@sema-agent/server 7.132.0 → 7.133.0

package/dist/trace/core-keyset-guard.d.ts

@@ -17,8 +17,9 @@
  * ⑨⑩([ref],2026-08-31)把两个最大的 wire 面也纳入:TaskSpec 按「server 有无写点」记 Wired/Unwired,
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
-import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, GateOutcome, GateDisposition, Settlement, PausedCause, TerminalCause, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps, SessionMemoryStatus } from "@sema-agent/core";
+import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, PermissionModeReceipt, GateOutcome, GateDisposition, Settlement, PausedCause, TerminalCause, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps, SessionMemoryStatus, PromptManifestIdentity, PromptIdentityLayers, PromptManifestSelectors, PromptManifestSection, PromptChainLink, SupersededOverlay, ToolDisclosureManifest } from "@sema-agent/core";
 import type { ToolApprovalFrame } from "../tool-approval.js";
+import type { TableCoreKeys } from "./projection-table.js";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
  *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
  *  `observability/run-terminal.ts` 的三张叶表 + 结果顶层键表用同一只断言,而不是各自再抄一份
@@ -59,7 +60,7 @@ type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
-type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "mods" | "lsp" | "hands" | "writeProtection" | "teamRole" | "fileHistory";
+type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "mods" | "lsp" | "hands" | "writeProtection" | "teamRole" | "fileHistory" | "permissionMode";
 type WiringSectionExcluded = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["wiring_manifest_tenant"]["excluded"][number];
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
@@ -132,6 +133,9 @@ type _GuardWiringAutoConsolidationReverse = AssertAllKeysHandled<Exclude<WiringA
 type WiringModelGateHandled = "class" | "removed" | "restore";
 type _GuardWiringModelGate = AssertAllKeysHandled<Exclude<keyof WiringSection<"modelGate">, WiringModelGateHandled>>;
 type _GuardWiringModelGateReverse = AssertAllKeysHandled<Exclude<WiringModelGateHandled, keyof WiringSection<"modelGate">>>;
+type WiringPermissionModeHandled = "requested" | "effective" | "foldedBy";
+type _GuardWiringPermissionMode = AssertAllKeysHandled<Exclude<keyof PermissionModeReceipt, WiringPermissionModeHandled>>;
+type _GuardWiringPermissionModeReverse = AssertAllKeysHandled<Exclude<WiringPermissionModeHandled, keyof PermissionModeReceipt>>;
 type WiringAutoModeHandled = "armed" | "reason" | "deniedSource";
 type _GuardWiringAutoMode = AssertAllKeysHandled<Exclude<keyof WiringSection<"autoMode">, WiringAutoModeHandled>>;
 type _GuardWiringAutoModeReverse = AssertAllKeysHandled<Exclude<WiringAutoModeHandled, keyof WiringSection<"autoMode">>>;
@@ -149,10 +153,62 @@ type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<Permiss
 type PromptAssembledFrame = Extract<TraceEvent, {
     kind: "prompt.assembled";
 }>;
-type PromptManifestNotOnRow = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["prompt_manifest"]["excluded"][number];
-type _GuardPromptManifestNotOnRowReverse = AssertAllKeysHandled<Exclude<PromptManifestNotOnRow, keyof PromptAssembledFrame>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence";
-type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "approvalCard" | "restoreMode" | "checkpointId" | "previewWithheld" | "authoredBy";
+type ManifestFaces = typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES;
+type ManifestDeclared<F, N extends keyof F> = F[N] extends {
+    readonly keys: infer K;
+} ? keyof K : never;
+type ManifestDeclaredOptional<F, N extends keyof F> = F[N] extends {
+    readonly keys: infer K;
+} ? {
+    [P in keyof K]: K[P] extends {
+        readonly optional: true;
+    } ? P : never;
+}[keyof K] : never;
+type ManifestNotOnRow<F, N extends keyof F> = F[N] extends {
+    readonly excluded: readonly (infer E)[];
+} ? E : never;
+/** 引擎型上带 `?` 的键。 */
+type OptionalKeysOf<T> = {
+    [P in keyof T]-?: {} extends Pick<T, P> ? P : never;
+}[keyof T];
+/**
+ * 一层的正向残余:引擎型有、声明里没有也没登记不上行的键;以及可选性不对的键 —— 非行层:声明为可选的键 ≠ 引擎型上带 `?` 的键;
+ * 行层:声明里每个键都得是可选(行的成员一律可缺席;少写一个 `optional`,解释器会把「引擎没发这个成员」读成读不出并计一次丢弃)。
+ * 全收敛到 `never` 才过。`Row` = 这一层是不是行。
+ */
+type ManifestLevelForward<F, N extends keyof F, Core, Row extends boolean> = Exclude<keyof Core, ManifestDeclared<F, N> | ManifestNotOnRow<F, N>> | (Row extends true ? Exclude<ManifestDeclared<F, N>, ManifestDeclaredOptional<F, N>> : Exclude<OptionalKeysOf<Core>, ManifestDeclaredOptional<F, N>> | Exclude<ManifestDeclaredOptional<F, N>, OptionalKeysOf<Core>>);
+/** 一层的反向残余:声明过或登记为不上行、而引擎型里已经没有的键(引擎退役它而簿里留着残条目)。 */
+type ManifestLevelReverse<F, N extends keyof F, Core> = Exclude<ManifestDeclared<F, N> | ManifestNotOnRow<F, N>, keyof Core>;
+/** 十二层的引擎型(层名 = 登记表里的面名)。 */
+type ManifestCore = {
+    prompt_manifest: PromptAssembledFrame;
+    prompt_manifest_identity: PromptManifestIdentity;
+    prompt_manifest_identity_layers: PromptIdentityLayers;
+    prompt_manifest_selectors: PromptManifestSelectors;
+    prompt_manifest_selectors_host: PromptManifestSelectors["host"];
+    prompt_manifest_block: PromptAssembledFrame["blocks"][number];
+    prompt_manifest_section: PromptManifestSection;
+    prompt_manifest_section_renderer: NonNullable<PromptManifestSection["renderer"]>;
+    prompt_manifest_chain_link: PromptChainLink;
+    prompt_manifest_superseded: SupersededOverlay;
+    prompt_manifest_tool: NonNullable<PromptAssembledFrame["tools"]>[number];
+    prompt_manifest_tool_disclosure: ToolDisclosureManifest;
+};
+/** 残余非空的层,按 `<层>.<残余键>` 点名(tsc 的报错里直接看见是哪一层的哪一个键)。 */
+/** 十二层的残余汇总:每层的正向残余(见 {@link ManifestLevelForward})按 `<层>.<残余键>` 点名;`F` = 登记表的形。全收敛到 `never` 才过。 */
+type ManifestForwardResidue<F extends Record<keyof ManifestCore, unknown>> = {
+    [L in keyof ManifestCore]: [ManifestLevelForward<F, L, ManifestCore[L], L extends "prompt_manifest" ? true : false>] extends [never] ? never : `${L}.${ManifestLevelForward<F, L, ManifestCore[L], L extends "prompt_manifest" ? true : false> & string}`;
+}[keyof ManifestCore];
+type _GuardPromptManifestKeys = AssertAllKeysHandled<ManifestForwardResidue<ManifestFaces>>;
+type _GuardPromptManifestKeysReverse = AssertAllKeysHandled<{
+    [L in keyof ManifestCore]: [ManifestLevelReverse<ManifestFaces, L, ManifestCore[L]>] extends [never] ? never : `${L}.${ManifestLevelReverse<ManifestFaces, L, ManifestCore[L]> & string}`;
+}[keyof ManifestCore]>;
+/** 非空 —— 十二层的声明都在(层名拼错 / 声明被整行删掉 ⇒ `ManifestDeclared` 坍成 `never`,上面的反向钉恒绿,这一条补上)。 */
+type _GuardPromptManifestKeysNonEmpty = AssertAllKeysHandled<{
+    [L in keyof ManifestCore]: [ManifestDeclared<ManifestFaces, L>] extends [never] ? L : never;
+}[keyof ManifestCore]>;
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence" | "checkpointId";
+type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "approvalCard" | "restoreMode" | "previewWithheld" | "authoredBy";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
 type ParkArmKeys = keyof Extract<PendingAction, {
@@ -163,9 +219,9 @@ type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCal
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptRole" | "promptBinding" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "mods" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools" | "allowTools" | "userAttachments";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptRole" | "promptBinding" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "mods" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools" | "allowTools" | "userAttachments" | "readDenyPatterns" | "writeProtectedAdditions" | "complianceAdditionalDenies";
 /** 导出:请求体键闭集门(`request-key-closure.ts`)据它锁「本仓记为未接线的引擎座,提交口不许受理」—— 两处分类只能同向。 */
-export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "writeProtectedAdditions" | "complianceAdditionalDenies" | "modelRole" | "enableBlockedReport" | "promptForm";
+export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "modelRole" | "enableBlockedReport" | "promptForm";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";
@@ -210,16 +266,25 @@ type _GuardSettlementReverse = AssertAllKeysHandled<Exclude<SettlementProjected,
 type SettlementWhoProjected = "party" | "approver" | "window";
 type _GuardSettlementWho = AssertAllKeysHandled<Exclude<SettlementWhoKeys, SettlementWhoProjected>>;
 type _GuardSettlementWhoReverse = AssertAllKeysHandled<Exclude<SettlementWhoProjected, SettlementWhoKeys>>;
-type WorkflowRunForwarded = "id" | "scope" | "status" | "startedAt" | "endedAt" | "createdAt" | "rev" | "parks" | "name" | "description" | "result" | "error" | "errorCode" | "agentFailures" | "stats" | "phases" | "agents" | "groups" | "resumeAdmissionIncomplete";
-type WorkflowRunStripped = "sourceTaskId" | "originatingSessionId" | "effectiveArgs" | "budgetOvershoot" | "timeoutInterruption" | "resultFull" | "completionId" | "resume" | "journalSkips";
-type _GuardWorkflowRun = AssertAllKeysHandled<Exclude<keyof WorkflowRun, WorkflowRunForwarded | WorkflowRunStripped>>;
-type _GuardWorkflowRunReverse = AssertAllKeysHandled<Exclude<WorkflowRunForwarded | WorkflowRunStripped, keyof WorkflowRun>>;
-type ParkRowKeys = keyof NonNullable<WorkflowRun["parks"]>[number];
-type ParkRowProjected = "callKey" | "sessionId" | "originRunId" | "originUnconfirmed" | "parkedBy" | "generation";
-type ParkRowWithheld = "token";
-type _GuardParkRow = AssertAllKeysHandled<Exclude<ParkRowKeys, ParkRowProjected | ParkRowWithheld>>;
-type _NoDoubleBookParkRow = AssertAllKeysHandled<Extract<ParkRowProjected, ParkRowWithheld>>;
-type _GuardParkRowReverse = AssertAllKeysHandled<Exclude<ParkRowProjected | ParkRowWithheld, ParkRowKeys>>;
+type WorkflowTables = typeof import("../http/routes/workflows.js");
+type _GuardWorkflowRun = AssertAllKeysHandled<Exclude<keyof WorkflowRun, TableCoreKeys<WorkflowTables["WORKFLOW_RUN_DISPOSITIONS"]>>>;
+type _GuardWorkflowRunReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_RUN_DISPOSITIONS"]>, keyof WorkflowRun>>;
+type _GuardWorkflowParkRow = AssertAllKeysHandled<Exclude<keyof NonNullable<WorkflowRun["parks"]>[number], TableCoreKeys<WorkflowTables["WORKFLOW_PARK_ROW_DISPOSITIONS"]>>>;
+type _GuardWorkflowParkRowReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_PARK_ROW_DISPOSITIONS"]>, keyof NonNullable<WorkflowRun["parks"]>[number]>>;
+type _GuardWorkflowPhase = AssertAllKeysHandled<Exclude<keyof WorkflowRun["phases"][number], TableCoreKeys<WorkflowTables["WORKFLOW_PHASE_DISPOSITIONS"]>>>;
+type _GuardWorkflowPhaseReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_PHASE_DISPOSITIONS"]>, keyof WorkflowRun["phases"][number]>>;
+type _GuardWorkflowAgent = AssertAllKeysHandled<Exclude<keyof WorkflowRun["agents"][number], TableCoreKeys<WorkflowTables["WORKFLOW_AGENT_DISPOSITIONS"]>>>;
+type _GuardWorkflowAgentReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_AGENT_DISPOSITIONS"]>, keyof WorkflowRun["agents"][number]>>;
+type _GuardWorkflowAgentActivity = AssertAllKeysHandled<Exclude<keyof NonNullable<WorkflowRun["agents"][number]["activity"]>[number], TableCoreKeys<WorkflowTables["WORKFLOW_AGENT_ACTIVITY_DISPOSITIONS"]>>>;
+type _GuardWorkflowAgentActivityReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_AGENT_ACTIVITY_DISPOSITIONS"]>, keyof NonNullable<WorkflowRun["agents"][number]["activity"]>[number]>>;
+type _GuardWorkflowAgentPendingApproval = AssertAllKeysHandled<Exclude<keyof NonNullable<WorkflowRun["agents"][number]["pendingApproval"]>, TableCoreKeys<WorkflowTables["WORKFLOW_AGENT_PENDING_APPROVAL_DISPOSITIONS"]>>>;
+type _GuardWorkflowAgentPendingApprovalReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_AGENT_PENDING_APPROVAL_DISPOSITIONS"]>, keyof NonNullable<WorkflowRun["agents"][number]["pendingApproval"]>>>;
+type _GuardWorkflowGroup = AssertAllKeysHandled<Exclude<keyof WorkflowRun["groups"][number], TableCoreKeys<WorkflowTables["WORKFLOW_GROUP_DISPOSITIONS"]>>>;
+type _GuardWorkflowGroupReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_GROUP_DISPOSITIONS"]>, keyof WorkflowRun["groups"][number]>>;
+type _GuardWorkflowRunStats = AssertAllKeysHandled<Exclude<keyof WorkflowRun["stats"], TableCoreKeys<WorkflowTables["WORKFLOW_RUN_STATS_DISPOSITIONS"]>>>;
+type _GuardWorkflowRunStatsReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_RUN_STATS_DISPOSITIONS"]>, keyof WorkflowRun["stats"]>>;
+type _GuardWorkflowRunStatsNested = AssertAllKeysHandled<Exclude<keyof WorkflowRun["stats"]["nested"], TableCoreKeys<WorkflowTables["WORKFLOW_RUN_STATS_NESTED_DISPOSITIONS"]>>>;
+type _GuardWorkflowRunStatsNestedReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_RUN_STATS_NESTED_DISPOSITIONS"]>, keyof WorkflowRun["stats"]["nested"]>>;
 type ReadRootCandidateProjected = "dir" | "clearsThisAsk" | "covers";
 type _GuardReadRootCandidate = AssertAllKeysHandled<Exclude<keyof ReadRootGrantCandidate, ReadRootCandidateProjected>>;
 type _GuardReadRootCandidateReverse = AssertAllKeysHandled<Exclude<ReadRootCandidateProjected, keyof ReadRootGrantCandidate>>;
@@ -321,11 +386,15 @@ export type CoreKeysetGuards = [
     _GuardWiringModelGateReverse,
     _GuardWiringAutoMode,
     _GuardWiringAutoModeReverse,
+    _GuardWiringPermissionMode,
+    _GuardWiringPermissionModeReverse,
     _GuardWiringGovernance,
     _GuardWiringGovernanceReverse,
     _GuardPermissionTrace,
     _GuardPermissionTraceReverse,
-    _GuardPromptManifestNotOnRowReverse,
+    _GuardPromptManifestKeys,
+    _GuardPromptManifestKeysReverse,
+    _GuardPromptManifestKeysNonEmpty,
     _GuardPermissionTraceNonEmpty,
     _GuardInboxSummary,
     _GuardInboxSummaryReverse,
@@ -352,9 +421,22 @@ export type CoreKeysetGuards = [
     _GuardSettlementWhoReverse,
     _GuardWorkflowRun,
     _GuardWorkflowRunReverse,
-    _GuardParkRow,
-    _NoDoubleBookParkRow,
-    _GuardParkRowReverse,
+    _GuardWorkflowParkRow,
+    _GuardWorkflowParkRowReverse,
+    _GuardWorkflowPhase,
+    _GuardWorkflowPhaseReverse,
+    _GuardWorkflowAgent,
+    _GuardWorkflowAgentReverse,
+    _GuardWorkflowAgentActivity,
+    _GuardWorkflowAgentActivityReverse,
+    _GuardWorkflowAgentPendingApproval,
+    _GuardWorkflowAgentPendingApprovalReverse,
+    _GuardWorkflowGroup,
+    _GuardWorkflowGroupReverse,
+    _GuardWorkflowRunStats,
+    _GuardWorkflowRunStatsReverse,
+    _GuardWorkflowRunStatsNested,
+    _GuardWorkflowRunStatsNestedReverse,
     _GuardReadRootCandidate,
     _GuardReadRootCandidateReverse,
     _GuardRiskAxes,

package/dist/trace/exit-seat.d.ts

@@ -0,0 +1,28 @@
+/** 品牌键:模块私有的 `unique symbol` —— 别处写不出这个键,于是写不出一个 `SafeText` 字面量;断言伪造由普查门在语法树上拦。 */
+declare const SAFE_TEXT: unique symbol;
+/** 经出口座的文本。是 `string` 的子型:读者零改;写进出口位只能用 {@link seatText} 铸的值。 */
+export type SafeText = string & {
+    readonly [SAFE_TEXT]: true;
+};
+/**
+ * **座表(闭集;一行 = 一类出口)**。加一类出口 = 加一行;表外的座名是编译错误。
+ *  · `trace-frame-text`:trace 帧的自由文本位(子代名 / 动作行 / 通告正文与结果 / 诊断 / 注入摘录 / 压缩说明 / 人类输入的署名与附件标签 …),不设界;
+ *  · `trace-frame-line`:trace 帧里一行宽的展示位(`workspace_changed.cwd` / `brain_status.detail`),界 300 码元。
+ */
+declare const EXIT_SEATS: {
+    readonly "trace-frame-text": {
+        readonly scope: "free-text";
+    };
+    readonly "trace-frame-line": {
+        readonly scope: "free-text";
+        readonly maxChars: 300;
+    };
+};
+export type ExitSeat = keyof typeof EXIT_SEATS;
+/**
+ * 出口座:`seat` 是座表的一行,`text` 是要出门的自由文本。返回的 {@link SafeText} 就是这个出口该写出去的字节。
+ * 表外的座名(只有绕过类型才到得了)⇒ 抛 —— 那是调用方的编程错,不是脱敏失败,不吞成占位。
+ */
+export declare function seatText(seat: ExitSeat, text: string): SafeText;
+export {};
+//# sourceMappingURL=exit-seat.d.ts.map

package/dist/trace/exit-seat.js

@@ -0,0 +1,76 @@
+import { errorKindOf } from "../observability/err-text.js";
+import { recordFailOpen } from "../observability/fail-open.js";
+import { OVERSIZED_REDACTION_PLACEHOLDER } from "../observability/run-terminal.js";
+import { proposeRedactionSpans, REDACTION_TOKEN_RE_SRC } from "./redact.js";
+const EXIT_SEATS = {
+    "trace-frame-text": { scope: "free-text" },
+    "trace-frame-line": { scope: "free-text", maxChars: 300 },
+};
+const SEAT_ROWS = new Map(Object.entries(EXIT_SEATS));
+for (const [name, row] of SEAT_ROWS) {
+    if (row.maxChars !== undefined && row.maxChars < OVERSIZED_REDACTION_PLACEHOLDER.length) {
+        throw new Error(`exit seat "${name}": maxChars ${row.maxChars} cannot hold the failure placeholder (${OVERSIZED_REDACTION_PLACEHOLDER.length} code units)`);
+    }
+}
+function mergeSpans(spans) {
+    const order = spans.map((s, i) => ({ s, i })).sort((a, b) => a.s.start - b.s.start || b.s.end - a.s.end || a.i - b.i);
+    const out = [];
+    for (const { s } of order) {
+        const last = out[out.length - 1];
+        if (last === undefined || s.start > last.end)
+            out.push(s);
+        else if (s.end > last.end)
+            out[out.length - 1] = { start: last.start, end: s.end, repl: last.repl };
+    }
+    return out;
+}
+const TOKEN_AT = new RegExp(REDACTION_TOKEN_RE_SRC, "y");
+function cutPlain(gap, room) {
+    let cut = room;
+    const hi = gap.charCodeAt(cut - 1);
+    if (cut > 0 && hi >= 0xd800 && hi <= 0xdbff && (gap.charCodeAt(cut) & 0xfc00) === 0xdc00)
+        cut -= 1;
+    const open = cut > 0 ? gap.lastIndexOf("«", cut - 1) : -1;
+    if (open !== -1) {
+        TOKEN_AT.lastIndex = open;
+        const m = TOKEN_AT.exec(gap);
+        if (m !== null && open + m[0].length > cut)
+            cut = open;
+    }
+    return gap.slice(0, cut);
+}
+function renderOnce(text, groups, maxChars) {
+    const parts = [];
+    let len = 0;
+    let at = 0;
+    for (const g of groups) {
+        const gap = text.slice(at, g.start);
+        if (maxChars !== undefined && len + gap.length > maxChars)
+            return parts.join("") + cutPlain(gap, maxChars - len);
+        parts.push(gap);
+        len += gap.length;
+        if (maxChars !== undefined && len + g.repl.length > maxChars)
+            return parts.join("");
+        parts.push(g.repl);
+        len += g.repl.length;
+        at = g.end;
+    }
+    const tail = text.slice(at);
+    parts.push(maxChars === undefined || len + tail.length <= maxChars ? tail : cutPlain(tail, maxChars - len));
+    return parts.join("");
+}
+export function seatText(seat, text) {
+    const row = SEAT_ROWS.get(seat);
+    if (row === undefined)
+        throw new Error(`exit seat: ${JSON.stringify(seat)} is not a row of the seat table`);
+    let out;
+    try {
+        out = renderOnce(text, mergeSpans(proposeRedactionSpans(text, row.scope)), row.maxChars);
+    }
+    catch (err) {
+        recordFailOpen("server.run-terminal.redact-threw", `seat=${seat} len=${typeof text === "string" ? text.length : -1} err=${errorKindOf(err)}`);
+        out = OVERSIZED_REDACTION_PLACEHOLDER;
+    }
+    return out;
+}
+//# sourceMappingURL=exit-seat.js.map

package/dist/trace/ledger-events.d.ts

@@ -55,8 +55,9 @@ export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" |
  | "suspended" | "needs_review" | "done" | "failed" | "suggestions" | "model_usage" | "prompt_assembled" | "config_assembled" | "file_link"
 /** 人在环三族的 open/close 帧对(投递面 = 本腿的 durable events tail)。 */
  | "elicitation" | "elicitation_complete" | "question" | "question_complete" | "tool_approval" | "tool_approval_complete"
-/** [ref] §4.3 新协议的呈卡帧(与上面两只 tool_approval 帧同一条投递面)。 */
- | "approval_request"
+/** [ref] §4.3 呈卡族的开卡帧与单卡消卡帧(与上面两只 tool_approval 帧同一条投递面;一条腿只发其中一族,
+ *  bg / resume 两条 durable 腿恒是呈卡腿 ⇒ 它们的账本自 7.133.0 起只有本族)。 */
+ | "approval_request" | "approval_complete"
 /**
  * [ref]([ref]):批级撤卡帧在 **bg/resume 两条 durable 腿**的账本落行(与呈卡帧同口
  * `append(type, rest)`,seq 由腿自己的 ledger 链步分配)。此前成文「reaper/收敛器无 seq 可分配故

package/dist/trace/project.d.ts

@@ -26,6 +26,7 @@
 import type { GateOutcome, McpDelivered, TaskResult, SystemInjectionPriority } from "@sema-agent/core";
 import type { RunEvent, RunRecord } from "../plugins/store-contracts.js";
 import type { ModelUsageDelta, ModelUsageTracker, PromptManifestRecord } from "../budget.js";
+import { type SafeText } from "./exit-seat.js";
 import { type SemaProvenanceInput } from "./sema-provenance.js";
 import type { LedgerEventType } from "./ledger-events.js";
 import type { InstructionsSegment } from "../instruction-selection.js";
@@ -81,6 +82,13 @@ export declare function attachModelUsage<T extends TaskResult>(result: T, ctx: {
  *   · **键在场但值坏**(NaN / 字符串 / null)= 数据损坏,写了键的 producer 是在声称自己知道 ⇒ 维持既有
  *     折叠(按 0 计,不传染,已知量不受损),否则一条陈年坏行就能把整个模型的成本抹成"未知"。
  *  下游补偿件早已就位:usage-analytics 的 numOf + `estimated` 标记(缺数值键 ⇒ 总量偏低并诚实标注)。 */
+/** **trace 帧数据的出口形**(RH-1 第一期):`Slots` 里列出的自由文本位只收 {@link SafeText}(出口座铸的),其余键照旧开放 ——
+ *  裸 `string` 写进这些位是 tsc 红;整只帧数据**只读**(交出去之后按键改写 —— 含动态键 `frame[k] = raw` —— 也是 tsc 红)。
+ *  对既有的 `Record<string, unknown>` 读者可赋值(零调用点改动)。类型层管不到的两形如实记:`any` 值、以及把一只 `Record<string, unknown>`
+ *  展开进字面量 / `Object.assign` 事后改写(TypeScript 不拿索引签名去对可选位、也不查 `Object.assign` 的目标)—— 品牌推到汇(SSE 写口 / 账本 append)是第三期。 */
+type FrameData<Slots extends object> = Readonly<Slots> & {
+    readonly [key: string]: unknown;
+};
 export declare function aggregateModelUsage(events: RunEvent[]): Record<string, ModelUsageDelta> | undefined;
 export type TraceBlock = {
     type: "thinking";
@@ -373,7 +381,11 @@ export declare function taskProgressEventData(ev: {
     workflowAgentLabel?: string;
     seq?: number;
     model?: string;
-}): Record<string, unknown>;
+}): FrameData<{
+    name?: SafeText;
+    currentAction?: SafeText;
+    workflowAgentLabel?: SafeText;
+}>;
 /**
  * The `task_started` payload(core 7.50.0):一只委派子代**起跑**的那一帧 —— 每周期一只(首派 / 复活;耐久续跑腿不铸),
  * 序在子代的 `wiring_manifest` 之后、它的首个 `task_progress` 与首次模型请求之前。
@@ -414,7 +426,10 @@ export declare function taskStartedEventData(ev: {
     startedAt: number;
     eventId?: string;
     parentToolCallId?: string;
-}): Record<string, unknown>;
+}): FrameData<{
+    name?: SafeText;
+    workflowAgentLabel?: SafeText;
+}>;
 /** The `task_notification` payload (core 1.202 [ref] P2: a background task finished — this event is the
  *  LEDGER/display projection of the OBSERVED terminal state, emitted the moment core observes it. It does NOT
  *  attest that the `<task-notification>` XML has entered the model context: core's steer targets the NEXT TURN
@@ -492,7 +507,28 @@ export declare function taskNotificationEventData(ev: {
      *  **事件顶层**键,不是 {@link TaskNotificationPayload} 的键,所以只有把整只 core 事件交给本投影的腿
      *  拿得到它;只拿到载荷的 park-drain 腿结构上没有这一位。 */
     priority?: SystemInjectionPriority;
-}): Record<string, unknown>;
+}): FrameData<{
+    summary: SafeText;
+    result?: SafeText;
+    output_file?: SafeText;
+    source?: SafeText;
+    diagnostics?: SafeText;
+    error?: SafeText;
+    lines?: SafeText[];
+    recentSteps?: Array<{
+        tool: string;
+        target: SafeText;
+        outcome: SafeText;
+    }>;
+    editedFiles?: Array<{
+        path: SafeText;
+        edits: number;
+    }>;
+    agentMessage?: {
+        from: string;
+        body: SafeText;
+    };
+}>;
 /** The `compacted` payload — EXPLICIT WHITELIST shared by all three legs (bg runs.ts + resume append + the sync
  *  live SSE frame; the 1.72 task_progress lesson: never `{...ev}`). trigger/tokensBefore (MF-18) verbatim;
  *  `preserved_segment.firstKeptEntryId` verbatim (a core-mint entryId, the shell's compaction-divider anchor);
@@ -519,7 +555,16 @@ export declare function diagnosticsEventData(ev: {
     isNew: boolean;
     eventId?: string;
     parentToolCallId?: string;
-}): Record<string, unknown>;
+}): FrameData<{
+    files: Array<{
+        uri: SafeText;
+        diagnostics: Array<FrameData<{
+            message: SafeText;
+            code?: SafeText | number;
+            source?: SafeText;
+        }>>;
+    }>;
+}>;
 /** The `steering_injected` payload([ref]/[ref] 裁定透传;core `TaskEvent` 联合臂 `type: "steering_injected"`,
  *  shell 渲染源 = CC 的系统提醒条:core 在 turn 之间给模型注入一条系统提示[todo 提醒/文件变化/日期跨天/
  *  技能列表变化…]时随手抛的展示投影,一附件一帧)。EXPLICIT WHITELIST(source=封闭枚举 verbatim;
@@ -530,7 +575,9 @@ export declare function steeringInjectedEventData(ev: {
     preview: string;
     eventId?: string;
     parentToolCallId?: string;
-}): Record<string, unknown>;
+}): FrameData<{
+    preview: SafeText;
+}>;
 /** `compaction_outcome`(core 2.5.0 [ref]②:压缩非 compacted 结局——manual /compact 的 mooted/failed
  *  两条真路)。[ref]A-2/C-2:此前它是**唯一**不走共享 builder、只在 live 腿 res.write 内联挑键的
  *  内容帧 ⇒ 两条 durable 腿零 case、回放即消失、三方普查各自失明。收进共享白名单 builder,三腿同源。
@@ -542,7 +589,9 @@ export declare function compactionOutcomeEventData(ev: {
     pass?: unknown;
     eventId?: unknown;
     parentToolCallId?: unknown;
-}): Record<string, unknown>;
+}): FrameData<{
+    reason?: SafeText;
+}>;
 /**
  * `compaction_started`(S-1732,core 7.53.0 #2008)—— 一次压缩 pass 在提交点(触发闸过了、切点在、`preCompact` 没拦)宣告开始,先于摘要调用:
  * 一次在供应方重试表里等很久的摘要(core 实测 503 × 11、173 s)从此在流上不是静默的。**原样投影**:`{ trigger, pass, startedAt }` + 身份两键,
@@ -567,7 +616,9 @@ export declare function workspaceChangedEventData(ev: {
     cwd: string;
     eventId?: string;
     parentToolCallId?: string;
-}): Record<string, unknown>;
+}): FrameData<{
+    cwd: SafeText;
+}>;
 /**
  * `wiring_manifest`(core 5.14.0 [ref] 新 `TaskEvent` 臂)—— 每条腿(root/child/resume)在 prepare
  * 时自证「我到底接了什么线」的清单帧。
@@ -802,8 +853,8 @@ export declare function wiringManifestEventData(ev: {
  * 代价是 operator 看不到历史腿的 governance 段 —— 治理四布尔是部署形事实(不随 leg 漂),静态自检面
  * (`GET /v1/diagnostics/wiring`)随时给出当前真值。
  *
- * 准入判据是 `explicitOperatorOk`(**不是** `isOperator`):空 `OPERATOR_PRINCIPALS` 必须是「没有人是
- * operator」,不能是「所有人都是」—— 后者会让一个没配 operator 名单的部署把治理面发给每一个订阅者。
+ * 准入判据是 `explicitOperatorOk`(「谁是 operator」的唯一读法):空 `OPERATOR_PRINCIPALS` 是「没有人是 operator」,不是「所有人都是」——
+ * 后者会让一个没配 operator 名单的部署把治理面发给每一个订阅者。单用户形显式声明 `OPERATOR_SINGLE_USER=true` 时它的每个调用方都是。
  *
  * `configFingerprint` 只在本构造器里透传:它是 `sha256(canonicalize(manifest 去 leg/去两个 provenance))`
  * 前 16 hex,**无盐**且输入含整个 governance 段,而 governance 只有 4 个布尔 ⇒ 16 种组合。租户手里已有其余
@@ -885,7 +936,16 @@ export declare function humanInputEventData(ev: {
     attachments?: unknown;
     eventId?: unknown;
     parentToolCallId?: unknown;
-}): Record<string, unknown>;
+}): FrameData<{
+    issuer?: SafeText;
+    actor?: FrameData<{
+        id?: SafeText;
+        issuer?: SafeText;
+    }>;
+    attachments?: Array<FrameData<{
+        label?: SafeText;
+    }>>;
+}>;
 /** S4 (SILENT-FALLBACK P0-a): the durable `brain_status` observation row, shared by the bg + resume append
  *  sites. core marks the live `status` frame EPHEMERAL (never replayed by core on resume) — this row is the
  *  SERVICE's own observation record (why a turn stalled: rate_limited/retrying/reconnecting/circuit_open, and
@@ -907,7 +967,9 @@ export declare function brainStatusEventData(ev: {
     providerConditionSource?: string;
     eventId?: string;
     parentToolCallId?: string;
-}): Record<string, unknown>;
+}): FrameData<{
+    detail?: SafeText;
+}>;
 export declare function compactedEventData(ev: {
     eventId?: string;
     parentToolCallId?: string;
@@ -945,7 +1007,13 @@ export declare function compactedEventData(ev: {
     };
     /** S-1732(core 7.53.0 #2008):这次落地的压缩 pass 的 id —— 与它的 `compaction_started` 帧同一个值(引擎在每次落地上都设;型上可选)。逐字。 */
     pass?: string;
-}): Record<string, unknown>;
+}): FrameData<{
+    attachedFiles?: Array<{
+        path: SafeText;
+        chars: number;
+        truncated: boolean;
+    }>;
+}>;
 export interface TraceTurn {
     /** per-task seq = the turn's terminating event seq (so history-up-to-H splices with stream seq>H). */
     seq: number;