@sema-agent/server 7.132.0 → 7.133.0

package/dist/boot/resolve-spec.js

@@ -1,11 +1,11 @@
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
-import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE, deriveAskEffective, expandTiers, modePolicyOf, resolveAskSeamForm } from "@sema-agent/core";
+import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, deriveAskEffective, expandTiers, modePolicyOf, resolveAskSeamForm } from "@sema-agent/core";
 import { cappedCeiling } from "../budget.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
-import { buildPromptSeats, createScenarioGate, mergeUserSkills, selectScenario } from "../capabilities/scenarios.js";
+import { buildExcludeToolsSeat, buildPromptSeats, createScenarioGate, mergeUserSkills, selectScenario } from "../capabilities/scenarios.js";
 import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildApprovalGrantNotice, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
@@ -17,7 +17,7 @@ import { HOST_POSTURE_REFUSED_CODE, taskInheritEnvRefusal, taskWriteFaceRefusal
 import { headerStr } from "../http/principal-gate.js";
 import { explicitOperatorOk } from "../http/server.js";
 import { isAtMentionable, matchCatalogModel, modelSupportsImages, refusedCatalogEntry, resolveTaskModel, selectableCatalog, terminalCatalogName } from "../model-select.js";
-import { modelUnavailableMessage } from "../model-entry-refusal.js";
+import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { PerTaskImageRegistry, resolveSandboxImageRef } from "../per-task-image.js";
 import { isRemoteScratchpadLane, remoteScratchpadDirFor } from "../plugins/remote-scratchpad.js";
 import { bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
@@ -27,7 +27,9 @@ import { tightenGoverned } from "../governance-overrides.js";
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { applyRuntimeGovernance } from "../runtime-governance.js";
 import { HttpError, createCodedHttpError, encodeCheckpointScope } from "../security.js";
-import { memoryProjectKeyFor, memorySpecForRequest } from "../memory-scope.js";
+import { sessionFaceReadOf } from "../session-incarnation.js";
+import { memorySpecForRequest } from "../memory-scope.js";
+import { createMemoryProjectLayers } from "../memory-project-layer.js";
 import { inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { a2aForScenario, mcpForScenario } from "../web-admin-client/facade.js";
 import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptProfileFromBody, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolMaterializeStrategyFromBody, allowToolsSpecFragment, toolNameListFromBody } from "../spec-fields.js";
@@ -37,17 +39,21 @@ import { assertRequestA2aUnlocked, resolveRequestA2a } from "../task-a2a.js";
 import { assertRequestMcpEntries, assertRequestMcpUnlocked, resolveRequestMcp } from "../task-mcp.js";
 import { storedToolAxesRereadM19 } from "../stored-request-tool-axes-m19.js";
 import { storedHooksRereadM20 } from "../stored-request-hooks-m20.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, REQUEST_SETTINGS_REFUSAL_PREFIX, acceptAppendSystemPrompt, applyTaskSettings, effectivePermissionMode, effectiveThinking, parseTaskSettings, taskHooksHonored, settingsPermissionBucketIssue, withPermissionMode } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_RULE_REFUSAL_CODE, SettingsRuleRefusalError, acceptAppendSystemPrompt, applyTaskSettings, createWorkflowAskPolicy, effectivePermissionMode, effectiveThinking, parseTaskSettings, taskHooksHonored, settingsPermissionBucketIssue } from "../task-settings.js";
+import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
+import { entryProblemsFacts } from "../entry-problems.js";
 import { inertToolListEntryOf } from "../rule-entry-list.js";
 import { TENANCY_WALL_CLOCK_BASE_SEC, enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
-import { executionLaneCaps, executionLaneHomeDir, executionLaneOf } from "../execution-lane-caps.js";
+import { executionLaneHomeDir, executionLaneOf, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
+import { fieldConflictFacts } from "../field-conflict.js";
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
     const scenarioGate = createScenarioGate({ config, scenarios, principalCaps, logger }, "enforce");
+    const readSessionFace = sessionFaceReadOf(ownerAware);
     assertGuardPatternsUsable(config);
     const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, {
         approvalSeat: durableEnabled ? "durable" : "absent",
@@ -59,6 +65,7 @@ export function createResolveSpec(ctx) {
         const sessionCwd = auth?.sessionId ? effectiveHostWorkspace(perSessionCwd.get(auth.sessionId), {}) : undefined;
         return sessionCwd ?? (config.remoteExec === undefined ? process.cwd() : undefined);
     };
+    const memoryProjectLayers = createMemoryProjectLayers({ backend: memoryEngine?.backend, syncRunner: memorySyncRunner, log: logger });
     if (onlySensitiveBaseline)
         logger.warn(onlySensitiveBaseline.event, onlySensitiveBaseline.fields);
     const approvalGrantNotice = buildApprovalGrantNotice(config);
@@ -81,7 +88,7 @@ export function createResolveSpec(ctx) {
                 cwdHonored: cwdHonored(config),
             });
             if (conflict) {
-                throw new HttpError(400, `cwd "${conflict.cwd.asSpelled}" is inside this session's scratchpad "${conflict.scratchpadDir.asSpelled}" — the scratchpad is the fs-write gate's EXEMPT directory, so a task rooted there would auto-approve every write under its own root and the engine refuses to build the gate at all (config.write_exempt_dir_covers_root). Point cwd at the project directory instead (or send no cwd and let the session keep the one it has): this session registers the cwd you send, so a task that happens not to mount the write gate would still leave every LATER task on this session rooted in the exemption. A workflow that really is meant to write without prompts says so with a knob that means it (a permission mode, an open write face) and still keeps its root outside the scratchpad — those knobs do not lift this refusal, because the conflict is between two fields of this request, not a permission level.`, { code: "request.field_conflict", extra: { cwd: conflict.cwd, scratchpadDir: conflict.scratchpadDir } });
+                throw new HttpError(400, `cwd "${conflict.cwd.asSpelled}" is inside this session's scratchpad "${conflict.scratchpadDir.asSpelled}" — the scratchpad is the fs-write gate's EXEMPT directory, so a task rooted there would auto-approve every write under its own root and the engine refuses to build the gate at all (config.write_exempt_dir_covers_root). Point cwd at the project directory instead (or send no cwd and let the session keep the one it has): this session registers the cwd you send, so a task that happens not to mount the write gate would still leave every LATER task on this session rooted in the exemption. A workflow that really is meant to write without prompts says so with a knob that means it (a permission mode, an open write face) and still keeps its root outside the scratchpad — those knobs do not lift this refusal, because the conflict is between two fields of this request, not a permission level.`, { code: "request.field_conflict", extra: { ...fieldConflictFacts("scratchpad_root", body.scratchpadDir === conflict.scratchpadDir.asSpelled ? ["cwd", "scratchpadDir"] : ["cwd"]), cwd: conflict.cwd, scratchpadDir: conflict.scratchpadDir } });
             }
         }
         const offFieldIssue = singleMemberOffFieldIssue(body);
@@ -109,6 +116,11 @@ export function createResolveSpec(ctx) {
             if (bucketIssue)
                 throw new HttpError(400, bucketIssue.message, { code: "request.field_invalid", extra: bucketIssue.fields });
         }
+        {
+            const seatIssue = tightenOnlySeatIssue(body.settings);
+            if (seatIssue)
+                throw new HttpError(400, seatIssue.message, { code: "request.field_invalid", extra: seatIssue.fields });
+        }
         {
             const replay = opts?.leg === "resume";
             const inertList = inertToolListEntryOf(body, replay ? ["deny"] : undefined);
@@ -136,8 +148,9 @@ export function createResolveSpec(ctx) {
         }
         const lane = bindSettingsCwdEnvAndModel(body, auth, gated, opts);
         const anchors = await resolveHistoryAnchors(body, auth);
-        const spec = assembleSpecLiteral(body, auth, req, opts, { ...gated, ...lane, ...anchors }, effMode);
-        const folded = await foldGovernanceAndSettings(body, auth, spec, gated, effMode);
+        const projectKey = memoryEngine ? await memoryProjectLayers.prepare(config, auth?.memoryScope, realTaskRootOf(auth)) : undefined;
+        const spec = assembleSpecLiteral(body, auth, req, opts, { ...gated, ...lane, ...anchors, projectKey }, effMode);
+        const folded = await foldGovernanceAndSettings(body, auth, spec, gated);
         const final = await applyImageFactsAndRouting(body, auth, folded.governed, {
             scenarioName: gated.scenarioName,
             scratchpadDir: folded.scratchpadDir,
@@ -149,7 +162,7 @@ export function createResolveSpec(ctx) {
     const gateScenarioAndAppend = async (body, auth, opts) => {
         const scenarioName = await scenarioGate(auth?.principal, body.scenario);
         gateExecutionLane(await principalCaps?.executionRuling(auth?.principal), executionLaneOf(config.remoteExec?.provider), logger);
-        const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, auth?.sessionId !== undefined ? { sessionId: auth.sessionId } : {});
+        const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, auth?.sessionId !== undefined ? { sessionId: auth.sessionId, delegationRoot: { sessionId: auth.sessionId, incarnation: (await readSessionFace?.(auth.sessionId))?.incarnation ?? null } } : {});
         const acceptedAppend = acceptAppendSystemPrompt(body.appendSystemPrompt, (detail) => logger.warn("append_system_prompt_dropped", { detail, sessionId: auth?.sessionId ?? null }));
         const objective = typeof body.objective === "string" ? body.objective : "";
         const parsedSettings = parseTaskSettings(body.settings, opts?.leg === "fresh" || !taskHooksHonored(config) ? {} : { storedHooksReread: storedHooksRereadM20(new Date().toISOString().slice(0, 10)) });
@@ -274,22 +287,22 @@ export function createResolveSpec(ctx) {
         if (picked.unavailable !== undefined) {
             const { requested, name, refusal, source } = picked.unavailable;
             if (opts?.leg === "fresh") {
-                throw new HttpError(400, modelUnavailableMessage(source === "mention" ? "@-mention" : "model", requested.slice(0, 120), name, refusal), { code: "request.model_unavailable" });
+                throw new HttpError(400, modelUnavailableMessage(source === "mention" ? "@-mention" : "model", requested, name, refusal), { code: "request.model_unavailable" });
             }
             metrics.inc("task_model_unavailable_fallback_total");
-            logger.warn("task_model_unavailable_fallback", { requested: requested.slice(0, 120), name, code: refusal.code, source, fallback: picked.model, sessionId: auth?.sessionId ?? null });
+            logger.warn("task_model_unavailable_fallback", { requested: echoModelRef(requested), name, code: refusal.code, source, fallback: picked.model, sessionId: auth?.sessionId ?? null });
         }
         if (picked.notAllowed !== undefined) {
             const { requested, resolved, source } = picked.notAllowed;
             if (opts?.leg === "fresh") {
-                throw new HttpError(400, `model "${requested.slice(0, 120)}" is not @-mentionable on this deployment (it resolves to catalog model "${resolved}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
+                throw new HttpError(400, `model "${echoModelRef(requested)}" is not @-mentionable on this deployment (it resolves to catalog model "${resolved}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
             }
             metrics.inc("task_model_not_allowlisted_resume_total");
-            logger.warn("task_model_not_allowlisted_resume", { requested: requested.slice(0, 120), resolved, source, sessionId: auth?.sessionId ?? null, note: "resumed leg keeps running the model it was started on — the allowlist gates fresh picks only" });
+            logger.warn("task_model_not_allowlisted_resume", { requested: echoModelRef(requested), resolved, source, sessionId: auth?.sessionId ?? null, note: "resumed leg keeps running the model it was started on — the allowlist gates fresh picks only" });
         }
         if (picked.unknownExplicit !== undefined) {
             metrics.inc("task_model_unknown_fallback_total");
-            logger.warn("task_model_unknown_fallback", { requested: picked.unknownExplicit.slice(0, 120), fallback: picked.model, sessionId: auth?.sessionId ?? null });
+            logger.warn("task_model_unknown_fallback", { requested: echoModelRef(picked.unknownExplicit), fallback: picked.model, sessionId: auth?.sessionId ?? null });
         }
         if (Array.isArray(body.images) && body.images.length > 0 && !modelSupportsImages(wireCatalog[picked.model])) {
             metrics.inc("images_omitted_total", { model: picked.model });
@@ -338,7 +351,7 @@ export function createResolveSpec(ctx) {
         return deriveAskEffective(askForm.form, "unresolved") === "human_reachable";
     };
     const assembleSpecLiteral = (body, auth, req, opts, parts, effMode) => {
-        const { scenarioName, cap, hands, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, } = parts;
+        const { scenarioName, cap, hands, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, projectKey, } = parts;
         const storedToolAxes = opts?.leg === "fresh" ? undefined : storedToolAxesRereadM19(new Date().toISOString().slice(0, 10));
         const spec = {
             objective: attachmentNotice ? `${picked.cleanedObjective}\n\n${attachmentNotice}` : picked.cleanedObjective,
@@ -380,7 +393,7 @@ export function createResolveSpec(ctx) {
                 ? { retainBackgroundProcesses: true }
                 : {}),
             ...(body.excludeAllTools === true ? { excludeAllTools: true } : {}),
-            ...(() => { const v = toolNameListFromBody(body.excludeTools); return v ? { excludeTools: v } : {}; })(),
+            ...buildExcludeToolsSeat(cap.excludeTools, toolNameListFromBody(body.excludeTools)),
             ...allowToolsSpecFragment(body.allowTools),
             ...(() => { const v = toolNameListFromBody(body.deferTools); return v ? { deferTools: v } : {}; })(),
             ...(() => { const v = promptProfileFromBody(body.promptProfile); return v ? { promptProfile: v } : {}; })(),
@@ -389,7 +402,7 @@ export function createResolveSpec(ctx) {
             ...(declaresInteractivePosture(body, req, opts) ? { interactionPosture: "interactive" } : {}),
             ...(body.approvalReach !== undefined ? { approvalReach: body.approvalReach } : {}),
             ...(typeof body.oneShot === "boolean" ? { oneShot: body.oneShot } : {}),
-            resilience: normalizeResilience(body.resilience, explicitOperatorOk(auth?.principal, config.operatorPrincipals)),
+            resilience: normalizeResilience(body.resilience, explicitOperatorOk(auth?.principal, config)),
             finalVerification: cap.finalVerification === true || body.finalVerification === true ? true : undefined,
             attachments: normalizeAttachments(body.attachments),
             ...(taskHooks ? { mods: [taskHooks] } : {}),
@@ -400,23 +413,23 @@ export function createResolveSpec(ctx) {
                 const cm = matchCatalogModel(body.compactionModel, wireCatalog, config.modelRefusals);
                 const refusedCm = cm === undefined ? refusedCatalogEntry(body.compactionModel, config.modelRefusals) : undefined;
                 if (refusedCm !== undefined && opts?.leg === "fresh") {
-                    throw new HttpError(400, modelUnavailableMessage("compactionModel", body.compactionModel.slice(0, 120), refusedCm.name, refusedCm.refusal), { code: "request.model_unavailable" });
+                    throw new HttpError(400, modelUnavailableMessage("compactionModel", body.compactionModel, refusedCm.name, refusedCm.refusal), { code: "request.model_unavailable" });
                 }
                 if (cm === undefined) {
                     if (opts?.leg === "fresh") {
-                        throw new HttpError(400, `unknown compactionModel "${body.compactionModel.slice(0, 120)}" — not in the configured catalog (name, tier word, or id; a catalog refresh may have removed it mid-request)`);
+                        throw new HttpError(400, `unknown compactionModel "${echoModelRef(body.compactionModel)}" — not in the configured catalog (name, tier word, or id; a catalog refresh may have removed it mid-request)`);
                     }
                     metrics.inc("task_model_unknown_fallback_total");
-                    logger.warn("compaction_model_unknown_fallback", { requested: body.compactionModel.slice(0, 120), sessionId: auth?.sessionId ?? null });
+                    logger.warn("compaction_model_unknown_fallback", { requested: echoModelRef(body.compactionModel), sessionId: auth?.sessionId ?? null });
                     return {};
                 }
                 if (!isAtMentionable(cm, wireCatalog, config.atMention, config.modelRefusals)) {
                     const terminal = terminalCatalogName(cm, wireCatalog, config.modelRefusals) ?? cm;
                     if (opts?.leg === "fresh") {
-                        throw new HttpError(400, `compactionModel "${body.compactionModel.slice(0, 120)}" is not @-mentionable on this deployment (it resolves to catalog model "${terminal}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
+                        throw new HttpError(400, `compactionModel "${echoModelRef(body.compactionModel)}" is not @-mentionable on this deployment (it resolves to catalog model "${terminal}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
                     }
                     metrics.inc("task_model_not_allowlisted_resume_total");
-                    logger.warn("task_model_not_allowlisted_resume", { requested: body.compactionModel.slice(0, 120), resolved: terminal, source: "compaction", sessionId: auth?.sessionId ?? null, note: "resumed leg keeps the compaction model it was started with — the allowlist gates fresh picks only" });
+                    logger.warn("task_model_not_allowlisted_resume", { requested: echoModelRef(body.compactionModel), resolved: terminal, source: "compaction", sessionId: auth?.sessionId ?? null, note: "resumed leg keeps the compaction model it was started with — the allowlist gates fresh picks only" });
                 }
                 return { compactionModel: cm };
             })()),
@@ -459,7 +472,7 @@ export function createResolveSpec(ctx) {
             })(),
             ...(config.requirePrincipal !== true ? { backgroundScope: "session" } : {}),
             memory: memoryEngine
-                ? memorySpecForRequest(auth?.memoryScope, memoryProjectKeyFor(config, auth?.memoryScope, realTaskRootOf(auth)), body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }, { memory: body.memory, memoryCapture: body.memoryCapture })
+                ? memorySpecForRequest(auth?.memoryScope, projectKey, body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }, { memory: body.memory, memoryCapture: body.memoryCapture })
                 : undefined,
             ...((v) => (v !== undefined ? { memoryPersistenceCapable: v } : {}))(effectiveMemoryPersistenceCapable(config)),
             tools: ((base) => {
@@ -505,7 +518,7 @@ export function createResolveSpec(ctx) {
         };
         return spec;
     };
-    const foldGovernanceAndSettings = async (body, auth, spec, gated, effMode) => {
+    const foldGovernanceAndSettings = async (body, auth, spec, gated) => {
         const { acceptedAppend, parsedSettings } = gated;
         const hostSemanticsLane = !isSandboxPathAdjudicationLane(config.remoteExec?.provider);
         const laneHomeBase = () => {
@@ -533,7 +546,7 @@ export function createResolveSpec(ctx) {
             };
         const governedBase = applyRuntimeGovernance(spec, createDeploymentGovernanceInputs(config, pathAdjudication));
         let governed = governedBase;
-        let effectiveSettings = effMode ? withPermissionMode(parsedSettings.settings, effMode) : parsedSettings.settings;
+        let effectiveSettings = parsedSettings.settings;
         if (effectiveSettings?.outputStyle && acceptedAppend && acceptedAppend.length + 2 + effectiveSettings.outputStyle.length > MAX_SETTINGS_OUTPUT_STYLE_CHARS) {
             logger.warn("output_style_dropped", { detail: `combined append carriers exceed the ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} cap (rider ${acceptedAppend.length} + style ${effectiveSettings.outputStyle.length}) — style dropped (pre-cap stored body on a resume leg?)`, sessionId: auth?.sessionId ?? null });
             const { outputStyle: _dropped2, ...rest2 } = effectiveSettings;
@@ -549,65 +562,31 @@ export function createResolveSpec(ctx) {
                 ? await ensureScratchpadDir(config.localDataRoot ?? localRoot, auth.sessionId, (msg, meta) => logger.warn(msg, { ...(meta ?? {}), sessionId: auth.sessionId }))
                 : undefined);
         if (effectiveSettings) {
-            const gateCommon = {
-                ...(approvalExemptionStore && auth?.sessionId
-                    ? {
-                        isExempt: async (toolName) => {
-                            const hit = await approvalExemptionStore.has(auth.sessionId, toolName);
-                            if (hit)
-                                logger.info("fs_write_gate_exempted", { toolName, sessionId: auth.sessionId });
-                            return hit;
-                        },
-                    }
-                    : {}),
+            const ruleBases = {
+                ...(pathAdjudication.taskRoot !== undefined ? { taskRoot: pathAdjudication.taskRoot } : {}),
+                ...(pathAdjudication.taskHome !== undefined ? { taskHome: pathAdjudication.taskHome } : {}),
             };
-            const fsWriteGate = hostSemanticsLane
-                ? {
-                    env: pathAdjudication.env,
-                    ...(pathAdjudication.cwd !== undefined ? { cwd: pathAdjudication.cwd } : {}),
-                    ...(pathAdjudication.taskRoot !== undefined ? { taskRoot: pathAdjudication.taskRoot } : {}),
-                    ...(pathAdjudication.taskHome !== undefined ? { taskHome: pathAdjudication.taskHome } : {}),
-                    ...(scratchpadDir ? { scratchpadDir } : {}),
-                    ...gateCommon,
-                }
-                :
-                    (() => {
-                        const sandboxScratchpadDir = isRemoteScratchpadLane(config.remoteExec?.provider) ? remoteScratchpadDirFor(auth?.sessionId) : undefined;
-                        return {
-                            env: pathAdjudication.env,
-                            ...(pathAdjudication.taskHome !== undefined ? { taskHome: pathAdjudication.taskHome } : {}),
-                            ...gateCommon,
-                            ...(sandboxScratchpadDir ? { scratchpadDir: sandboxScratchpadDir } : {}),
-                            ...(gateCommon.isExempt
-                                ? {
-                                    isExempt: (toolName, canonicalPath) => canonicalPath.startsWith("/") ? gateCommon.isExempt(toolName) : false,
-                                }
-                                : {}),
-                        };
-                    })();
-            const workflowGate = approvalExemptionStore && auth?.sessionId
-                ? {
-                    isExempt: async (toolName) => {
-                        const hit = await approvalExemptionStore.has(auth.sessionId, toolName);
-                        if (hit)
-                            logger.info("workflow_gate_exempted", { toolName, sessionId: auth.sessionId });
-                        return hit;
-                    },
-                }
-                : undefined;
             try {
-                governed = applyTaskSettings(governedBase, effectiveSettings, fsWriteGate, workflowGate);
+                governed = applyTaskSettings(governedBase, effectiveSettings, ruleBases);
             }
             catch (e) {
-                if (e.code === WRITE_EXEMPT_DIR_COVERS_ROOT_CODE) {
-                    throw new HttpError(400, e.message, {
-                        code: "request.field_conflict",
-                        ...(e.detail !== undefined ? { extra: { writeExemptDirCoversRoot: e.detail } } : {}),
-                    });
-                }
+                if (e instanceof SettingsRuleRefusalError)
+                    throw new HttpError(422, `${REQUEST_SETTINGS_REFUSAL_PREFIX}${e.message}`, { code: SETTINGS_RULE_REFUSAL_CODE, extra: { ...entryProblemsFacts(e.problems) } });
                 throw new HttpError(422, `${REQUEST_SETTINGS_REFUSAL_PREFIX}${e.message}`);
             }
         }
+        if (governed.selfOrchestration === true) {
+            governed = tightenGoverned(governed, {
+                toolPolicy: createWorkflowAskPolicy(approvalExemptionStore && auth?.sessionId
+                    ? async (toolName) => {
+                        const hit = await approvalExemptionStore.has(auth.sessionId, toolName);
+                        if (hit)
+                            logger.info("workflow_gate_exempted", { toolName, sessionId: auth.sessionId });
+                        return hit;
+                    }
+                    : undefined),
+            });
+        }
         return { governed, scratchpadDir, hostSemanticsLane };
     };
     const applyImageFactsAndRouting = async (body, auth, governed, folded) => {
@@ -631,7 +610,7 @@ export function createResolveSpec(ctx) {
             const resolved = await resolveSandboxImageRef({
                 profile: taskImageProfile,
                 ...(capsNeeded && capsNeeded.length > 0 ? { capabilitiesNeeded: capsNeeded } : {}),
-                viewer: { operator: explicitOperatorOk(auth.principal, config.operatorPrincipals), tenantId: auth.principal ?? null },
+                viewer: { operator: explicitOperatorOk(auth.principal, config), tenantId: auth.principal ?? null },
                 index: imageIndex,
             });
             if (!resolved.ok)
@@ -662,7 +641,7 @@ export function createResolveSpec(ctx) {
             const isolatedExecEnv = isIsolatedExecEnv(config.remoteExec?.provider, config.remoteExec?.provider === "k8s" ? config.remoteExec.runtimeClass : undefined);
             const decision = routeServiceTask({
                 isolatedExecEnv,
-                hasExecutionEnv: executionLaneCaps(executionLaneOf(config.remoteExec?.provider)).coreRemoteExecutionEnv === "supported",
+                hasExecutionEnv: laneWiresExecutionEnv(executionLaneOf(config.remoteExec?.provider)),
                 ...(config.autonomy ? { autonomy: config.autonomy } : {}),
             });
             logger.info("orchestration_routed", { mode: decision.mode, reason: decision.reason, sessionId: auth?.sessionId ?? null });

package/dist/boot/runner-deps.js

@@ -180,6 +180,7 @@ export function createRunnerDeps(ctx) {
                 logger,
             })
             : undefined,
+        principalInboxConsumer: config.principalInboxAssistant !== undefined ? { assistant: config.principalInboxAssistant } : undefined,
         onTaskOutcome: outcomeSink
             ? (o) => {
                 metrics.inc("task_outcomes_total", { status: o.status, green: String(o.oracle?.green ?? "unknown") });

package/dist/boot/session-faces.d.ts

@@ -69,6 +69,7 @@ export interface SessionFacesCtx {
 export declare function createSessionFaces(ctx: SessionFacesCtx): {
     ownerAware: OwnerAwareSessionStore;
     sessionAudit: ((sessionId: string, opts?: SessionAuditReadOpts) => Promise<{
+        agent?: import("../audit.js").SessionAgent | undefined;
         owner: string | null;
         sessionId: string;
         createdAt: string;

package/dist/boot/session-faces.js

@@ -1,4 +1,4 @@
-import { buildRewindHandles, buildSessionAudit, buildSessionAuditLocal, buildSessionAuditPg } from "../audit.js";
+import { buildRewindHandles, buildSessionAudit, buildSessionAuditLocal, buildSessionAuditPg, sessionAgentOf } from "../audit.js";
 import { makeDegenerateInstrument } from "../degenerate-instrument.js";
 import { PlanCacheProbe } from "../plan-cache-probe.js";
 import { purgeScratchpadDir } from "../env-facts.js";
@@ -25,7 +25,9 @@ export function createSessionFaces(ctx) {
                     : await buildSessionAuditLocal(auditLocalRoot, sessionId, handles);
             if (!audit)
                 return undefined;
-            return { ...audit, owner: (await ownerAware.ownerOf?.(sessionId)) ?? null };
+            const [owner, placement] = await Promise.all([ownerAware.ownerOf?.(sessionId), opts !== undefined ? ownerAware.placementOf?.(sessionId) : undefined]);
+            const agent = sessionAgentOf(placement);
+            return { ...audit, owner: owner ?? null, ...(agent !== undefined ? { agent } : {}) };
         }
         : undefined;
     const sessionWatchRegistry = ownerAware.getHead && ownerAware.ownerOf

package/dist/boot/stage-02-web-admin-pull.js

@@ -3,6 +3,7 @@ import { createWebAdminRuntime } from "./web-admin.js";
 import { composeExecutionLane, FILE_SOURCED_LANES } from "./execution-lane.js";
 import { serviceConfigSourceKind } from "../config-provider.js";
 import { logConfigDirMigration, migrateLocalConfigDirectory } from "../config-d-migration.js";
+import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "../model-entry-refusal.js";
 import { isRosterGateArmed } from "../config.js";
 import { judgeServedModelRoute } from "../model-route-endpoint.js";
@@ -10,8 +11,10 @@ import { servedModelTableLeg } from "../model-select.js";
 export async function runStage02(ctx) {
     const { config, localRoot, logger, metrics } = ctx;
     const configSource = serviceConfigSourceKind(config);
-    if (configSource === "local")
+    if (configSource === "local") {
+        await assertLocalConfigDirTrusted({ root: localRoot, declaredOwnerUid: config.configLocalOwnerUid });
         logConfigDirMigration(logger, await migrateLocalConfigDirectory(localRoot));
+    }
     await composeExecutionLane(config, { configSource, localRoot, logger, drivesFromFile: FILE_SOURCED_LANES });
     const webAdmin = await createWebAdminRuntime({ config, logger, metrics, localRoot });
     const servedLeg = servedModelTableLeg(config);

package/dist/boot/stage-06-runners.d.ts

@@ -51,6 +51,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     workflowCompletionInbox: import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox | undefined;
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
+    workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -60,6 +61,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     };
     workflowRunStore: import("../orchestration/workflow-notify-journal.js").JournalingWorkflowRunStore | undefined;
     workflowsCapable: boolean;
+    orgDeliveryGate: import("@sema-agent/core").OrgDeliveryGate | undefined;
     deploymentMods: readonly import("@sema-agent/core").ModRegistration<import("@sema-agent/core").EngineDollar>[];
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     dropSessionScoped: (sid: string) => void;

package/dist/boot/stage-06-runners.js

@@ -7,6 +7,7 @@ import { withoutHands } from "../capabilities/hands-lane.js";
 import { isBrandedDeployment } from "../capabilities/brand-identity.js";
 import { redactSecrets } from "../trace/redact.js";
 import { hasServiceAuth } from "../http/server.js";
+import { operatorRosterPresent } from "../http/principal-gate.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
 import { createHookLlm, buildHookFailureText } from "../hooks/hook-llm.js";
 import { assertRetentionLaneWirable } from "./retention-lane.js";
@@ -21,11 +22,12 @@ import { defaultEngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { createOrgMemoryAdmissionWiring } from "./org-memory.js";
 import { createGovernanceSeams } from "./governance-seams.js";
 import { createSharedMemoryScopeAuthorizer } from "../shared-memory-scope-authorizer.js";
+import { mountOrgDeliveryGate } from "./org-delivery.js";
 import { parkedAskRedeem, runStore } from "./late-binds.js";
 import { withInternalRunEnvs } from "../internal-run-env.js";
 export function runStage06(ctx) {
     const { backend, backgroundAgentStore, brain, engineDataRoot, config, webAdmin, consolidationValve, deploymentMods, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecordStore, sessionCaptureRecords, sessionPolicyStore, sessionStore, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
-    const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
+    const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, workflowParkDecisions, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
     const parkCommitted = backend?.checkpoint && config.durableApproval ? createParkCommitWatch(backend.checkpoint(logger)) : undefined;
     const checkpointStore = parkCommitted?.store;
     const parkCommits = parkCommitted?.watch;
@@ -83,7 +85,7 @@ export function runStage06(ctx) {
         : undefined;
     for (const w of buildConsolidationValveAudit({
         valve: consolidationValve,
-        operatorPrincipals: config.operatorPrincipals,
+        operatorRosterPresent: operatorRosterPresent(config),
         hasServiceAuth: hasServiceAuth(config),
         allowUnauthedWrites: config.allowUnauthedWrites ?? false,
     }).warnings) {
@@ -127,6 +129,7 @@ export function runStage06(ctx) {
         sharedMemoryStores: sharedMemoryStore ? sharedMemoryStore : undefined,
         getRunStore: () => runStore,
     });
+    const orgDeliveryGate = mountOrgDeliveryGate({ runnerDeps, directory: orgMemoryAdmission.directory, mailboxStore, backend, logger });
     const runner = new Runner(runnerDeps);
     const handslessRunner = new Runner(withoutHands(runnerDeps));
     const { hookModelFor, hookLlm } = createHookLlm({ config, getKeyResolver: () => webAdmin.getKeyResolver(), metrics });
@@ -210,6 +213,6 @@ export function runStage06(ctx) {
         onError: runnerDeps.onError ? runnerDeps.onError : undefined,
     };
     const subRunner = new Runner(subRunnerDeps);
-    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable };
+    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowParkDecisions, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate };
 }
 //# sourceMappingURL=stage-06-runners.js.map

package/dist/boot/stage-07-capability-layer.d.ts

@@ -66,6 +66,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     workflowCompletionInbox: import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox | undefined;
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
+    workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -75,6 +76,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     };
     workflowRunStore: import("../orchestration/workflow-notify-journal.js").JournalingWorkflowRunStore | undefined;
     workflowsCapable: boolean;
+    orgDeliveryGate: import("@sema-agent/core").OrgDeliveryGate | undefined;
     deploymentMods: readonly import("@sema-agent/core").ModRegistration<import("@sema-agent/core").EngineDollar>[];
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     dropSessionScoped: (sid: string) => void;

package/dist/boot/stage-07-capability-layer.js

@@ -7,13 +7,14 @@ import { ensureChildSessionDurableWithPromotion } from "../plugins/session-store
 import { webSearchConfigFromEnv, createWebSearchBackend, shouldProbeWebSearchOnBoot } from "../plugins/web-search.js";
 import { createAuthorizer } from "../security.js";
 import { buildForceDurableGateInertNotice, buildNoResponderBootWarns, gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
-import { executionLaneOf } from "../execution-lane-caps.js";
+import { executionLaneOf, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { loadDeploymentSkills } from "../capabilities/skills.js";
 import { createRepoClient } from "../capabilities/repo-tools.js";
 import { buildScenarios, builtinScenarioDetails, danglingScenarioRefusal } from "../capabilities/scenarios.js";
 import { isBrandedDeployment } from "../capabilities/brand-identity.js";
 import { RateLimiter } from "../observability/rate-limit.js";
 import { explicitOperatorOk } from "../http/server.js";
+import { buildOperatorUndeclaredNotice } from "../http/principal-gate.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { reclaimOrphansAtBoot } from "../boot-reclaim.js";
@@ -56,6 +57,18 @@ export async function runStage07(ctx) {
         throw new Error(gateRefusal);
     await reclaimOrphansAtBoot(runStore, checkpointStore, logger);
     await runBootCrashConvergence({ backend, runStore, liveAudit: approvalAskAudit, localDataRoot: config.localDataRoot, logger });
+    const adoption = await toolApproval?.adoptOpenAsks();
+    if (adoption !== undefined && (adoption.capped || adoption.cardUnreadable > 0)) {
+        logger.warn("approval_ask_adopted_partially", {
+            adopted: adoption.adopted,
+            cardUnreadable: adoption.cardUnreadable,
+            capped: adoption.capped,
+            note: "some approval asks still pending in the ask ledger were not taken into this replica's live list: unreadable card envelopes are skipped, and only the oldest pending rows up to the adoption cap are taken. The skipped asks stay answerable through POST /v1/tasks/:taskId/asks/:askId/decision and are expired by the reconciler on their own window.",
+        });
+    }
+    else if (adoption !== undefined && adoption.adopted > 0) {
+        logger.info("approval_ask_adopted", { adopted: adoption.adopted, alreadyLive: adoption.alreadyLive });
+    }
     const userInputLedgerStore = backend && runStore ? backend.userInputLedger() : undefined;
     const userInputLedger = backend && runStore && userInputLedgerStore
         ? await (async () => {
@@ -75,7 +88,7 @@ export async function runStage07(ctx) {
         ? selectEnvironmentTool({
             catalog: imageIndex,
             selection: sessionEnvSelection,
-            viewerFor: (principal) => ({ operator: explicitOperatorOk(principal, config.operatorPrincipals), tenantId: principal ?? null }),
+            viewerFor: (principal) => ({ operator: explicitOperatorOk(principal, config), tenantId: principal ?? null }),
         })
         : undefined;
     const imageBakes = backend?.imageBake && config.imageBakes.enabled ? backend.imageBake() : undefined;
@@ -83,6 +96,11 @@ export async function runStage07(ctx) {
         logger.info("image_bakes_enabled", { operators: config.operatorPrincipals.length, runner: config.imageBakes.runnerPrincipal });
     if (durableEnabled)
         logger.info("durable_approval_enabled", { toolApprovalGate: config.approvalRequire.length });
+    {
+        const undeclared = buildOperatorUndeclaredNotice(config, durableEnabled);
+        if (undeclared)
+            logger.warn(undeclared.event, undeclared.fields);
+    }
     if (config.a2aServe) {
         const peer = facts.a2aServe({ config, runStore });
         if (peer.available) {
@@ -151,10 +169,13 @@ export async function runStage07(ctx) {
         })
             .catch((e) => logger.warn("web_search_probe_failed", { provider: webSearchCfg.provider, error: e instanceof Error ? e.message : String(e) }));
     }
-    const ensureChildSessionDurable = checkpointStore && config.sessionBackend === "tidb" ? (sessionId) => ensureChildSessionDurableWithPromotion(sessionStore, subRunnerSessions, sessionId) : undefined;
+    const ensureChildSessionDurable = checkpointStore && config.sessionBackend === "tidb"
+        ? (sessionId, root) => ensureChildSessionDurableWithPromotion(sessionStore, subRunnerSessions, sessionId, root, logger)
+        : undefined;
     const webFetchSummarize = createWebFetchSummarizeLane({ brain, config, getKeyResolver: () => webAdmin.getKeyResolver(), logger });
     const scenarioDeps = {
         runner, subRunner, model: DEFAULT_MODEL_REF, skills, repoClient, requirePrincipal: config.requirePrincipal,
+        handsLane: laneWiresExecutionEnv(executionLaneOf(config.remoteExec?.provider)),
         webSearch: webSearch ? webSearch : undefined, logger, webFetchSummarize,
         backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
         checkpointStore: checkpointStore ? checkpointStore : undefined,

package/dist/boot/stage-08-reapers.d.ts

@@ -79,6 +79,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     workflowCompletionInbox: import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox | undefined;
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
+    workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -88,6 +89,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     };
     workflowRunStore: import("../orchestration/workflow-notify-journal.js").JournalingWorkflowRunStore | undefined;
     workflowsCapable: boolean;
+    orgDeliveryGate: import("@sema-agent/core").OrgDeliveryGate | undefined;
     deploymentMods: readonly import("@sema-agent/core").ModRegistration<import("@sema-agent/core").EngineDollar>[];
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     dropSessionScoped: (sid: string) => void;

package/dist/boot/stage-08-reapers.js

@@ -5,12 +5,12 @@ import { startRetentionLane, RETENTION_LEASE_TTL_FACTOR } from "./retention-lane
 import { createLimitSync } from "./limit-sync.js";
 import { runDenySweep } from "./late-binds.js";
 export function runStage08(ctx) {
-    const { approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, spaceReclaimer, handslessRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, userInputLedger, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
+    const { approvalAskAudit, approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, spaceReclaimer, handslessRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, userInputLedger, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
     const reaper = startReapers({
         config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits,
         rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap,
         workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore,
-        backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, userInputLedger,
+        backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, userInputLedger, approvalAskAudit,
         getRunDenySweep: () => runDenySweep,
     });
     const ttlMs = config.retentionSweep.intervalSec * 1000 * RETENTION_LEASE_TTL_FACTOR;

package/dist/boot/stage-09-leader.d.ts

@@ -18,6 +18,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     }>) | undefined;
     webAdminJwtVerifier: import("../auth-bridge.js").WebAdminJwtVerifier | undefined;
     sessionAudit: ((sessionId: string, opts?: import("../audit.js").SessionAuditReadOpts) => Promise<{
+        agent?: import("../audit.js").SessionAgent | undefined;
         owner: string | null;
         sessionId: string;
         createdAt: string;
@@ -102,6 +103,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     workflowCompletionInbox: import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox | undefined;
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
+    workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -111,6 +113,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     };
     workflowRunStore: import("../orchestration/workflow-notify-journal.js").JournalingWorkflowRunStore | undefined;
     workflowsCapable: boolean;
+    orgDeliveryGate: import("@sema-agent/core").OrgDeliveryGate | undefined;
     deploymentMods: readonly import("@sema-agent/core").ModRegistration<import("@sema-agent/core").EngineDollar>[];
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     dropSessionScoped: (sid: string) => void;