@sema-agent/server 7.132.0 → 7.133.0

package/dist/boot/stage-10-http-server.d.ts

@@ -17,6 +17,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     }>) | undefined;
     webAdminJwtVerifier: import("../auth-bridge.js").WebAdminJwtVerifier | undefined;
     sessionAudit: ((sessionId: string, opts?: import("../audit.js").SessionAuditReadOpts) => Promise<{
+        agent?: import("../audit.js").SessionAgent | undefined;
         owner: string | null;
         sessionId: string;
         createdAt: string;
@@ -101,6 +102,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     workflowCompletionInbox: import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox | undefined;
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
+    workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -110,6 +112,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     };
     workflowRunStore: import("../orchestration/workflow-notify-journal.js").JournalingWorkflowRunStore | undefined;
     workflowsCapable: boolean;
+    orgDeliveryGate: import("@sema-agent/core").OrgDeliveryGate | undefined;
     deploymentMods: readonly import("@sema-agent/core").ModRegistration<import("@sema-agent/core").EngineDollar>[];
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     dropSessionScoped: (sid: string) => void;

package/dist/boot/stage-10-http-server.js

@@ -9,7 +9,6 @@ import { createHttpServer } from "../http/server.js";
 import { exportMemoryScope } from "../memory-export.js";
 import { performMemorySync } from "../memory-sync.js";
 import { backgroundAgentOutput, taskHandleOutput, taskHandleStop } from "../runs.js";
-import { sqlBlobCapOf } from "../plugins/blob-backend.js";
 import { createStoreLiveProbe } from "../store-live-probe.js";
 import { counterStoreLabel } from "../plugins/store-backend.js";
 import { sessionStoreLabelOf } from "../store-posture.js";
@@ -30,7 +29,7 @@ import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export async function runStage10(ctx) {
-    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, parkCommits, config, webAdmin, consolidationValve, costQuota, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
+    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, parkCommits, config, webAdmin, consolidationValve, costQuota, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
     const stores = {
         runStore,
         resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
@@ -47,6 +46,7 @@ export async function runStage10(ctx) {
         peerDirectory: runnerDeps.peerDirectory,
         workflowRunStore: workflowRunStore ? workflowRunStore : undefined,
         workflowAgentSessionIndex: workflowAgentSessionIndex ? workflowAgentSessionIndex : undefined,
+        workflowParkDecisions: workflowParkDecisions ? workflowParkDecisions : undefined,
         workflowJournalStore: workflowJournalStore ? workflowJournalStore : undefined,
         imageIndex,
         imageBakes,
@@ -99,6 +99,7 @@ export async function runStage10(ctx) {
         memoryConsolidation: memoryConsolidationFaces,
         memoryOptOutGrant: memoryOptOutGrantStore,
         orgMemoryDirectory: orgMemoryAdmission.directory,
+        orgDeliveryGate,
         sharedMemoryStore: sharedMemoryStore ? sharedMemoryStore : undefined,
         sessionMirrorRuling: principalCaps
             ? async (p) => (await principalCaps.executionRuling(p))?.sessionMirror
@@ -177,6 +178,7 @@ export async function runStage10(ctx) {
         restartState: () => webAdmin.restartState(),
         configApplyState: () => webAdmin.configApplyState(),
         centerCredentialState: () => webAdmin.centerCredentialState(),
+        centerIdentityNoticeState: () => webAdmin.centerIdentityNoticeState(),
         modelRefusalsState: () => webAdmin.modelRefusalsState(),
         candidateRejectionState: () => webAdmin.candidateRejectionState(),
         configHandoffState: () => webAdmin.configHandoffState(),
@@ -191,9 +193,6 @@ export async function runStage10(ctx) {
         storeLiveState: storeLiveProbe ? () => storeLiveProbe.state() : undefined,
     };
     const knobs = {
-        snapshotBlobSqlCap: sqlEngine !== undefined && !config.snapshotBlobStore
-            ? () => sqlBlobCapOf(config.snapshotBlobSqlMaxBytes, sqlEngine)
-            : undefined,
         sessionEventsMaxConnections: sessionWatchRegistry ? posIntEnv(process.env.SESSION_EVENTS_MAX_CONNS, 256, 100_000) : undefined,
     };
     const resolveSpec = createResolveSpec({
@@ -201,7 +200,7 @@ export async function runStage10(ctx) {
         getKeyResolver: () => webAdmin.getKeyResolver(),
         taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner,
         hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec,
-        selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore,
+        selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore,
         checkpointStore, imageIndex, perTaskImage,
         sessionEnvSelection,
         lockedKeys: governanceSeams.lockedKeys,

package/dist/boot/stores.js

@@ -377,7 +377,7 @@ export async function openStores(ctx) {
                 ...(config.memorySync.maxPushEntries !== undefined ? { maxPushEntries: config.memorySync.maxPushEntries } : {}),
                 ...(config.memorySync.maxPullEntries !== undefined ? { maxPullEntries: config.memorySync.maxPullEntries } : {}),
             });
-            logger.info("memory_sync_enabled", { url: buildDisplaySafeUrl(config.memorySync.url), scope: config.memorySync.scope, cursorPath: memorySyncRunner.cursorPath });
+            logger.info("memory_sync_enabled", { url: buildDisplaySafeUrl(config.memorySync.url), scope: config.memorySync.scope, cursorPath: memorySyncRunner.cursorPathFor(config.memorySync.scope) });
             memorySyncRunner.trigger("boot");
         }
         else {
@@ -436,7 +436,7 @@ export async function openStores(ctx) {
     const breakerState = backend?.breaker && config.resilience.circuitBreaker
         ? backend
             .breaker((streak) => {
-            metrics.setGauge("counter_flush_fail_streak", streak, { table: "circuit_breaker", kind: "write_through" });
+            metrics.setGauge("counter_flush_fail_streak", streak, { table: "breaker_state", kind: "write_through" });
             if (streak > 0)
                 metrics.inc("breaker_writethrough_failed_total", { backend: backend.kind });
             if (streak === 3)

package/dist/boot/web-admin.d.ts

@@ -4,6 +4,7 @@ import { buildPricing } from "../budget.js";
 import { type Scenario, type ScenarioDeps, type ScenarioDetail } from "../capabilities/scenarios.js";
 import type { LoadedSkill } from "../capabilities/skills.js";
 import { type ServiceConfig } from "../config.js";
+import { type CenterIdentityNotice } from "../center-config-tier.js";
 import { type CenterCredentialHealthView } from "../center-credential-renewer.js";
 import { type ModelKeyRef } from "../key-resolver.js";
 import type { Logger } from "../observability/logger.js";
@@ -83,6 +84,9 @@ export interface WebAdminRuntime {
     stopRefreshLoop(): void;
     /** S-698:`/health.centerCredential` 的取值口 —— 凭证来源的健康态 + 续签器状态;都健康 / 没有中心 ⇒ `undefined`(键缺席)。 */
     centerCredentialState(): CenterCredentialHealthView | undefined;
+    /** S-667:`/health.centerIdentityNotice` 的取值口 —— 中心凭证换人后的**最近一条**通告(`center_identity_demoted` 已降到无中心配置档 / `center_identity_landed`
+     *  新身份的配置已换上;码、冻结句与状态机见 `center-config-tier.ts`)。从未换过人 / 没有中心 ⇒ `undefined`(键缺席)。值形就是 wire 形 `{ code, message, at }`。 */
+    centerIdentityNoticeState(): CenterIdentityNotice | undefined;
     /** [ref](core 5.50 [ref]):mid-turn MCP 撤销台账读口,喂 `RunnerDeps.mcpRevocations` 席。
      *  **取走即声明接线**——调用本方法后,restart 信号的 mcp 片对纯删除向豁免(台账即时承接);
      *  不取 ⇒ 旧 restart 语义逐字保留(fail-closed)。 */

package/dist/boot/web-admin.js

@@ -11,14 +11,17 @@ import { applyCenterPlugins } from "../capabilities/center-plugins.js";
 import { applyCenterArtifact, centerSourceOnError, withPromptArtifactBackfill } from "../capabilities/center-prompts.js";
 import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
 import { isRosterGateArmed } from "../config.js";
+import { toolsRunOnThisHost } from "../task-cwd.js";
 import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg, legacyV1LkgPath, migrateV1Lkg } from "../config-lkg.js";
 import { answerStillCurrent, centerStateBin, credentialIdentityNow, judgeCenterCredentialAtBoot } from "../center-credential.js";
+import { createCenterConfigTier } from "../center-config-tier.js";
 import { buildCenterCredentialHealthView, createCenterCredentialRenewer } from "../center-credential-renewer.js";
 import { centerManagedConfigKeys } from "../web-admin-client/apply-effective.js";
 import { createConfigProvider, raceBootFetch, serviceConfigSourceKind, BOOT_FETCH_DEFERRED } from "../config-provider.js";
+import { ConfigDirUntrustedError } from "../config-dir-trust.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { buildSealedKeyPublicFace, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
-import { applyEffective, applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, mutateInPlace, logEffectiveDiff, applySkillsManifest, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, fetchPromptArtifact } from "../web-admin-client/facade.js";
+import { applyEffective, applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, mutateInPlace, logEffectiveDiff, applySkillsManifest, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, NO_CENTER_EFFECTIVE, isNoCenterEffective, fetchPromptArtifact } from "../web-admin-client/facade.js";
 import { buildConfigHandoff, buildRestartSignal, configHandoffMissing } from "../fleet/engine-signal.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../web-admin-client/mcp-revocation.js";
 import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "../web-admin-client/read-warnings.js";
@@ -26,6 +29,7 @@ import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, candidateReje
 import { SHA256_HEX_RE } from "../digest-form.js";
 import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../web-admin-client/apply-ledger.js";
 import { announceReadDenyRows, buildDeploymentPostureSeats } from "./runner-deps.js";
+import { echoCallerText } from "../caller-text-echo.js";
 function lkgReadNote(scope) {
     switch (scope) {
         case "whole":
@@ -86,6 +90,21 @@ export async function createWebAdminRuntime(ctx) {
         ? createCenterCredentialRenewer({ source: cc.credential, centerUrl: cc.baseUrl, leadMs: config.centerCredentialRenewLeadMs, logger })
         : undefined;
     const currentIdentity = () => (cc === undefined ? undefined : credentialIdentityNow(cc.credential));
+    const tier = createCenterConfigTier();
+    const announceTier = (n) => {
+        switch (n.code) {
+            case "center_identity_demoted":
+                logger.warn(n.code, { at: n.at, message: n.message, ...(n.retained !== undefined ? { retained: n.retained } : {}), note: "the credential identity changed: the previous account's center configuration is dropped (every center-supplied hot face is back on its env base, the center prompt layer is withdrawn, the Runners run the env model table) and a pull for the new identity is under way; skills / MCP / A2A / scenarios are baked at boot and stay the previous account's until a restart (see /health.restart)" });
+                return;
+            case "center_identity_landed":
+                logger.info(n.code, { at: n.at, message: n.message });
+                return;
+            default: {
+                const unknownCode = n.code;
+                throw new Error(`announceTier: unknown notice code ${JSON.stringify(unknownCode)}`);
+            }
+        }
+    };
     const candidateIdentity = new WeakMap();
     const candidateIdentityOf = (eff) => candidateIdentity.get(eff);
     const validatorIdentity = new Map();
@@ -133,6 +152,7 @@ export async function createWebAdminRuntime(ctx) {
             ...(config.configProvider ? { provider: config.configProvider } : {}),
             ...(cc ? { webAdmin: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker, dryRun: cc.dryRun } } : {}),
             localDir: localRoot,
+            localOwnerUid: config.configLocalOwnerUid,
             ...(config.configLkgEnabled ? { skillBodyCacheDir: defaultSkillCacheDir(config) } : {}),
         })
         : undefined;
@@ -301,6 +321,10 @@ export async function createWebAdminRuntime(ctx) {
     if (configProvider && !cc?.dryRun)
         await rebasePromptState(promptStateIdentity, "boot");
     const adoptCenterPrompts = async (eff, prompts, phase) => {
+        if (isNoCenterEffective(eff)) {
+            await rebasePromptState(undefined, phase);
+            return;
+        }
         const adoptedIdentity = candidateIdentityOf(eff);
         if (adoptedIdentity !== undefined && adoptedIdentity !== promptStateIdentity) {
             await rebasePromptState(adoptedIdentity, phase);
@@ -348,14 +372,20 @@ export async function createWebAdminRuntime(ctx) {
         return ledger;
     };
     const noteHandoff = (next) => {
-        const applied = next.applied ?? handoff.applied;
+        const applied = next.noneApplied === true ? undefined : (next.applied ?? handoff.applied);
         const durable = next.durable ?? handoff.durable;
         handoff = { ...(applied !== undefined ? { applied } : {}), ...(durable !== undefined ? { durable } : {}) };
         latchHandoff();
     };
-    const markApplied = (gen, version) => {
-        applyLedger.applied(gen, version);
-        noteHandoff({ applied: version });
+    const markApplied = (gen, eff) => {
+        applyLedger.applied(gen, eff.version);
+        if (isNoCenterEffective(eff))
+            noteHandoff({ noneApplied: true });
+        else
+            noteHandoff({ applied: eff.version });
+        const landed = tier.committed(candidateIdentityOf(eff));
+        if (landed !== undefined)
+            announceTier(landed);
     };
     let lkgBooted = false;
     let bootLkgCandidate;
@@ -480,7 +510,7 @@ export async function createWebAdminRuntime(ctx) {
             const lkgIdentity = candidateIdentityOf(lkgR.effective);
             if (lkgSurvivesRestart && lkgIdentity !== undefined)
                 noteHandoff({ durable: { version: lkgR.effective.version, identity: lkgIdentity } });
-            markApplied(lkgGen, lkgR.effective.version);
+            markApplied(lkgGen, lkgR.effective);
             await adoptCenterPrompts(lkgR.effective, lkgR.prompts, "boot-lkg");
             const lkgPlane = modelPlaneCommitted(lkgReport);
             if (lkgPlane)
@@ -585,7 +615,7 @@ export async function createWebAdminRuntime(ctx) {
                                 recordApply(rep);
                             },
                         });
-                        markApplied(bootGen, r.effective.version);
+                        markApplied(bootGen, r.effective);
                         const bootClean = fullyLandedForLkg(r, bootReport);
                         if (bootClean)
                             ccEtag = r.etag;
@@ -622,11 +652,13 @@ export async function createWebAdminRuntime(ctx) {
             }
         }
         catch (err) {
+            if (err instanceof ConfigDirUntrustedError)
+                throw err;
             if (bootApplyPhase)
                 logger.warn("config_apply_refused", { source: configProvider.kind, err: String(err), note: "the pulled candidate failed to apply at boot — falling back to the LKG / env; this is not a reachability failure" });
             else
                 logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
-            await bootFallBackWhole(`${bootApplyPhase ? "boot apply refused" : "boot fetch failed"}: ${String(err).slice(0, 120)}`);
+            await bootFallBackWhole(`${bootApplyPhase ? "boot apply refused" : "boot fetch failed"}: ${echoCallerText(String(err), { maxChars: 120 })}`);
         }
         if (!dryRun && cc !== undefined && currentIdentity() !== promptStateIdentity)
             await rebasePromptState(currentIdentity(), "boot-end");
@@ -669,6 +701,7 @@ export async function createWebAdminRuntime(ctx) {
             announceReadDenyRows(config, logger);
     };
     let ccTimer;
+    let unwatchCredential;
     return {
         providerKind: configProvider?.kind,
         sealedKeyPublic: sealedKeys === undefined ? undefined : buildSealedKeyPublicFace(sealedKeys),
@@ -707,6 +740,7 @@ export async function createWebAdminRuntime(ctx) {
                 const pluginOut = await applyCenterPlugins(skills, effective, {
                     cacheRoot: join(config.localDataRoot ?? join(homedir(), ".ai-agent"), "plugin-cache"),
                     allowHosts: config.pluginsAllowHosts,
+                    toolsShareThisFilesystem: toolsRunOnThisHost(config),
                     logger,
                 }).catch((err) => {
                     logger.warn("center_plugins_apply_failed", { error: err instanceof Error ? err.message : String(err) });
@@ -839,6 +873,69 @@ export async function createWebAdminRuntime(ctx) {
             if (configProvider) {
                 const ccRef = config.webAdmin;
                 let refreshInFlight = false;
+                let followUp = false;
+                let ownRead = false;
+                const commitHot = async (c) => {
+                    const { eff, prompts, gen, phase } = c;
+                    const noCenter = isNoCenterEffective(eff);
+                    const planeChanged = noCenter || modelPlaneChanged(appliedPlaneEff, eff);
+                    let report;
+                    const committed = applyEffective(config, eff, logger, {
+                        leg: "hot",
+                        checkpointStorePresent,
+                        sealedKeys,
+                        generation: gen,
+                        report: (rep) => {
+                            report = rep;
+                            recordApply(rep);
+                        },
+                        ...(planeChanged ? { swapPlane: swapRunnerDeps } : {}),
+                    });
+                    if (!committed)
+                        return { committed: false, report, planeCommitted: false };
+                    mutateInPlace(pricing, buildPricing(config.models));
+                    keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
+                    limitSync?.sync();
+                    ceilingVerdict?.judge();
+                    if (phase !== "boot-deferred")
+                        mcpRevocations.applyEnabledEntries(enabledMcpEntries(eff.mcp));
+                    applyLiveReadFace(eff, swapRunnerDeps, phase);
+                    markApplied(gen, eff);
+                    const planeCommitted = modelPlaneCommitted(report);
+                    if (planeCommitted)
+                        appliedPlaneEff = noCenter ? undefined : eff;
+                    planeDeferredNoHandoff = undefined;
+                    await adoptCenterPrompts(eff, prompts, phase);
+                    if (planeCommitted)
+                        markRosterLanded(eff);
+                    if (tier.drifted(currentIdentity()))
+                        requestTick();
+                    return { committed: true, report, planeCommitted };
+                };
+                const demoteToNoCenter = async (awaiting) => {
+                    const gen = reserveArrivalGeneration();
+                    applyLedger.seenTarget(gen, NO_CENTER_EFFECTIVE.version);
+                    const hot = await commitHot({ eff: NO_CENTER_EFFECTIVE, prompts: undefined, gen, phase: "no-center" });
+                    if (!hot.committed) {
+                        throw new Error("the no-center tier was refused (the Runners did not accept the env model table) — the previous account's center configuration is still in force; retried next tick");
+                    }
+                    if (hot.report !== undefined && !hot.report.fullyApplied) {
+                        logger.warn("center_identity_demotion_partial", { groups: refusedGroups(hot.report).map((g) => g.group), note: "a group of the no-center tier was refused — that group keeps its previous values (loud; the env base for that group could not be applied)" });
+                    }
+                    noteCandidateVerdict(gen, undefined);
+                    latestEffective = undefined;
+                    ccEtag = undefined;
+                    announceTier(tier.demote(awaiting, hot.report !== undefined ? refusedGroups(hot.report).map((g) => g.group) : []));
+                };
+                const reconcileCenterIdentity = async (identity) => {
+                    if (identity === undefined || !tier.drifted(identity))
+                        return;
+                    if (tier.isDemoted()) {
+                        tier.retarget(identity);
+                        return;
+                    }
+                    await demoteToNoCenter(identity);
+                };
                 const refreshTick = async (arrival) => {
                     if (refreshInFlight)
                         return "ok";
@@ -850,6 +947,15 @@ export async function createWebAdminRuntime(ctx) {
                 const refreshTickRan = async (arrival) => {
                     refreshInFlight = true;
                     try {
+                        let ownIdentity;
+                        ownRead = true;
+                        try {
+                            ownIdentity = currentIdentity();
+                        }
+                        finally {
+                            ownRead = false;
+                        }
+                        await reconcileCenterIdentity(ownIdentity);
                         await retryPendingCatalog("refresh-retry");
                         if (planeDeferredNoHandoff) {
                             metrics.inc("models_tiers_plane_deferred_stuck_total");
@@ -875,6 +981,7 @@ export async function createWebAdminRuntime(ctx) {
                             }
                         }
                         if (r) {
+                            await reconcileCenterIdentity(candidateIdentityOf(r.effective));
                             const tickGen = arrival !== undefined ? useArrivalGeneration(r.effective.version, arrival.ordinal) : generationOf(r.effective.version);
                             applyLedger.seenTarget(tickGen, r.effective.version);
                             const verdict = judgeConfigCandidate(r);
@@ -889,35 +996,10 @@ export async function createWebAdminRuntime(ctx) {
                                 ccEtag = r.etag;
                             }
                             else {
-                                const planeChanged = modelPlaneChanged(appliedPlaneEff, r.effective);
-                                let applyReport;
-                                const committed = applyEffective(config, r.effective, logger, {
-                                    leg: "hot",
-                                    checkpointStorePresent,
-                                    sealedKeys,
-                                    generation: tickGen,
-                                    report: (rep) => {
-                                        applyReport = rep;
-                                        recordApply(rep);
-                                    },
-                                    ...(planeChanged ? { swapPlane: swapRunnerDeps } : {}),
-                                });
-                                if (!committed)
+                                const hot = await commitHot({ eff: r.effective, prompts: verdict.prompts, gen: tickGen, phase: "refresh" });
+                                if (!hot.committed)
                                     return "ok";
-                                mutateInPlace(pricing, buildPricing(config.models));
-                                keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
-                                limitSync?.sync();
-                                ceilingVerdict?.judge();
-                                mcpRevocations.applyEnabledEntries(enabledMcpEntries(r.effective.mcp));
-                                applyLiveReadFace(r.effective, swapRunnerDeps, "refresh");
-                                markApplied(tickGen, r.effective.version);
-                                const tickPlane = modelPlaneCommitted(applyReport);
-                                if (tickPlane)
-                                    appliedPlaneEff = r.effective;
-                                planeDeferredNoHandoff = undefined;
-                                await adoptCenterPrompts(r.effective, verdict.prompts, "refresh");
-                                if (tickPlane)
-                                    markRosterLanded(r.effective);
+                                const applyReport = hot.report;
                                 if (!fullyLandedForLkg(r, applyReport)) {
                                     ccEtag = undefined;
                                     const refused = applyReport ? refusedGroups(applyReport) : [];
@@ -962,13 +1044,39 @@ export async function createWebAdminRuntime(ctx) {
                         return inFlight;
                     const p = refreshTick(arrival).finally(() => {
                         inFlight = undefined;
+                        afterLane();
                     });
                     inFlight = p;
                     return p;
                 };
+                const requestTick = () => {
+                    if (ccTimer === undefined || ownRead)
+                        return;
+                    if (inFlight !== undefined || refreshInFlight) {
+                        followUp = true;
+                        return;
+                    }
+                    queueMicrotask(() => void runTick());
+                };
+                const afterLane = () => {
+                    if (!followUp)
+                        return;
+                    followUp = false;
+                    if (tier.drifted(currentIdentity()))
+                        requestTick();
+                };
+                unwatchCredential =
+                    ccRef !== undefined && !ccRef.dryRun && configProvider.kind === "remote"
+                        ? ccRef.credential.onRead((read) => {
+                            if (tier.drifted(read.identity))
+                                requestTick();
+                        })
+                        : undefined;
                 manualRefresh = runTick;
                 ccTimer = setInterval(() => void runTick(), 60_000);
                 ccTimer.unref?.();
+                if (tier.drifted(currentIdentity()))
+                    requestTick();
                 const deferredBootApply = async (r, arrivalGen) => {
                     if (!r)
                         return;
@@ -985,6 +1093,7 @@ export async function createWebAdminRuntime(ctx) {
                     }
                     finally {
                         refreshInFlight = false;
+                        afterLane();
                     }
                 };
                 const deferredBootApplyInner = async (r, lateGen) => {
@@ -1001,34 +1110,10 @@ export async function createWebAdminRuntime(ctx) {
                         ccEtag = r.etag;
                         return;
                     }
-                    const planeChangedLate = modelPlaneChanged(appliedPlaneEff, r.effective);
-                    let applyReportLate;
-                    const committedLate = applyEffective(config, r.effective, logger, {
-                        leg: "hot",
-                        checkpointStorePresent,
-                        sealedKeys,
-                        generation: lateGen,
-                        report: (rep) => {
-                            applyReportLate = rep;
-                            recordApply(rep);
-                        },
-                        ...(planeChangedLate ? { swapPlane: swapRunnerDeps } : {}),
-                    });
-                    if (!committedLate)
+                    const hotLate = await commitHot({ eff: r.effective, prompts: lateVerdict.prompts, gen: lateGen, phase: "boot-deferred" });
+                    if (!hotLate.committed)
                         return;
-                    mutateInPlace(pricing, buildPricing(config.models));
-                    keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
-                    limitSync?.sync();
-                    ceilingVerdict?.judge();
-                    applyLiveReadFace(r.effective, swapRunnerDeps, "boot-deferred");
-                    markApplied(lateGen, r.effective.version);
-                    const latePlane = modelPlaneCommitted(applyReportLate);
-                    if (latePlane)
-                        appliedPlaneEff = r.effective;
-                    planeDeferredNoHandoff = undefined;
-                    await adoptCenterPrompts(r.effective, lateVerdict.prompts, "boot-deferred");
-                    if (latePlane)
-                        markRosterLanded(r.effective);
+                    const applyReportLate = hotLate.report;
                     if (!fullyLandedForLkg(r, applyReportLate)) {
                         ccEtag = undefined;
                         const refusedLate = applyReportLate ? refusedGroups(applyReportLate) : [];
@@ -1069,10 +1154,13 @@ export async function createWebAdminRuntime(ctx) {
                 ccTimer = undefined;
             }
             credentialRenewer?.stop();
+            unwatchCredential?.();
+            unwatchCredential = undefined;
         },
         centerCredentialState() {
             return cc === undefined ? undefined : buildCenterCredentialHealthView(cc.credential.health(), credentialRenewer);
         },
+        centerIdentityNoticeState: () => tier.notice(),
     };
 }
 //# sourceMappingURL=web-admin.js.map

package/dist/boot/workflow-orchestration.d.ts

@@ -15,6 +15,7 @@ import { type WorkflowRun, type WorkflowRunStore } from "@sema-agent/core";
 import type { ServiceConfig } from "../config.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { type WorkflowAgentSessionIndex } from "../orchestration/workflow-agent-session-index.js";
+import type { WorkflowParkDecisionStore } from "../orchestration/workflow-park-decision.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import { type WorkflowCompletionInbox } from "../orchestration/workflow-completion-inbox.js";
@@ -49,5 +50,6 @@ export declare function createWorkflowOrchestration(ctx: WorkflowOrchestrationCt
         publishTerminalFleetRow?: (id: string, run: WorkflowRun) => void;
     };
     workflowAgentSessionIndex: WorkflowAgentSessionIndex | undefined;
+    workflowParkDecisions: WorkflowParkDecisionStore | undefined;
 };
 //# sourceMappingURL=workflow-orchestration.d.ts.map

package/dist/boot/workflow-orchestration.js

@@ -66,6 +66,7 @@ export function createWorkflowOrchestration(ctx) {
                 ? backend.workflowAgentSessionIndex()
                 : new LocalWorkflowAgentSessionIndex(join(config.localDataRoot ?? localRoot, "workflows"), undefined))
         : undefined;
+    const workflowParkDecisions = config.selfOrchestrationEnabled && backend !== undefined && (sqlWorkflowRunStore !== undefined || backend.kind === "local") ? backend.workflowParkDecisions?.() : undefined;
     const workflowRunStore = baseWorkflowRunStore
         ? new JournalingWorkflowRunStore(baseWorkflowRunStore, workflowNotifyGate, fleetBus, workflowAgentSessionIndex)
         : undefined;
@@ -82,7 +83,7 @@ export function createWorkflowOrchestration(ctx) {
     return {
         sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion,
         workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink,
-        workflowAgentRegistry, subagentSteerRegistry, workflowRecoverOpts, workflowAgentSessionIndex,
+        workflowAgentRegistry, subagentSteerRegistry, workflowRecoverOpts, workflowAgentSessionIndex, workflowParkDecisions,
     };
 }
 //# sourceMappingURL=workflow-orchestration.js.map

package/dist/brain.js

@@ -9,6 +9,7 @@ import { openaiRouteBaseUrl } from "./model-route-endpoint.js";
 import { catalogEntryFingerprint } from "./web-admin-client/restart-signal.js";
 import { buildDisplaySafeRefusal, buildDisplaySafeUrl } from "./trace/redact.js";
 import { createModelReachBrain } from "./model-unreachable-notice.js";
+import { breakerKeyOf, routeDigestOf } from "./breaker-key.js";
 function isOffDeploymentRoot(baseUrl, config) {
     if (!baseUrl)
         return false;
@@ -20,6 +21,9 @@ function isOffDeploymentRoot(baseUrl, config) {
 function deploymentGatewayRoots(config) {
     return config.gatewayBaseUrl !== undefined ? [config.gatewayBaseUrl, ...config.gatewayFallbackUrls] : [];
 }
+function breakerRoutesOf(config, r) {
+    return r.circuitBreaker ? deploymentGatewayRoots(config).slice(0, -1) : [];
+}
 function deploymentGatewayKey(config) {
     return config.gatewayBaseUrl !== undefined ? config.gatewayApiKey : undefined;
 }
@@ -53,6 +57,7 @@ export function createBrainAssembly(config, deps = {}) {
             ? { maxRetries: FAST_FAIL_MAX_RETRIES }
             : {};
     const routes = deploymentGatewayRoots(config);
+    const breakerRoutes = breakerRoutesOf(config, r);
     const openaiBrains = routes.map((baseUrl, i) => {
         const gatewayKey = deploymentGatewayKey(config);
         const brain = constructRouteBrain(i === 0 ? "gateway route" : `gateway fallback route[${i - 1}]`, [baseUrl], () => createOpenAIBrain({
@@ -62,13 +67,12 @@ export function createBrainAssembly(config, deps = {}) {
             fetchImpl,
             ...timeouts,
         }));
-        const isLast = i === routes.length - 1;
-        return r.circuitBreaker && !isLast
+        return i < breakerRoutes.length
             ? createCircuitBreakerBrain(brain, {
                 failureThreshold: r.failureThreshold,
                 cooldownMs: r.cooldownMs,
                 state: breakerState,
-                key: (m) => `${m.provider ?? "openai"}:${m.id}@${baseUrl}`,
+                key: (m) => breakerKeyOf(m, baseUrl),
             })
             : brain;
     });
@@ -206,6 +210,7 @@ export function brainSummary(config) {
         idleTimeoutMs: r.idleTimeoutMs,
         circuitBreaker: breakerActive,
         circuitBreakerRequested: r.circuitBreaker,
+        circuitBreakerRoutes: breakerRoutesOf(config, r).map((u) => ({ route: buildDisplaySafeUrl(u), digest: routeDigestOf(u) })),
         gatewayRetryCap: config.gatewayMaxRetries !== undefined
             ? `env:${config.gatewayMaxRetries}`
             : hasFailover || r.circuitBreaker || config.degrade?.reactive

package/dist/breaker-key.d.ts

@@ -0,0 +1,6 @@
+import { type Model } from "@sema-agent/core";
+/** 一条路由的身份摘要(键的路由段;启动日志把它与该路由的展示串并排印出,运维据此把错误文本 / 表行对回路由)。 */
+export declare function routeDigestOf(baseUrl: string): string;
+/** 断路器键:`<头段>@<路由摘要>`,头段 = `<provider>:<model id>`(放不下列宽预算时见 {@link boundedHead})。provider 缺席按 `openai`(与 core 默认键同一个前半)。恒 ≤ 190 字节。 */
+export declare function breakerKeyOf(model: Pick<Model, "provider" | "id">, baseUrl: string): string;
+//# sourceMappingURL=breaker-key.d.ts.map

package/dist/breaker-key.js

@@ -0,0 +1,29 @@
+import { createHash } from "node:crypto";
+import { routeKeyOf } from "@sema-agent/core";
+const ROUTE_DIGEST_HEX = 24;
+const BREAKER_KEY_MAX_BYTES = 190;
+const HEAD_MAX_BYTES = BREAKER_KEY_MAX_BYTES - 1 - ROUTE_DIGEST_HEX;
+const HEAD_DIGEST_HEX = 16;
+const sha256Hex = (text) => createHash("sha256").update(text, "utf8").digest("hex");
+export function routeDigestOf(baseUrl) {
+    return sha256Hex(routeKeyOf(baseUrl)).slice(0, ROUTE_DIGEST_HEX);
+}
+export function breakerKeyOf(model, baseUrl) {
+    return `${boundedHead(`${model.provider ?? "openai"}:${model.id}`)}@${routeDigestOf(baseUrl)}`;
+}
+function boundedHead(head) {
+    if (Buffer.byteLength(head, "utf8") <= HEAD_MAX_BYTES)
+        return head;
+    const tail = `~${sha256Hex(head).slice(0, HEAD_DIGEST_HEX)}`;
+    let prefix = "";
+    let used = 0;
+    for (const ch of head) {
+        const n = Buffer.byteLength(ch, "utf8");
+        if (used + n > HEAD_MAX_BYTES - tail.length)
+            break;
+        prefix += ch;
+        used += n;
+    }
+    return `${prefix}${tail}`;
+}
+//# sourceMappingURL=breaker-key.js.map

package/dist/caller-text-echo.d.ts

@@ -10,11 +10,14 @@ export declare function echoCallerText(text: string, opts?: EchoCallerTextOption
 /** 句子里点名一个值的写法:{@link echoCallerText} 外加一对双引号。 */
 export declare function quotedCallerText(text: string): string;
 /**
- * 一个**判不过**的申报名(MCP server / A2A 对端的 `name`)在拒句 / 告警元数据里的回显:非串只说种类、空串说 `empty`,否则按本口径的引号形
- * 外加送来的原长度(运维要的是「我那个名字长了多少」,不是一屏乱码)。判据本身不在这里:「能不能用」只有契约包的 `isUsableWireName` 一只
- * (请求腿 / 声明腿同读),本函数只管回显 —— 回显清洗是消费方按自己的腿定的(契约包的判官模块头注同此分工)。
+ * 数据截断(**不是**回显):前 `max` 字 + `…(总长)`;不超则原样。给喂回模型 / 交给 hook 的**数据**用 —— 读的一方(模型、hook 作者)看得出被截、截掉多少。
+ * 不剥控制与双向字符:数据要原样(exit 2 的多行 stderr 保行)。写进日志字段 / 回到人面前的串**不用**它,用 {@link echoCallerText}。
  */
-export declare function describeBadWireName(v: unknown): string;
-/** 一个词表外的 `contentOrigin` 值在拒句 / 告警元数据里的回显:串 ⇒ 本口径的引号形;非串 ⇒ 只说种类。判据是契约包的 `isContentOriginWord`(不在这里)。 */
-export declare function describeBadContentOrigin(v: unknown): string;
+export declare function clipDataText(s: string, max: number): string;
+/**
+ * 硬帽:前 `max` 字,什么也不加;不超则原样,缺席(`undefined`)透传。给带 schema `.max()` 的 wire 字段用(审批卡:整只 ask 不能因为一个 200 KB 的字段落不了库)——
+ * 截断记号会让串超过 schema 的上限,所以这里没有记号;也不剥控制与双向字符(卡上的串是要被人审的那一串,清洗会让「看到的」与「将执行的」不是同一个东西)。
+ */
+export declare function capText(s: string, max: number): string;
+export declare function capText(s: string | undefined, max: number): string | undefined;
 //# sourceMappingURL=caller-text-echo.d.ts.map