取自验过的身份面(`gatedPrincipal`),交给门的 `authedFrom` 就是 `{ scope: <那位主体> }`;
+ *     体里没有发件人这个键(写了 = 词表外键,400)。没有验过的身份 ⇒ 401(身份面那一句),不论部署是否要求 principal ——
+ *     门要一个发件人 scope,匿名者没有。无凭证部署上 principal 头只是调用方自报 ⇒ 本口在分派器的无凭证写门内
+ *     (声明行 `credentialGated`,503 `auth.service_token_required`;本地开发显式 `ALLOW_UNAUTHED_WRITES=true` 才放行);
+ *  ② 判体形 —— `{ to: 非空串, content: 非空串(≤ {@link PRINCIPAL_INBOX_CONTENT_MAX_CHARS} 字), urgent?: 布尔 }`,
+ *     键闭集与提交口同一只组句器(`principalInboxBodyKeyIssue`);
+ *  ③ 调门、投影门的答案 —— 回执 ⇒ 200 `{ receiptId }`;拒绝 ⇒ core 的词原样做 `errorCode`、门的那一句原样做 `error`。
+ * 本口**不碰**任何店:一个店名、一个 `.append` 都没有(`test/org-delivery-gate-single-path.test.ts` 按源码钉)。
+ *
+ * 回执**不**带门回执里的 `seq`:那是收件人箱的序号,原样交给发件人就是把「收件人这只箱收过多少封」泄给 org 里的任何人。
+ *
+ * 拒绝词 → HTTP 状态(穷举 `switch`,core 加词 ⇒ 编译红):
+ *  · `not_member` → 404:「不同 org」「查无此人」「目录答不上来」同一份字节(门保证),404 与本仓反枚举的既有形一致;
+ *  · `rate_limited` → 429;
+ *  · `inbox_full` → 409(收件人那一侧的状态,不是发件人的速率;与 `steering.queue_full` 同档);
+ *  · `recipient_tombstoned` → 410(收件人正在被删除,这条路关了)。
+ * 门缺席(本部署没声明收件箱消费方)⇒ 501 `capability.unavailable`,能力位 `principalInboxDelivery` 读同一只事实。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
+/**
+ * 一封信正文的字符上界。全局请求体上界(8 MiB)对一只收件箱太宽:箱里最多 50 封,而读它的是收件人的助理 ——
+ * 一封信是一段话,不是一份附件(要转一份长文,发它的出处)。
+ */
+export declare const PRINCIPAL_INBOX_CONTENT_MAX_CHARS = 32000;
+export declare function handlePrincipalInbox(req: IncomingMessage, res: ServerResponse, match: RouteMatch<PrincipalInboxRouteId>, ctx: RouteCtx): Promise<void>;
+export declare const PRINCIPAL_INBOX_ROUTES: readonly [{
+    readonly id: "principal-inbox-messages";
+    readonly path: "/v1/principal-inbox/messages";
+    readonly credentialGated: readonly ["POST"];
+    readonly methods: readonly ["POST"];
+}];
+/** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽。 */
+export type PrincipalInboxRouteId = RouteIdsOf<typeof PRINCIPAL_INBOX_ROUTES>;
+//# sourceMappingURL=principal-inbox.d.ts.map

package/dist/http/routes/principal-inbox.js

@@ -0,0 +1,76 @@
+import { sendJson, sendError } from "../send.js";
+import { gatedPrincipal, sendUnauthorized } from "../principal-gate.js";
+import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
+import { principalInboxBodyKeyIssue } from "../../request-key-closure.js";
+export const PRINCIPAL_INBOX_CONTENT_MAX_CHARS = 32_000;
+function sendRefusal(res, outcome) {
+    switch (outcome.code) {
+        case "org_delivery.not_member":
+            sendError(res, 404, "org_delivery.not_member", outcome.message);
+            return;
+        case "org_delivery.rate_limited":
+            sendError(res, 429, "org_delivery.rate_limited", outcome.message);
+            return;
+        case "org_delivery.inbox_full":
+            sendError(res, 409, "org_delivery.inbox_full", outcome.message);
+            return;
+        case "org_delivery.recipient_tombstoned":
+            sendError(res, 410, "org_delivery.recipient_tombstoned", outcome.message);
+            return;
+        default:
+            return assertNever(outcome.code);
+    }
+}
+export async function handlePrincipalInbox(req, res, match, ctx) {
+    const { deps } = ctx;
+    const { readJson } = ctx.helpers;
+    switch (match.decl.id) {
+        case "principal-inbox-messages": {
+            const principal = gatedPrincipal(req, deps.config);
+            if (principal === undefined) {
+                sendUnauthorized(res, "identity");
+                return;
+            }
+            const fact = facts.principalInboxDelivery(deps);
+            if (!fact.available) {
+                sendError(res, 501, "capability.unavailable", "cross-principal delivery is not available on this deployment (it declares no principal-inbox consumer, so no organization delivery gate is mounted)");
+                return;
+            }
+            const raw = await readJson(req);
+            if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+                sendError(res, 400, "request.field_invalid", "body must be a JSON object { to: string, content: string, urgent?: boolean }");
+                return;
+            }
+            const keyIssue = principalInboxBodyKeyIssue(raw);
+            if (keyIssue) {
+                sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
+                return;
+            }
+            const body = raw;
+            if (typeof body.to !== "string" || body.to === "") {
+                sendError(res, 400, "request.field_invalid", "to must be a non-empty string naming the recipient principal");
+                return;
+            }
+            if (typeof body.content !== "string" || body.content === "" || body.content.length > PRINCIPAL_INBOX_CONTENT_MAX_CHARS) {
+                sendError(res, 400, "request.field_invalid", `content must be a non-empty string of at most ${PRINCIPAL_INBOX_CONTENT_MAX_CHARS} characters`);
+                return;
+            }
+            if (body.urgent !== undefined && typeof body.urgent !== "boolean") {
+                sendError(res, 400, "request.field_invalid", "urgent must be a boolean when present");
+                return;
+            }
+            const outcome = await fact.gate.deliverCrossPrincipal({ scope: principal }, body.to, { content: body.content, ...(body.urgent !== undefined ? { urgent: body.urgent } : {}) });
+            if (!outcome.ok) {
+                sendRefusal(res, outcome);
+                return;
+            }
+            sendJson(res, 200, { receiptId: outcome.receipt.receiptId });
+            return;
+        }
+        default:
+            return assertNever(match.decl.id);
+    }
+}
+export const PRINCIPAL_INBOX_ROUTES = [{ id: "principal-inbox-messages", path: "/v1/principal-inbox/messages", credentialGated: ["POST"], methods: ["POST"] }];
+//# sourceMappingURL=principal-inbox.js.map

package/dist/http/routes/retention-ops.js

@@ -36,7 +36,7 @@ export async function handleRetention(req, res, match, ctx) {
         sendOperatorPrincipalsRequired(res);
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+    if (!explicitOperatorOk(principal, deps.config)) {
         sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
         return;
     }
@@ -71,14 +71,7 @@ async function handleHold(req, res, ctx, store, rawDomain, principal, held) {
     }
     let note;
     if (held) {
-        let raw;
-        try {
-            raw = await ctx.helpers.readJson(req);
-        }
-        catch {
-            sendError(res, 400, "request.invalid_json", "invalid JSON body");
-            return;
-        }
+        const raw = await ctx.helpers.readJson(req);
         if (raw !== undefined && raw !== null && raw !== "") {
             if (typeof raw !== "object" || Array.isArray(raw)) {
                 sendError(res, 400, "request.body_shape", "invalid retention hold body — expected an object with an optional `note` string");