@sema-agent/server 7.132.0 → 7.134.0

package/dist/http/routes/approvals-assistant.js

@@ -4,7 +4,7 @@ import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
 import { APPROVAL_GATE_KINDS, carriesDeploymentListQuestion, standingAnswerDurablyRecordable } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
-import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
+import { principalFrom, decodeCheckpointScope, ownerOfCheckpointScope, CHECKPOINT_PUBLIC_SCOPE, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
 import { MAX_APPROVAL_REASON_CHARS, projectQuestionAnswer, questionAnswerFromProjection } from "../../approval-hmac.js";
 import { PLAN_APPROVE_PERMISSION_MODES_AFTER, isPlanApprovePermissionModeAfter, planReviewDecisionExitsPlan, storedBodyPermissionMode } from "../../task-settings.js";
@@ -14,22 +14,26 @@ import { redactRiskDescriptor } from "../../observability/run-terminal.js";
 import { buildRunName } from "../../fleet/fleet-bus.js";
 import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
-import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal } from "../principal-gate.js";
+import { sendJson, sendError, sseHeaders, logRequestError, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
+import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sessionCallerOf } from "../principal-gate.js";
+import { readOwnedRun, readOwnedSession } from "../owner-access.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
 import { deploymentListAsks } from "../../approval.js";
 import { callGrantBindingOf, questionGrantBindingOf } from "../../standing-answer-grant.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { readResumeCtx } from "../resume-ctx-read.js";
+import { KEEP_SEALED, readResumeCtx } from "../resume-ctx-read.js";
+import { StoreCorruptError } from "../../plugins/sql-json-column.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
+import { durableRowIdentity } from "../../checkpoint-identity.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
+import { fieldConflictFacts } from "../../field-conflict.js";
 const DECIDE_BODY_DECLARED_KEYS = [
-    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decision", "reason", "remember", "updatedInput",
+    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decision", "feedback", "reason", "remember", "updatedInput",
 ];
 const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
-const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "remember", "updatedInput"];
+const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "feedback", "remember", "updatedInput"];
 const PLAN_REVIEW_BODY_DECLARED_KEYS = [
     "boundCallId", "decidedBy", "decision", "editedPlan", "permissionModeAfter", "reason",
 ];
@@ -268,20 +272,32 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
         }
         const cs = park.checkpointStore;
         const principal = gatedPrincipal(req, deps.config);
-        const operator = isOperator(principal, deps.config.operatorPrincipals);
+        const operator = explicitOperatorOk(principal, deps.config);
+        const ownScope = principal ?? CHECKPOINT_PUBLIC_SCOPE;
         if (match.decl.id === "approvals-stream") {
             const scope = operator
                 ? (new URLSearchParams(match.search).get("owner") ?? undefined)
-                : (principal ?? "__none__");
+                : ownScope;
             await streamApprovals(req, res, cs, deps.toolApproval, scope, deps.config);
             return;
         }
         if (match.decl.id === "approvals-list") {
             const scope = operator
                 ? (new URLSearchParams(match.search).get("owner") ?? undefined)
-                : (principal ?? "__none__");
+                : ownScope;
+            let durableRows;
+            try {
+                durableRows = await cs.listPending(scope);
+            }
+            catch (err) {
+                if (!isApprovalsReadCorrupt(err))
+                    throw err;
+                logRequestError(deps.logger, req, err);
+                sendError(res, 500, "approvals.read_corrupt", "a stored approval row cannot be read - retrying this request will fail the same way until an operator repairs or removes the row");
+                return;
+            }
             sendJson(res, 200, {
-                pending: (await cs.listPending(scope)).map((r) => projectPendingForWire(r, deps.config)),
+                pending: durableRows.map((r) => projectPendingForWire(r, deps.config)),
                 serverNowMs: Date.now(),
                 ...(deps.toolApproval ? { livePending: deps.toolApproval.listLivePending(scope) } : {}),
                 ...(deps.approvalAskAudit ? { crashConverged: deps.approvalAskAudit.listCrashConverged(scope) } : {}),
@@ -300,17 +316,13 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
                     return;
                 }
-                const operators = deps.config.operatorPrincipals;
-                const isExplicitOperator = explicitOperatorOk(principal, operators);
-                if (!isExplicitOperator) {
+                if (!explicitOperatorOk(principal, deps.config)) {
                     const owned = facts.sessionOwnership(deps);
                     if (!owned.available) {
                         sendError(res, 501, "capability.session_store_required", "approval exemptions require a session-store backend");
                         return;
                     }
-                    const ownerOf = owned.sessionStorage.ownerOf.bind(owned.sessionStorage);
-                    const owner = await ownerOf(exSessionId);
-                    if (owner === undefined || (owner !== null && owner !== principal)) {
+                    if ((await readOwnedSession(deps, owned.sessionStorage, sessionCallerOf(req, deps), exSessionId, "owner")) === undefined) {
                         sendError(res, 404, "not_found.session", "not found");
                         return;
                     }
@@ -329,22 +341,28 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
                 const revoked = await deps.approvalExemptionStore.revoke(exSessionId, exToolName);
-                sendJson(res, revoked ? 200 : 404, revoked ? { revoked: true } : { error: "not found", errorCode: "not_found.exemption" });
+                if (revoked)
+                    sendJson(res, 200, { revoked: true });
+                else
+                    sendError(res, 404, "not_found.exemption", "not found");
                 return;
             }
         }
         if (match.decl.id === "assistant-inbox") {
             const ownerParam = new URLSearchParams(match.search).get("owner") || undefined;
-            const scope = operator && ownerParam ? ownerParam : (principal ?? "__none__");
+            const scope = operator && ownerParam ? ownerParam : ownScope;
             const summaries = await cs.listByScope(scope);
             const inbox = (await Promise.all(summaries.map(async (s) => {
-                const ctxRead = await readResumeCtx(cs.getCtx(s.sessionId));
+                const ctxRead = await readResumeCtx(cs.getCtx(s.sessionId), KEEP_SEALED);
                 if (ctxRead.kind === "corrupt")
                     recordFailOpen("server.assistant-inbox.objective-ctx-corrupt", ctxRead.where);
-                const objective = ctxRead.kind === "ok" ? (ctxRead.ctx.body?.objective ?? null) : null;
+                const storedBody = ctxRead.kind === "ok" ? ctxRead.ctx.body : undefined;
+                const storedObjective = typeof storedBody === "object" && storedBody !== null ? storedBody.objective : undefined;
+                const objective = typeof storedObjective === "string" ? storedObjective : null;
                 const input = s.toolInput != null ? redactedPreview(s.toolInput) : null;
                 return {
                     sessionId: s.sessionId,
+                    ...durableRowIdentity("assistant-inbox", s.checkpointId, s.token),
                     scope: s.scope,
                     createdAt: s.createdAt,
                     ...(s.gateKind !== undefined ? { gateKind: s.gateKind } : {}),
@@ -364,13 +382,14 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     objective,
                     input,
                 };
-            }))).sort((a, b) => (b.severity ?? 0) - (a.severity ?? 0) || (a.createdAt ?? 0) - (b.createdAt ?? 0));
+            })))
+                .sort((a, b) => (b.severity ?? 0) - (a.severity ?? 0) || (a.createdAt ?? 0) - (b.createdAt ?? 0));
             sendJson(res, 200, { inbox });
             return;
         }
         if (match.decl.id === "assistant-tasks") {
             const ownerParam = new URLSearchParams(match.search).get("owner") || undefined;
-            const scope = operator && ownerParam ? ownerParam : (principal ?? "__none__");
+            const scope = operator && ownerParam ? ownerParam : ownScope;
             const ledger = facts.durableRuns(deps);
             if (!ledger.available) {
                 sendJson(res, 200, { tasks: [] });
@@ -379,7 +398,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const runStore = ledger.runStore;
             const summaries = await cs.listByScope(scope);
             const byGate = new Map(summaries.map((s) => [s.sessionId, s]));
-            const runs = await runStore.listRuns({ owner: scope, limit: 100 });
+            const runs = await runStore.listRuns({ owner: ownerOfCheckpointScope(scope), limit: 100 });
             const tasks = runs
                 .filter((r) => r.status === "running" || isParkedRunStatus(r.status))
                 .map((r) => {
@@ -416,17 +435,11 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 return;
             }
             const taskId = match.params.taskId;
-            const run = await runStore.getRun(taskId);
+            const run = await readOwnedRun(deps.config, runStore, principal, taskId, "owner_or_operator");
             if (!run) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
-            const operators = deps.config.operatorPrincipals;
-            const explicitOperator = explicitOperatorOk(principal, operators);
-            if (!explicitOperator && run.owner !== null && run.owner !== principal) {
-                sendError(res, 404, "not_found.run", "task not found");
-                return;
-            }
             if (run.status === "running") {
                 const ownedHere = run.instanceId != null && run.instanceId === deps.instanceId;
                 if (ownedHere && !preemptableRuns.has(taskId)) {
@@ -482,8 +495,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
-            const operators = deps.config.operatorPrincipals;
-            const explicitOperator = explicitOperatorOk(principal, operators);
+            const explicitOperator = explicitOperatorOk(principal, deps.config);
             if (!explicitOperator && run.owner !== null && run.owner !== principal) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
@@ -520,7 +532,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
             }
             if (decision === "edit" && (typeof body.editedPlan !== "string" || body.editedPlan.length === 0)) {
-                sendError(res, 400, "request.field_conflict", "decision 'edit' requires a non-empty editedPlan (the operator's revised plan)");
+                sendError(res, 400, "request.field_conflict", "decision 'edit' requires a non-empty editedPlan (the operator's revised plan)", fieldConflictFacts("plan_edit", ["decision", "editedPlan"]));
                 return;
             }
             const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
@@ -543,7 +555,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 return;
             }
             if (decision !== "edit" && body.editedPlan !== undefined) {
-                sendError(res, 400, "request.field_conflict", `editedPlan is only valid with decision 'edit' (got '${decision}')`);
+                sendError(res, 400, "request.field_conflict", `editedPlan is only valid with decision 'edit' (got '${decision}')`, fieldConflictFacts("plan_edit", ["editedPlan", "decision"]));
                 return;
             }
             if (body.permissionModeAfter !== undefined && !isPlanApprovePermissionModeAfter(body.permissionModeAfter)) {
@@ -551,7 +563,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 return;
             }
             if (!planReviewDecisionExitsPlan(decision) && body.permissionModeAfter !== undefined) {
-                sendError(res, 400, "request.field_conflict", `permissionModeAfter is only valid with a decision that carries the plan out ('approve' or 'edit'; got '${decision}')`);
+                sendError(res, 400, "request.field_conflict", `permissionModeAfter is only valid with a decision that carries the plan out ('approve' or 'edit'; got '${decision}')`, fieldConflictFacts("plan_mode_after", ["permissionModeAfter", "decision"]));
                 return;
             }
             if (body.reason !== undefined && typeof body.reason !== "string") {
@@ -572,7 +584,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
                 if (!deps.config.directDoorActive) {
-                    sendError(res, 400, "request.field_conflict", "boundCallId (the plan_review nonce) is only valid on a direct-door worker — a BFF worker carries no decision proof to bind it to");
+                    sendError(res, 400, "request.field_conflict", "boundCallId (the plan_review nonce) is only valid on a direct-door worker — a BFF worker carries no decision proof to bind it to", fieldConflictFacts("bound_call_door", ["boundCallId"]));
                     return;
                 }
             }
@@ -611,8 +623,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 deciderPrincipal = proof.principal;
                 singleUse = proof.singleUse === undefined ? undefined : { proof: proof.singleUse, store };
             }
-            const operators = deps.config.operatorPrincipals;
-            const explicitOperator = explicitOperatorOk(deciderPrincipal, operators);
+            const explicitOperator = explicitOperatorOk(deciderPrincipal, deps.config);
             if (!explicitOperator && run.owner !== null && run.owner !== deciderPrincipal) {
                 deps.logger?.info?.("decide_404", { reason: "owner-mismatch", taskId, principalPresent: principal !== undefined });
                 sendError(res, 404, "not_found.run", "task not found");
@@ -626,7 +637,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             if (body.permissionModeAfter !== undefined) {
                 const storedCtx = plan.prepared.ctx;
                 if (storedCtx.body !== undefined && storedBodyPermissionMode(storedCtx.body) !== "plan") {
-                    sendError(res, 400, "request.field_conflict", "permissionModeAfter does not apply to this task: it was not started in plan mode (its stored permission mode is not \"plan\"), so approving the plan returns it to the mode it was in before planning");
+                    sendError(res, 400, "request.field_conflict", "permissionModeAfter does not apply to this task: it was not started in plan mode (its stored permission mode is not \"plan\"), so approving the plan returns it to the mode it was in before planning", fieldConflictFacts("plan_mode_after", ["permissionModeAfter"]));
                     return;
                 }
             }
@@ -657,7 +668,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
             if (!decision) {
-                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, decidedBy? }", retiredDecisionKeyFacts(body)?.extra);
+                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, decidedBy?, feedback? }", retiredDecisionKeyFacts(body)?.extra);
                 return;
             }
             {
@@ -683,7 +694,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
                 if (decision !== "approve") {
-                    sendError(res, 400, "request.field_conflict", "remember requires decision 'approve'");
+                    sendError(res, 400, "request.field_conflict", "remember requires decision 'approve'", fieldConflictFacts("remember_decision", ["remember", "decision"]));
                     return;
                 }
                 if (deps.config.directDoorActive) {
@@ -721,6 +732,10 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
             }
+            if (body.feedback !== undefined && typeof body.feedback !== "string") {
+                sendError(res, 400, "request.field_invalid", "feedback must be a string (the words the approving person wrote on the card; omit the key when there are none)");
+                return;
+            }
             if (deps.config.directDoorActive && body.updatedInput !== undefined) {
                 sendError(res, 400, "updated_input_not_in_proof", "updatedInput is not supported on a direct-door worker (not covered by the decision proof)");
                 return;
@@ -729,6 +744,10 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "checkpoint_token_not_in_proof", "checkpointToken is not supported on a direct-door worker (not covered by the decision proof); bind the decision with boundCallId and boundInputHash instead");
                 return;
             }
+            if (deps.config.directDoorActive && body.feedback !== undefined) {
+                sendError(res, 400, "feedback_not_in_proof", "feedback is not supported on a direct-door worker (not covered by the decision proof)");
+                return;
+            }
             const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
             switch (decidedByReading.kind) {
                 case "not_in_proof":
@@ -745,11 +764,20 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
             }
             const decidedBy = decidedByReading.decidedBy;
+            if (body.feedback !== undefined && decision !== "approve") {
+                sendError(res, 400, "request.field_conflict", "feedback is only valid with decision 'approve' — the words of a denial are its reason", fieldConflictFacts("approval_feedback", ["feedback", "decision"]));
+                return;
+            }
+            if (body.feedback !== undefined && decidedBy !== "person") {
+                sendError(res, 400, "request.field_conflict", "feedback is only valid on a person's decision — the agent reads it as the user's own words, which a policy decision cannot carry", fieldConflictFacts("approval_feedback", ["feedback", "decidedBy"]));
+                return;
+            }
             const binding = {
                 checkpointToken: body.checkpointToken,
                 boundCallId: body.boundCallId,
                 boundInputHash: body.boundInputHash,
                 updatedInput: body.updatedInput,
+                ...(typeof body.feedback === "string" ? { feedback: body.feedback } : {}),
             };
             let deciderPrincipal = principal;
             if (deps.config.directDoorActive) {
@@ -770,8 +798,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
                 deciderPrincipal = proof.principal;
             }
-            const operators = deps.config.operatorPrincipals;
-            const explicitOperator = explicitOperatorOk(deciderPrincipal, operators);
+            const explicitOperator = explicitOperatorOk(deciderPrincipal, deps.config);
             if (!explicitOperator) {
                 const cpScope = await cs
                     .peekPendingScope(sessionId, { gateKinds: APPROVAL_GATE_KINDS })
@@ -814,6 +841,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(decision === "approve" && binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
                     ...(answer !== undefined ? { answer } : {}),
                     ...((r) => (r !== undefined ? { reason: r } : {}))(decisionReasonOf(body)),
+                    ...(binding.feedback !== undefined ? { feedback: binding.feedback } : {}),
                 },
                 deciderPrincipal,
                 explicitOperator,
@@ -830,6 +858,9 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
     return assertNever(match.decl.id);
 }
 const APPROVALS_STREAM_POLL_MS = 3000;
+function isApprovalsReadCorrupt(err) {
+    return err instanceof StoreCorruptError;
+}
 function redactPendingDisclosures(row) {
     const rd = row.riskDescriptor;
     if (rd === null || rd === undefined)
@@ -895,23 +926,27 @@ export async function streamApprovals(req, res, cs, live, scope, governance, pol
     });
     let first = true;
     while (!closed) {
-        let pending;
-        let livePending;
+        let snapshot;
         try {
-            pending = (await cs.listPending(scope)).map((r) => projectPendingForWire(r, governance));
-            livePending = live ? live.listLivePending(scope) : [];
+            const pending = (await cs.listPending(scope)).map((r) => projectPendingForWire(r, governance));
+            snapshot = { pending, livePending: live ? live.listLivePending(scope) : [] };
         }
-        catch {
+        catch (err) {
+            if (isApprovalsReadCorrupt(err)) {
+                if (!res.writableEnded)
+                    res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "approvals.read_corrupt", message: "a stored approval row cannot be read - this stream is closing, and reconnecting will fail the same way until an operator repairs or removes the row" })}\n\n`);
+                break;
+            }
             if (!res.writableEnded)
-                res.write(`event: heartbeat\ndata: ${JSON.stringify({ type: "heartbeat" })}\n\n`);
-            await sleep(pollMs);
-            continue;
+                res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "approvals.read_unavailable", message: "the approvals queue could not be read - this stream stays open and retries on its next poll; until a read succeeds, silence here does not mean nothing is pending" })}\n\n`);
         }
-        durableLane.tick(pending);
-        liveLane.tick(livePending);
-        if (first) {
-            res.write(`event: synced\ndata: ${JSON.stringify({ type: "synced", count: pending.length })}\n\n`);
-            first = false;
+        if (snapshot !== undefined) {
+            durableLane.tick(snapshot.pending);
+            liveLane.tick(snapshot.livePending);
+            if (first) {
+                res.write(`event: synced\ndata: ${JSON.stringify({ type: "synced", count: snapshot.pending.length })}\n\n`);
+                first = false;
+            }
         }
         if (Date.now() - start > SSE_MAX_STREAM_MS) {
             res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "approvals stream reached its 15-minute cap — reconnect to continue" })}\n\n`);

package/dist/http/routes/background.js

@@ -7,6 +7,7 @@ import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../pri
 import {} from "../route-ctx.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
+import { sessionOwnerCellOf } from "../../security.js";
 const LIST_LIMIT = 500;
 export const DESCRIPTION_MAX = 500;
 const ROW_KEY_DISPOSITION = {
@@ -67,8 +68,8 @@ export async function handleBackground(req, res, match, ctx) {
         sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
         return;
     }
-    const isOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-    if (!isOperator && !ctx.helpers.sessionOwnerOk(req, res, owner))
+    const operator = explicitOperatorOk(principal, deps.config);
+    if (!operator && !ctx.helpers.sessionOwnerOk(req, res, await sessionOwnerCellOf(owned.sessionStorage, sessionId, owner)))
         return;
     const scope = owner ?? "default";
     switch (id) {

package/dist/http/routes/capabilities.js

@@ -2,6 +2,8 @@ import { PERMISSION_MODES, USER_ATTACHMENT_SEAT, expandTiers, reasoningEffortLev
 import { modelImageInput, modelReasoningDecl, isAtMentionable, selectableCatalog } from "../../model-select.js";
 import { buildDroppedEntriesWire } from "../../web-admin-client/read-warnings.js";
 import { buildCandidateRejectedWire } from "../../web-admin-client/candidate-gate.js";
+import { buildModelPlaneFace } from "../../model-plane-face.js";
+import { isRosterGateArmed } from "../../config.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
@@ -10,7 +12,7 @@ import { leaderEntryRefusal, leaderRunEntry } from "../../leader/run-entry.js";
 import { autonomyKeepsOpenWriteFace, autonomyModeFloor } from "../../runtime-governance.js";
 import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protocol.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
-import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
+import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, McpProbeMisaligned, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
 import { mcpForScenario } from "../../web-admin-client/facade.js";
 import { sendScenarioNotFound } from "../scenario-read-face.js";
 import { sendJson, sendError } from "../send.js";
@@ -21,6 +23,7 @@ import { projectWriteProtectionCapability } from "../../write-protection.js";
 import { projectStoreCapability } from "../../store-posture.js";
 import { projectWebSearchCapability } from "../../plugins/web-search.js";
 import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
+import { MCP_ASSERTION_HEADER_SENT } from "../../mcp-assertion-header.js";
 import { gateCompositeMembers } from "../../capabilities/composite-members.js";
 import { projectApprovalsStreamLiveCapability } from "../../capabilities/approvals-push.js";
 import { workflowModelAllowlistFor } from "../../task-workflow.js";
@@ -29,6 +32,7 @@ import * as facts from "../../capability-facts.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
 import { coercePermissionModeStrict, PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { callerTrust } from "../caller-trust.js";
 function routePairingOf(deps, name, m) {
     if (modelKeyPoisonOf(name, deps.config.modelApiKeyEnv ?? {}, process.env, deps.config.modelApiKeys ?? {}) !== undefined)
         return "unknown";
@@ -72,12 +76,14 @@ export async function handleCapabilities(req, res, match, ctx) {
             if (autoModeFault !== undefined)
                 deps.logger?.warn("auto_mode_face_resolver_fault", { fault: autoModeFault });
             const rulesLaneForCaller = facts.ruleLaneForCaller(deps, gatedPrincipal(req, deps.config)).available;
+            const streamApprovalFact = facts.streamApproval(deps);
             sendJson(res, 200, gateCompositeMembers({
                 ...deps.capabilities,
                 ...facts.engineCapabilityBits(),
                 asyncRuns: facts.durableRuns(deps).available,
                 artifacts: facts.durableRuns(deps).available,
                 approvals: facts.checkpointPark(deps).available,
+                approvalReadRootGrant: facts.readRootGrant(deps).available,
                 sessions: facts.sessionAuditView(deps).available,
                 deviceExecutor: facts.deviceLane(deps).available
                     ? { enabled: true, protocolVersion: DEVICE_PROTOCOL_VERSION, maxInflightPerDevice: deps.config.remoteExec?.provider === "device" ? (deps.config.remoteExec.maxInflightPerDevice ?? 4) : 4, wsPath: DEVICE_WS_PATH, management: facts.deviceManagement(deps).available }
@@ -100,6 +106,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 mcpReconnect: facts.mcpReconnect(deps).available,
                 background: { listFace: facts.sessionOwnership(deps).available, exitFaces: facts.sessionOwnership(deps).available },
                 sharedMemory: facts.sharedMemoryRead(deps).available,
+                principalInboxDelivery: facts.principalInboxDelivery(deps).available,
                 adoption: facts.adoption(deps).available,
                 memoryBundle: facts.memoryBundle(deps).available,
                 memoryCompliance: facts.memoryCompliance(deps).available,
@@ -124,8 +131,8 @@ export async function handleCapabilities(req, res, match, ctx) {
                 scratchpadDir: true,
                 subagentSteer: facts.subagentSteer(deps).available,
                 subagentResume: facts.subagentSteer(deps).available,
-                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: taskHooksHonored(deps.config) },
-                settings: { permissions: { allowGrant: true, allowLayer: true } },
+                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: taskHooksHonored(deps.config), pluginHooks: taskHooksHonored(deps.config), managedHookGroups: taskHooksHonored(deps.config), tightenOnlySeats: true, approvalFrameFamilies: true },
+                settings: { permissions: { allowGrant: true, allowLayer: true, callerTrust: callerTrust(req, deps.config).trust } },
                 permissionModeAuto: {
                     accepted: true,
                     classifierSeat: deps.autoModeFace?.seatMounted === true,
@@ -160,11 +167,13 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sessionInit: true,
                 mcp: true,
                 mcpProbe: true,
+                mcpAssertionHeaderSent: MCP_ASSERTION_HEADER_SENT,
                 mcpElicitation: facts.elicitation(deps).available,
                 askUserQuestion: facts.askUserQuestion(deps).available,
                 toolApproval: facts.toolApproval(deps).available,
                 approvalsStreamLive: projectApprovalsStreamLiveCapability(deps),
-                streamApproval: facts.streamApproval(deps).available,
+                streamApproval: streamApprovalFact.available,
+                approvalFrameFamilies: [...facts.approvalFrameFamilies(streamApprovalFact)],
                 approvalDecisionNote: true,
                 approvalDecidedBy: true,
                 permissionModes: [...PERMISSION_MODES],
@@ -273,6 +282,11 @@ export async function handleCapabilities(req, res, match, ctx) {
                 defaultModel: { id: deps.config.model.id, ...(defaultName ? { name: defaultName } : {}) },
                 droppedEntries: buildDroppedEntriesWire(deps.config.droppedCatalogEntries),
                 ...(candidateRejection !== undefined ? { candidateRejected: buildCandidateRejectedWire(candidateRejection) } : {}),
+                modelPlane: buildModelPlaneFace(deps.config, {
+                    envTableIsPlaceholder: isRosterGateArmed(deps.config.webAdmin),
+                    candidateRejection,
+                    modelRefusals: deps.modelRefusalsState?.(),
+                }),
             });
             return;
         }
@@ -330,6 +344,8 @@ async function answerMcpProbe(res, ctx, answer, outcome, declaredBy) {
             sendMcpProbeRefusal(res, ctx, buildMcpProbeIncompleteRefusal(err.boundMs), "failed", Math.ceil(err.boundMs / 1000));
             return;
         }
+        if (err instanceof McpProbeMisaligned)
+            throw err;
         if (declaredBy === "caller") {
             sendMcpProbeRefusal(res, ctx, buildMcpProbeDeclarationRefusal(), "failed");
             return;

package/dist/http/routes/config-catalog.d.ts

@@ -9,9 +9,9 @@
  * 门序 = operator 面口径:身份 → 能力(事实 `configCatalog`,501)→ 授权 → 应答;billable=false,
  * 刻意不吃 drain / roster-pending 两道 503(排障读面在停机窗里恰恰要打得通)。
  *
- * 🔴 鉴权 = `explicitOperatorOk`(空名单=谁都不是)——设计稿 §0.5 点名**禁** `isOperator` 那个
- * 「空名单=人人都是」的 fail-open 谓词:本面是部署事实外泄口(env 在场性/后端形态/限额值),
- * 单用户形也不放宽。
+ * 🔴 鉴权 = `explicitOperatorOk`(「谁是 operator」的唯一读法:空名单 = 谁都不是)—— 设计稿 §0.5 点名禁「空名单 = 人人都是」的 fail-open 读法
+ * (S-1050 起整只删):本面是部署事实外泄口(env 在场性 / 后端形态 / 限额值)。单用户形只在部署方显式声明 `OPERATOR_SINGLE_USER=true`
+ * (每个调用方都是运维)时对调用方开。
  *
  * 🔴 旋钮 `CONFIG_CATALOG_ENABLED=false` / operator 名单空 ⇒ 501(事实 `configCatalog`,与能力位同一只函数):
  * 旋钮关 = `feature.config_catalog_disabled`(合规部署不想让部署事实上 wire 的表态;「去开旋钮」由码与句承担),

package/dist/http/routes/config-catalog.js

@@ -29,7 +29,7 @@ export async function handleConfigCatalog(req, res, match, ctx) {
                         return assertNever(fact.why);
                 }
             }
-            if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+            if (!explicitOperatorOk(principal, deps.config)) {
                 sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
                 return;
             }

package/dist/http/routes/devices.js

@@ -47,14 +47,7 @@ function bodyKeyIssue(body, accepted) {
     return `unknown key(s) in body: ${extra.join(", ")} — this endpoint accepts ${accepted.length === 0 ? "no body keys" : accepted.slice().sort().join(", ")} (a silently dropped key is a declaration that never existed)`;
 }
 async function readClosedBody(req, res, readJson, accepted) {
-    let body;
-    try {
-        body = await readJson(req);
-    }
-    catch {
-        sendError(res, 400, "request.invalid_json", "invalid JSON body");
-        return null;
-    }
+    const body = await readJson(req);
     if (typeof body !== "object" || body === null || Array.isArray(body)) {
         sendError(res, 400, "request.body_shape", "body must be a JSON object");
         return null;
@@ -151,7 +144,7 @@ export async function handleDevices(req, res, match, ctx) {
         }
     }
     const { store, hub, enrollment, runStore } = lane;
-    const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
+    const operator = explicitOperatorOk(principal, deps.config);
     const domain = deviceOwnerDomainOf(req, deps.config);
     if (match.decl.id === "devices-list") {
         if (!operator && domain === undefined) {
@@ -277,14 +270,7 @@ export async function handleDevices(req, res, match, ctx) {
         sendDeviceNotFound(res);
         return;
     }
-    let body;
-    try {
-        body = (await readJson(req));
-    }
-    catch {
-        sendError(res, 400, "request.invalid_json", "invalid JSON body");
-        return;
-    }
+    const body = (await readJson(req));
     if (typeof body !== "object" || body === null || typeof body.toDeviceId !== "string" || body.expectedRev === undefined) {
         sendError(res, 400, "request.body_shape", "body must be { toDeviceId: string, expectedRev: number } — expectedRev is the binding rev read from GET /v1/devices/sessions/{rootSessionId} (explicit prior state; two concurrent operators must not silently stomp each other)");
         return;

package/dist/http/routes/diagnostics.d.ts

@@ -43,8 +43,8 @@ export interface ServerWiringGateInput {
     streamApprovalEnabled: boolean;
     /** 谓词自己的入参类型(结构形,不 import store 依赖树)—— 取型而非重述,两处不可能漂。 */
     backend: StreamApprovalGateInput["backend"];
-    /** 在场性即事实;本面不取实例,故 `unknown` 足够(取窄型会把整棵 store 类型树拖进诊断域)。 */
-    checkpointStore: unknown;
+    /** 谓词自己的入参类型(只收店的形,工厂方法过不了 tsc)—— 取型而非重述,与 `backend` 同理;在场性即事实,本面不读实例的内容。 */
+    checkpointStore: StreamApprovalGateInput["checkpointStore"];
     durableApproval: boolean;
     /** S-178:三个 posture 旋钮的**来源**,取自 config 上与值同处写的那一格(不在这里重判)。 */
     durableApprovalSource: PostureSource;
@@ -68,7 +68,7 @@ export interface StaticWiringAudit {
 export interface StaticWiringFacts {
     /** core `describeStaticWiring(deps, specTemplate)` 的产物。 */
     manifest: WiringManifest;
-    /** 我方喂给 `resolveStreamApprovalGate` 的 `parkFacility` 实参(= checkpoint 店在场 ∧ DURABLE_APPROVAL)。 */
+    /** 我方喂给 `resolveStreamApprovalGate` 的 `checkpointStore` 实参的在场性(= checkpoint 店在场 ∧ DURABLE_APPROVAL)。 */
     parkFacility: boolean;
     /** store backend 的种类;`undefined` = env-only worker(无 backend)。 */
     backendKind: "mysql" | "pg" | "local" | undefined;

package/dist/http/routes/diagnostics.js

@@ -12,27 +12,31 @@ export function buildServerWiringGates(input) {
         toolApprovalEnabled: input.toolApprovalEnabled,
         streamApprovalEnabled: input.streamApprovalEnabled,
         backend: input.backend,
-        parkFacility: input.checkpointStore !== undefined,
+        checkpointStore: input.checkpointStore,
     });
     const noCenterArm = (knob) => `this knob has no web-admin arm on this deployment — it is set by ${knob} on this machine, or derived from the deployment posture`;
+    const noLaneArm = (knob) => `this knob has no execution-lane default — ${knob} does not depend on which execution lane this deployment runs`;
     return {
         streamApproval: gate.active ? "active" : gate.reason,
         durableApproval: buildPostureKnobReading(input.durableApproval, {
             knob: "DURABLE_APPROVAL",
             source: input.durableApprovalSource,
             centerMeaning: noCenterArm("DURABLE_APPROVAL"),
+            laneMeaning: noLaneArm("DURABLE_APPROVAL"),
             postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set) composed with a durable store being present: park/resume and the /v1/approvals routes are on by default — set DURABLE_APPROVAL=false to pin them off",
         }),
         streamAskWindowMs: buildPostureKnobReading(input.streamAskWindowMs, {
             knob: "STREAM_ASK_WINDOW_MS",
             source: input.streamAskWindowMsSource,
             centerMeaning: noCenterArm("STREAM_ASK_WINDOW_MS"),
+            laneMeaning: noLaneArm("STREAM_ASK_WINDOW_MS"),
             postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): an approval card waits 24h instead of 5 minutes, so stepping away does not settle the run unattended — set STREAM_ASK_WINDOW_MS to pin your own window",
         }),
         sessionAutoTitle: buildPostureKnobReading(input.sessionAutoTitle, {
             knob: "SESSION_AUTO_TITLE",
             source: input.sessionAutoTitleSource,
             centerMeaning: noCenterArm("SESSION_AUTO_TITLE"),
+            laneMeaning: noLaneArm("SESSION_AUTO_TITLE"),
             postureMeaning: "this knob has no posture arm — its default is the same on every deployment shape",
         }),
         checkpointStore: input.checkpointStore !== undefined,
@@ -93,7 +97,7 @@ export async function handleDiagnostics(req, res, match, ctx) {
                     return;
                 }
                 const principal = gatedPrincipal(req, deps.config);
-                if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+                if (!explicitOperatorOk(principal, deps.config)) {
                     sendError(res, 403, "auth.operator_only", "wiring diagnostics are operator-only on a multi-tenant worker");
                     return;
                 }