@sema-agent/server 7.132.0 → 7.134.0

package/dist/http/run-declared-families.d.ts

@@ -0,0 +1,16 @@
+/**
+ * 一条 run 的**持久化声明**读口(H5):它声明了哪些审批开卡帧族(`settings.approvalFrameFamilies`)。
+ *
+ * 声明随受理过的提交体落盘 —— 提交腿(`POST /v1/tasks` 两腿 / `POST /v1/runs` / A2A)在 run 认领之后把整份提交体写进续跑输入(`checkpoint_ctx`,会话键,
+ * `http/submit-ctx.ts` 的 `persistSubmitCtx`),所以**事后**才发生的读(耐久事件流的开流 preamble)读得到「这条 run 当初声明了什么」。读法只有一个:
+ * `declaredApprovalFrameFamilies`(S-1914 的唯一读者;缺席 / 形坏 ⇒ 空集),本模块不另判声明的合法性。
+ *
+ * 失效方向是**不重放**:续跑输入不在 / 体读不出 ⇒ 空集 ⇒ preamble 零帧(与「未声明」同形;空集 = 这条腿没有活审批通道)。店与会话 id 由类型保证在场:
+ * 唯一的调用方(`routes/runs.ts` 事件流 preamble)只在上场门为真时读 —— 上场门的 park 设施项就是「checkpoint 店在场」,run 行的会话 id 是必填串。
+ * 体读不出(店的拒绝契约)时报一次 `onUnreadable(where)`,让「为什么这条 run 的卡没被重放」在运维日志里有迹可循;店抖动 / 连接错按读口的刻意保守折成「不在」(`readResumeCtx` 头注)。
+ * 读的是 `KEEP_SEALED` 形:`approvalFrameFamilies` 不是凭据位,不为一个声明位开封任何凭据。
+ */
+import type { ApprovalFrameFamily } from "../tool-approval.js";
+import type { CheckpointStoreFull } from "../plugins/store-backend.js";
+export declare function readRunDeclaredFamilies(cs: Pick<CheckpointStoreFull, "getCtx">, sessionId: string, onUnreadable?: (where: string) => void): Promise<ReadonlySet<ApprovalFrameFamily>>;
+//# sourceMappingURL=run-declared-families.d.ts.map

package/dist/http/run-declared-families.js

@@ -0,0 +1,12 @@
+import { declaredApprovalFrameFamilies } from "../tool-approval.js";
+import { KEEP_SEALED, readResumeCtx } from "./resume-ctx-read.js";
+export async function readRunDeclaredFamilies(cs, sessionId, onUnreadable) {
+    const read = await readResumeCtx(cs.getCtx(sessionId), KEEP_SEALED);
+    if (read.kind === "corrupt")
+        onUnreadable?.(read.where);
+    if (read.kind !== "ok")
+        return new Set();
+    const body = read.ctx.body;
+    return declaredApprovalFrameFamilies(typeof body === "object" && body !== null ? Reflect.get(body, "settings") : undefined);
+}
+//# sourceMappingURL=run-declared-families.js.map

package/dist/http/send.d.ts

@@ -7,9 +7,10 @@
  * no longer exists, so quoting its line numbers here would point at nothing). `server.ts`
  * now imports them from here, so all ~500 existing `sendJson(...)` call sites are unchanged text.
  */
-import type { ServerResponse } from "node:http";
+import type { IncomingMessage, ServerResponse } from "node:http";
 import { type SessionErrorFace } from "../session-error-wire.js";
-import type { HttpError } from "../security.js";
+import type { Logger } from "../observability/logger.js";
+import { type HttpError } from "../security.js";
 import { type Refusal, type RefusalBody } from "./refusal-body.js";
 /**
  * [ref](黑板 [ref]②)—— 一条响应「是 SSE 流」的**在场标记**。
@@ -72,6 +73,20 @@ export declare function sendJson(res: ServerResponse, status: number, body: unkn
  *  where `error`/`errorCode` aren't cleanly separable from the rest of the body, are left on raw
  *  `sendJson` (see the A6 migration notes for the callers still doing that on purpose). */
 export declare function sendError(res: ServerResponse, status: number, errorCode: string, message: string, extra?: Readonly<Record<string, unknown>>): void;
+/** `request.invalid_json` 的机读 `reason`(闭集两词):`not_json` = 体不是合法 JSON;`not_object` = 是合法 JSON,但这一口要的是对象。 */
+export declare const INVALID_JSON_REASONS: readonly ["not_json", "not_object"];
+export type InvalidJsonReason = (typeof INVALID_JSON_REASONS)[number];
+/** 每个 `reason` 的句子(wire 文案,冻结在 `test/api-error-text-freeze.test.ts` 的常量锚格;句子由 `reason` 定,调用点不另写一句)。 */
+export declare const INVALID_JSON_MESSAGES: {
+    readonly not_json: "invalid JSON body";
+    readonly not_object: "body must be a JSON object when present";
+};
+/**
+ * 请求体不是这一口要的 JSON ⇒ 400 `request.invalid_json` + `reason`。**全仓唯一铸这个码的地方**:请求体读取器(`request-guards.ts` 的 `readJson`,体不是合法 JSON)与要求对象体的口
+ * (体是合法 JSON、却不是对象)都经它抛 / 渲;路由域不再各自在本地 catch 里自铸同一个码(那些回落臂在读取器抛无码 `HttpError` 的年月里恒不可达,
+ * 且裸 catch 会把读取器的 413 一并折成「JSON 非法」)。
+ */
+export declare function invalidJsonError(reason: InvalidJsonReason): HttpError;
 /** B7([ref] lens1 §C3):`HttpError` 的兜底 catch-all 站点没有自己的语义分支——`err.code` 在 42 个
  *  throw 点里只有 3 个带。为了让「errorCode 恒在」在这些站点也成立(而不是靠豁免表放行),按**状态码**
  *  给一个诚实的粗码:它只声明「这类拒绝」,不冒充比 throw 点更细的语义。带 `code` 的 throw 点原样优先。 */
@@ -102,11 +117,17 @@ export declare function sendSessionPolicyError(res: ServerResponse, e: unknown,
  * 回 `true` = 已应答,调用点 `return`;`false` = 不是 `SessionError`,或这个词在这一面上是登记过的留白(站点的既有
  * 处置照旧 —— 通常是继续上抛到全局兜底)。
  *
- * 句子:属主给了固定句就发它(import 面 `invalid_session` 那一句),否则发 core 的原句过既有脱敏(`redactErrorMessage`:
+ * 句子:属主给了固定句就发它(import 面 `invalid_session` / `placement_refused` 两句),否则发 core 的原句过既有脱敏(`redactErrorMessage`:
  * 不抛、有上限)。core 的 `corrupt_session` 原句只点名会话 id 与跳过计数(「Session <id> is unreadable: its log has no
  * meta header (N of M records skipped as corrupt)」),SQL 两店的原句点名 `<表>.<列>` 与行号 —— 两者都不含盘上路径
  * (路径只进运维面:`server.session-repo.corrupt-record-skipped` 的探针行,S-990;SQL 两店走各自的拒绝句)。
  */
 export declare function sendSessionError(res: ServerResponse, e: unknown, face: SessionErrorFace): boolean;
 export declare function msg(e: unknown): string;
+/**
+ * 路由抛出的未归类错误的运维行 `request_error` —— **唯一写者**。外层兜底(`server.ts`)与「就地经映射下发」的站点(会话同步的暂存提交 catch)同调它:
+ * 后者在兜底之前就把错误换成了有名字的应答,不经这一行的话,被映射接走的错误(如提交门抛的 `corrupt_session`,句子点名表列与行号)会从服务端日志里消失。
+ * codex r10 [high] 纵深:错误句可带凭据回显 ⇒ 先过 `redactHead`(有上限、不抛)。
+ */
+export declare function logRequestError(logger: Logger | undefined, req: IncomingMessage, err: unknown): void;
 //# sourceMappingURL=send.d.ts.map

package/dist/http/send.js

@@ -1,7 +1,8 @@
 import { SessionError, SessionPolicyError } from "@sema-agent/core";
 import { sessionPolicyErrorFacts, sessionPolicyErrorHttp, sessionPolicyErrorSentence } from "../session-policy-wire.js";
 import { sessionErrorHttp } from "../session-error-wire.js";
-import { redactErrorMessage } from "../observability/run-terminal.js";
+import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
+import { createCodedHttpError } from "../security.js";
 import { refusalBody } from "./refusal-body.js";
 export const SSE_RESPONSE_MARK = Symbol("sema.http.sse-response");
 export function isSseResponse(res) {
@@ -34,6 +35,14 @@ export function sendJson(res, status, body) {
 export function sendError(res, status, errorCode, message, extra) {
     sendJson(res, status, refusalBody(extra === undefined ? { errorCode, message } : { errorCode, message, facts: extra }));
 }
+export const INVALID_JSON_REASONS = ["not_json", "not_object"];
+export const INVALID_JSON_MESSAGES = {
+    not_json: "invalid JSON body",
+    not_object: "body must be a JSON object when present",
+};
+export function invalidJsonError(reason) {
+    return createCodedHttpError(400, "request.invalid_json", INVALID_JSON_MESSAGES[reason], { reason });
+}
 export function httpErrorCode(status, code) {
     if (code)
         return code;
@@ -73,10 +82,13 @@ export function sendSessionError(res, e, face) {
     const wire = sessionErrorHttp(e.code, face);
     if (wire === undefined)
         return false;
-    sendError(res, wire.status, wire.errorCode, wire.sentence ?? redactErrorMessage(e.message) ?? "session store error");
+    sendError(res, wire.status, wire.errorCode, wire.sentence ?? redactErrorMessage(e.message) ?? "session store error", wire.detail === undefined ? undefined : { detail: wire.detail });
     return true;
 }
 export function msg(e) {
     return e instanceof Error ? e.message : String(e);
 }
+export function logRequestError(logger, req, err) {
+    logger?.error("request_error", { method: req.method, url: req.url, err: redactHead(msg(err), 2000) });
+}
 //# sourceMappingURL=send.js.map

package/dist/http/server.d.ts

@@ -10,7 +10,6 @@ import type { RunStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchor
 import type { RuleConsentLane } from "../rules-consent.js";
 import { type MemorySyncRequest, type MemorySyncResponse } from "../memory-sync.js";
 import type { TaskAttachmentStore } from "../plugins/task-attachment-store.js";
-import type { SqlBlobCapReading } from "../plugins/blob-backend.js";
 import type { LeaderEndpoint } from "../leader/endpoint.js";
 import { type WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
 import type { SubagentSteerRegistry } from "../orchestration/subagent-steer.js";
@@ -38,8 +37,8 @@ import { MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHA
 import { routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath } from "./route-table.js";
 export { routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, hasServiceAuth };
 export { MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills };
-import { explicitOperatorOk, isOperator, hasServiceAuth } from "./principal-gate.js";
-export { explicitOperatorOk, isOperator };
+import { explicitOperatorOk, hasServiceAuth } from "./principal-gate.js";
+export { explicitOperatorOk };
 /** Per-request authorization context resolved before building the spec (identity, owned session). */
 export interface RequestAuth {
     principal?: string;
@@ -154,6 +153,12 @@ export interface ServiceStoreDeps {
     /** Durable-checkpoint store ([ref], core 1.67): durable F4 suspend/resume. When present, the resume
      *  endpoint + suspended-run surfacing are active. Set only when DURABLE_APPROVAL + a TiDB pool. */
     checkpointStore?: CheckpointStoreFull;
+    /** S-1907:停驻行凭据的**封签器**(`sealed-key.ts` `ensureCheckpointCtxSealing`,这一域自己的保管店 `<数据根>/sealed-key/checkpoint-ctx-keys/`;规则属主 = `checkpoint-ctx.ts` 末段
+     *  「凭据位密封」)。提交体里请求面凭据位上的值在 `checkpoint_ctx` 里只以封签存在:写 ctx 的每一笔经它封、续跑上下文读口经它开。
+     *  🔴 **与 `checkpointStore` 同在**:店在而它缺席 ⇒ `createHttpServer` 拒启(句子 = `CHECKPOINT_CTX_SEALING_REQUIRED`)—— 凭据只以封签落盘,
+     *  封不了就不落,没有「明文照写」的第二种装配。嵌入方:`checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir)`
+     *  (保管目录要跨重启持久、多副本各副本是同一份钥匙,否则封它的那把钥匙不在 ⇒ 409 `conflict.checkpoint_ctx_unsealable` `reason:"key_not_held"`)。 */
+    checkpointCtxSealing?: import("./checkpoint-ctx.js").CheckpointCtxSealing;
     /** E6 durable SessionPolicyStore (operator-tightened per-session tool rules). Enables PUT/GET /v1/sessions/:id/policy
      *  when present; core reads the rules at prepare-time (subtract-only) via RunnerDeps.sessionPolicyStore (wired separately). */
     sessionPolicyStore?: ServiceSessionPolicyStore;
@@ -209,6 +214,10 @@ export interface ServiceStoreDeps {
      *  (boot/workflow-orchestration.ts);任一缺席 = 那条车道不存在(workflow 出身的 park 落 legacy 腿,
      *  与本批之前逐字同形)。契约与单写者纪律的属主 = orchestration/workflow-agent-session-index.ts。 */
     workflowAgentSessionIndex?: import("../orchestration/workflow-agent-session-index.js").WorkflowAgentSessionIndex;
+    /** workflow 子代停驻卡的耐久决定行(一张卡一行,键 = 子代 checkpoint 的 token):写者 = `/decide` 的 workflow 车道,读者 = 每一只起跑器开跑前的那一只读者。
+     *  必须绑在 `runStore` 这一只上(与它同出一个 store backend:`run()` / `workflowParkDecisions()`);park 索引与 run 店都在时必填 ——
+     *  起服判官 `parkDecisionStoreRefusal` 判。契约与律的属主 = orchestration/workflow-park-decision.ts。 */
+    workflowParkDecisions?: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore;
     /** [ref] journal 读面(PAIR-REVIEW 修车批):GET /v1/workflows/:runId/journal 的数据源——与 runner 侧
      *  workflowJournalStore 同一实例(main.ts backend.workflowJournal());缺席=501(与 workflowRunStore 同门)。 */
     workflowJournalStore?: import("@sema-agent/core").WorkflowJournalStore;
@@ -315,9 +324,7 @@ export interface ServiceCoordinatorDeps {
      *  LEADER_ENABLED + the leader wiring (e2b workers + git push) is configured. */
     leaderEndpoint?: LeaderEndpoint;
     /** Fire-and-forget session auto-titler (first-submit hook; absent = feature dark). */
-    sessionTitler?: {
-        maybeTitle(sessionId: string, objective: string, model?: string): void;
-    };
+    sessionTitler?: import("../session-titler.js").SessionTitler;
 }
 /** **函数/构件缝**:main.ts 把跨多个子系统的动作编译成一个可调用面交给路由(路由不该自己
  *  重组零件——见 backend 的同款论证)。parked-revive 三件是同族的构件缝(boot 期从生产装配取的裸
@@ -567,6 +574,10 @@ export interface ServiceSeamDeps {
      *  🔴 缺席 ⇒ `/v1/shared-memory/*` 整域不挂载(诚实缺席);挂载还另要 {@link orgMemoryDirectory}
      *  在场 —— 没有成员性判据的读面只能全放或全拒,两个都比「这个面不存在」差。 */
     sharedMemoryStore?: import("@sema-agent/core").SharedMemoryStoreProvider;
+    /** [ref] §10.2 —— 跨主体投递门(`createOrgDeliveryGate` 的产物,`boot/stage-06-runners.ts` 装配的唯一实例)。
+     *  `POST /v1/principal-inbox/messages` 只经它投递;缺席 = 本部署没声明收件箱消费方(`PRINCIPAL_INBOX_ASSISTANT` 未设)⇒
+     *  那一口 501、能力位 `principalInboxDelivery` false(同读事实 `principalInboxDelivery`)。 */
+    orgDeliveryGate?: import("@sema-agent/core").OrgDeliveryGate;
     /** WEB-SETUP-RECON 附B — org sessionMirror 治理态的 SERVICE 半场 = **观测面(audit),非执法面**。
      *  裁定 (c):「该镜像而未镜像」发生在数据产生端(壳)——本 server 是镜像**目标**,只看得见到达的 push;
      *  没到达的会话对 server 不存在(无客户端会话清单、无心跳契约),required 锁的真执法只能在壳(CC
@@ -726,6 +737,9 @@ export interface ServiceDeploymentDeps {
      *  `buildCenterCredentialHealthView` 铸形,只有闭集词 / 时刻 / 计数,不带路径与令牌)。缺席 / 返回 undefined = 健康或没有中心
      *  ⇒ `/health` 形状逐字不变(additive)。 */
     centerCredentialState?: () => import("../center-credential-renewer.js").CenterCredentialHealthView | undefined;
+    /** S-667:`/health.centerIdentityNotice` —— 中心凭证换人后的**最近一条**两态通告(`center-config-tier.ts` 铸:`{ code, message, at }`,码闭集两词、句冻结)。取值口交出的
+     *  就是 wire 形,`/health` 不另投影;无鉴权面,只有码 / 冻结句 / 时刻。缺席 / 返回 undefined = 从未换过人或没有中心 ⇒ `/health` 形状逐字不变(additive)。 */
+    centerIdentityNoticeState?: () => import("../center-config-tier.js").CenterIdentityNotice | undefined;
     /** S-768:模型拒因信号(`/health.modelRefusals`,settings-schema 6.2.0 `ModelRefusalsSignal` 形:名 → 码 + 组拒码)。fleet 心跳读**这同一只**
      *  (`boot/stage-10-http-server.ts` → `modelRefusals: () => deployment.modelRefusalsState?.()`)—— 一处铸、两出口。缺席 / 返回 undefined =
      *  没有可报的拒或没有配置管道 ⇒ `/health` 形状逐字不变(additive)。 */
@@ -780,8 +794,8 @@ export interface ServiceDeploymentDeps {
     /** S-131:SQL **引擎读口**(`sql-engine-posture.ts` 的单一推导点 —— boot 期借一条池连接触发驱动的连接初始化,交回本池的驱动:
      *  `dialect`(SQL 文本轴,恒在)+ 活的 `facts`(`SET` 之后**回读复核**过的真值;池重连后驱动会重新初始化并刷新,快照会说谎)。
      *  读者:`GET /v1/diagnostics/wiring` 的 `sqlEngine` 段(operator-only,全量含版本与两堵墙)与 `GET /v1/capabilities` 的 `store.sql` 位(窄投影;
-     *  7.106.0 前是顶层 `sql`,S-866 ①)读 `facts`;提交受理口的 413 把整只读口交给唯一判官 `sql-driver.ts` `sqlWallsOf`(本服务的装配另用同一只读口铸
-     *  `snapshotBlobSqlCap`,`PUT /sync/blobs` 的前置帽)—— 墙的方言只从这里来(与事实同出一只驱动),不另从店后端读。
+     *  7.106.0 前是顶层 `sql`,S-866 ①)读 `facts`;提交受理口的 413 把整只读口交给唯一判官 `sql-driver.ts` `sqlWallsOf`(墙的方言只从这里来(与事实同出一只驱动),不另从店后端读);其中包墙是连接级事实 ——
+     *  这里的包墙是最近一次初始化的那条连接的读数,受理口那一腿是同一只规则的提前一跑,终判在将要执行写入的那条连接上(`sql-driver.ts` `connectJudged`;SQL 快照 blob 的店判与 `PUT /sync/blobs` 的 413 来自它)。
      *  两种缺席、两个值:**席缺席** = 本部署没有 SQL 后端(env-only worker、local 文件后端);**`facts` 是 `null`** = 有 SQL 后端、但事实此刻没建立
      *  (池上最近一次连接初始化被拒,驱动当场作废了事实)。两者在两个读面上都报缺席(诚实缺席,不铸空壳);墙按方言读后者(MySQL 协议 ⇒ 最保守的假定墙)。
      *  7.132.0 前这一席是 `sqlEngineFacts: () => SqlEngineFacts | null`(只给事实、不给方言);照旧传它 ⇒ `createHttpServer` 起服拒。
@@ -826,15 +840,6 @@ export interface ServiceDeploymentDeps {
 }
 /** **数值旋钮**:部署可调的上限/拍距。缺省值写在消费点(`?? 256` 之类),此处只承载覆写。 */
 export interface ServiceKnobDeps {
-    /** (a)(clay 拍 a+c,2026-07-27)当快照 blob 走 SQL 默认店时(逃生口形/覆写形),该店的 per-blob
-     *  承载帽的**读口**——PUT /sync/blobs 面每个请求调一次、据此**前置 413**(typed `blob_too_large_for_sql`)。
-     *  键缺席=不前置(MinIO 形无帽);读口答 `undefined`=此刻没有墙(pg 形)=不前置。读口而非数字:帽由库报的墙推导,
-     *  库调墙、池连接换代后活事实会变,门限必须跟着变(与店写口 `SqlBlobBackend` 读同一份池级事实、同一只函数
-     *  `sqlBlobCapOf`)。读口答的是**帽 + 它的出处**(`{ capBytes, source }`,`source` ∈ `operator` / `reported` / `assumed`,见 `SqlBlobCapReading`):
-     *  413 的句子与机读位 `wallSource` 按出处分三形(运维旋钮 / 库报的墙 / 假定的墙),不把假定或运维的旋钮说成库的上限。
-     *  为什么在 HTTP 面重复店里的检查:店的 never-throw 结果形把一切写失败折成 502,而 502
-     *  语义=可重试,对端会对一个永远过不去的 blob 无限重试——413 才是「别再送了」的诚实形。 */
-    snapshotBlobSqlCap?: () => SqlBlobCapReading | undefined;
     /** [ref] SSE 连接帽(缺省 256/副本;超限 503+Retry-After=消费方回落 /head 轮询)。 */
     sessionEventsMaxConnections?: number;
     /** [ref] SSE 心跳/owner 复核拍距 ms(缺省 25s;测试注入用)。 */
@@ -862,7 +867,7 @@ export declare function flattenServiceDeps(deps: ServiceDeps): FlatServiceDeps;
 /** The TRUSTED end-user principal for an owner-gated / per-tenant request. On a direct-door worker the
  *  trusted-header path is OFF (x-agent-principal is client-self-asserted), so identity comes from the crypto-VERIFIED
  *  principal JWT (`x-approval-principal-token`, principal-only proof — no cnf.bnd action binding); otherwise the
- *  BFF-minted trusted header. undefined when absent/invalid (fail-closed → callers map to 401 / scope "__none__").
+ *  BFF-minted trusted header. undefined when absent/invalid (fail-closed → callers map to 401, or to the anonymous scope `"_"` on the approval queue faces).
  *  🔴 Use this for ANY endpoint that reads or gates PER-TENANT data — NOT `principalFrom` directly, which trusts
  *  the self-asserted header on a direct door (/v1/usage + the trace owner-gate
  *  had drifted to a bare principalFrom, unlike the leader/images/approvals identity paths). One source of truth

package/dist/http/server.js

@@ -1,6 +1,5 @@
 import http from "node:http";
 import { outwardPlane } from "../terminal.js";
-import { redactHead } from "../observability/run-terminal.js";
 import { validatePendingSteer } from "@sema-agent/core";
 import {} from "../web-admin-client/facade.js";
 import { describeValueShape } from "@sema-agent/settings-schema";
@@ -18,9 +17,12 @@ import { cascadeConfig } from "./run-meta.js";
 export { cascadeConfig };
 import { coarseStatusForState, errorCodeForExit } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
-import { sendError, sendHttpError, sendSessionError, msg } from "./send.js";
+import { sendError, sendHttpError, sendSessionError, logRequestError } from "./send.js";
 import { createRequestGuards } from "./request-guards.js";
 import { sqlEngineSeatIssue } from "../sql-engine-posture.js";
+import { parkDecisionStoreRefusal } from "../orchestration/workflow-park-decision.js";
+import { CHECKPOINT_CTX_SEALING_REQUIRED } from "./checkpoint-ctx.js";
+import { retiredServiceDepsRefusal } from "./retired-service-deps.js";
 import { createAdmission, MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills } from "./admission.js";
 import { createResumeLegs } from "./resume-legs.js";
 import * as facts from "../capability-facts.js";
@@ -29,8 +31,8 @@ import { routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDis
 import { createApprovalSweeps } from "./approval-sweeps.js";
 export { routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, hasServiceAuth };
 export { MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills };
-import { explicitOperatorOk, isOperator, hasServiceAuth } from "./principal-gate.js";
-export { explicitOperatorOk, isOperator };
+import { explicitOperatorOk, hasServiceAuth } from "./principal-gate.js";
+export { explicitOperatorOk };
 class DrainYieldingPreemptBook extends Map {
     drainingNow;
     constructor(drainingNow) {
@@ -59,14 +61,10 @@ export function createHttpServer(rawDeps) {
     if (typeof deps.runnerFor !== "function") {
         throw new Error("createHttpServer: the runnerFor seat is required (it picks each task's Runner from its execution lane) — pass the hands-lane selector, or `runnerFor: () => runner` for a single-Runner embedding; refusing to start rather than run every task on the widest Runner");
     }
-    if (deps.snapshotBlobSqlCapBytes !== undefined) {
-        throw new Error("createHttpServer: snapshotBlobSqlCapBytes was replaced by snapshotBlobSqlCap in 7.132.0 — pass a reader `() => { capBytes, source } | undefined` (called on every PUT /v1/sessions/:id/sync/blobs/:hash; `source` is \"operator\" for a cap you set yourself, \"reported\" / \"assumed\" for one derived from the database's walls; `undefined` = no cap) — for a fixed cap: `() => ({ capBytes: <bytes>, source: \"operator\" })`; refusing to start rather than run without the blob cap");
-    }
-    if (deps.snapshotBlobSqlCap !== undefined && typeof deps.snapshotBlobSqlCap !== "function") {
-        throw new Error(`createHttpServer: snapshotBlobSqlCap must be a reader \`() => { capBytes, source } | undefined\` (called on every PUT /v1/sessions/:id/sync/blobs/:hash), got ${typeof deps.snapshotBlobSqlCap} — pass the reader (or \`() => undefined\` for no cap), or leave it unset; refusing to start rather than answer every blob upload with a 500`);
-    }
-    if (deps.sqlEngineFacts !== undefined) {
-        throw new Error("createHttpServer: sqlEngineFacts was replaced by sqlEngine in 7.132.0 — pass the SQL pool's engine reading as sqlEngine: `{ dialect: \"tidb\" | \"pg\", facts }` where `facts` is read live (a getter) and is null while the pool's connection setup has not succeeded, or leave both unset when there is no SQL store; refusing to start rather than run the submit admission without the database's walls");
+    {
+        const retired = retiredServiceDepsRefusal(deps);
+        if (retired !== undefined)
+            throw new Error(retired);
     }
     {
         const issue = sqlEngineSeatIssue(deps.backend, deps.sqlEngine);
@@ -83,6 +81,13 @@ export function createHttpServer(rawDeps) {
             }
         }
     }
+    {
+        const refusal = parkDecisionStoreRefusal(deps);
+        if (refusal !== undefined)
+            throw new Error(`createHttpServer: ${refusal}`);
+    }
+    if (deps.checkpointStore !== undefined && deps.checkpointCtxSealing === undefined)
+        throw new Error(`createHttpServer: ${CHECKPOINT_CTX_SEALING_REQUIRED}`);
     const idemCache = new IdempotencyCache();
     const inflightRuns = new Map();
     const preemptableRuns = new DrainYieldingPreemptBook(() => deps.drainState?.draining === true);
@@ -138,9 +143,9 @@ export function createHttpServer(rawDeps) {
             }
         };
     }
-    const { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, isFleetWide, sessionOwnerScope, sessionOwnerScopeForWrite, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, readJson, readRawBody } = createRequestGuards({ deps });
+    const { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, readJson, readRawBody } = createRequestGuards({ deps });
     const { prepareSpec } = createAdmission({ deps, readJson, runnerFor });
-    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
+    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
     const { denyExpiredApprovals, redeemParkedAsk } = createApprovalSweeps({ deps, resumeCheckpoint, mayDiscloseRowError });
     const { handle } = createDispatch({ deps, noteActivity, routeCtxBase, counters });
     const server = http.createServer((req, res) => {
@@ -152,7 +157,7 @@ export function createHttpServer(rawDeps) {
                     res.end();
                 return;
             }
-            deps.logger?.error("request_error", { method: req.method, url: req.url, err: redactHead(msg(err), 2000) });
+            logRequestError(deps.logger, req, err);
             if (res.headersSent) {
                 res.end();
                 return;

package/dist/http/stored-body-replay.js

@@ -1,8 +1,9 @@
-import { REQUEST_SETTINGS_REFUSAL_PREFIX, rulePolicyBucketsRefusal, settingsPermissionBucketIssue, storedBodyPermissionMode } from "../task-settings.js";
+import { REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_RULE_REFUSAL_CODE, neverAutoNamesRefusal, rulePolicyBucketsRefusal, settingsPermissionBucketIssue, storedBodyPermissionMode } from "../task-settings.js";
+import { readTightenOnlySeats, tightenOnlySeatField, tightenOnlySeatIssue } from "../tighten-only-seats.js";
+import { entryProblemsFacts } from "../entry-problems.js";
 import { autonomyModeFloor, entryPermissionMode } from "../runtime-governance.js";
 import { inertToolListEntryOf, replayInertEntry } from "../rule-entry-list.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
-import { httpErrorCode } from "./send.js";
 import { allowListReadingEraOf, allowListReadingUnstated, permissionModeReadingStated } from "./checkpoint-ctx.js";
 export function permissionModeReadingUnstated(ctx, floor) {
     if (floor === undefined || permissionModeReadingStated(ctx))
@@ -21,19 +22,31 @@ function storedPermissionBucketRefusal(body) {
         return undefined;
     return replayInertEntry(issue.fields.field, issue.fields.field === "settings.permissions.allow" ? "allow" : "deny", BUCKET_GATE_CODE, issue.message, { ...issue.fields });
 }
+function storedTightenOnlySeatRefusal(body) {
+    const issue = tightenOnlySeatIssue(body?.settings);
+    if (issue === null)
+        return undefined;
+    return replayInertEntry(tightenOnlySeatField(issue.seat), "deny", BUCKET_GATE_CODE, issue.message, { ...issue.fields });
+}
 function storedRulePolicyRefusal(body, deployment) {
     const permissions = storedPermissions(body);
     if (permissions === undefined)
         return undefined;
     const home = executionLaneHomeDir(deployment);
     const refused = rulePolicyBucketsRefusal({ ...(Array.isArray(permissions["ask"]) ? { ask: permissions["ask"] } : {}), ...(Array.isArray(permissions["deny"]) ? { deny: permissions["deny"] } : {}) }, home !== undefined ? { home } : {});
-    return refused === undefined ? undefined : replayInertEntry(`settings.permissions.${refused.bucket}`, "deny", httpErrorCode(422), `${REQUEST_SETTINGS_REFUSAL_PREFIX}${refused.message}`);
+    if (refused !== undefined)
+        return replayInertEntry(`settings.permissions.${refused.bucket}`, "deny", SETTINGS_RULE_REFUSAL_CODE, `${REQUEST_SETTINGS_REFUSAL_PREFIX}${refused.message}`, { ...entryProblemsFacts(refused.problems) });
+    const neverAuto = readTightenOnlySeats({ permissions }).values.neverAuto;
+    if (neverAuto === undefined)
+        return undefined;
+    const neverAutoRefused = neverAutoNamesRefusal(neverAuto);
+    return neverAutoRefused === undefined ? undefined : replayInertEntry(tightenOnlySeatField("neverAuto"), "deny", SETTINGS_RULE_REFUSAL_CODE, `${REQUEST_SETTINGS_REFUSAL_PREFIX}${neverAutoRefused.message}`, { ...entryProblemsFacts(neverAutoRefused.problems) });
 }
 export function storedBodyReplayRefusal(ctx, deployment) {
     const writer = ctx.writerVersion !== undefined ? { writerVersion: ctx.writerVersion } : {};
     if (allowListReadingUnstated(ctx))
         return { kind: "allow_list_reading", era: allowListReadingEraOf(ctx), ...writer };
-    const entry = storedPermissionBucketRefusal(ctx.body) ?? inertToolListEntryOf(ctx.body, ["deny"]) ?? storedRulePolicyRefusal(ctx.body, deployment);
+    const entry = storedPermissionBucketRefusal(ctx.body) ?? storedTightenOnlySeatRefusal(ctx.body) ?? inertToolListEntryOf(ctx.body, ["deny"]) ?? storedRulePolicyRefusal(ctx.body, deployment);
     if (entry !== undefined)
         return { kind: "inert_tool_list", entry };
     const mode = permissionModeReadingUnstated(ctx, autonomyModeFloor(deployment.autonomy));

package/dist/http/submit-ctx.d.ts

@@ -1,11 +1,11 @@
 import type { RunStore } from "../plugins/store-backend.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
-import { buildCheckpointCtx } from "./checkpoint-ctx.js";
+import { buildCheckpointCtx, type CheckpointCtxSealer, type SealedCheckpointCtx } from "./checkpoint-ctx.js";
 import { type RefusalBody } from "./refusal-body.js";
 /** 写不进的那一种可答复的结局(各腿把它交回自己的出口:同步 / durable 腿直接回,活流腿编码成终帧)。 */
 export interface SubmitCtxRefusal {
-    readonly status: 413;
+    readonly status: 413 | 409;
     readonly body: RefusalBody;
 }
 /**
@@ -14,10 +14,11 @@ export interface SubmitCtxRefusal {
  * 返回 `undefined` = 写进了,腿照常起跑。
  */
 export declare function persistSubmitCtx(store: {
-    putCtx(sessionId: string, ctx: object): Promise<void>;
+    putCtx(sessionId: string, ctx: SealedCheckpointCtx): Promise<void>;
 }, deps: {
     readonly logger?: Logger | undefined;
     readonly metrics?: Metrics | undefined;
+    readonly checkpointCtxSealing?: CheckpointCtxSealer | undefined;
 }, claim: {
     readonly runStore: RunStore;
     readonly taskId: string;

package/dist/http/submit-ctx.js

@@ -1,15 +1,26 @@
 import { StoreRowTooLargeError } from "../plugins/sql-errors.js";
 import { releaseClaimedRun } from "./claimed-run.js";
-import { buildCheckpointCtx } from "./checkpoint-ctx.js";
+import { buildCheckpointCtx, CheckpointCtxUnsealableError } from "./checkpoint-ctx.js";
 import { refusalBody } from "./refusal-body.js";
+import { limitFactsUnmeasured } from "../limit-refusal.js";
+function unsealableRefusal(e) {
+    return {
+        status: 409,
+        body: refusalBody({
+            errorCode: "conflict.checkpoint_ctx_unsealable",
+            message: "this deployment cannot store this task's credentials (MCP / A2A headers or env values, settings.env, settings.webSearch.apiKey, or http hook headers) for resuming it: they are kept only sealed, and this server has no sealed-key store — nothing was run; ask whoever operates this deployment to give the service a writable sealed-key directory (<data root>/sealed-key/), or submit the task without those credentials",
+            facts: { field: e.field, reason: e.reason },
+        }),
+    };
+}
 function rowTooLargeRefusal(tooLarge) {
     switch (tooLarge.wall) {
         case "row":
-            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database keeps in one row (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's single-row limit (TiDB performance.txn-entry-size-limit)` }) };
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database keeps in one row (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's single-row limit (TiDB performance.txn-entry-size-limit)`, facts: limitFactsUnmeasured("body", "bytes") }) };
         case "statement":
-            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database accepts in one statement (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's max_allowed_packet` }) };
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database accepts in one statement (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's max_allowed_packet`, facts: limitFactsUnmeasured("body", "bytes") }) };
         case "value":
-            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than PostgreSQL holds in one value (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments` }) };
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than PostgreSQL holds in one value (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments`, facts: limitFactsUnmeasured("body", "bytes") }) };
         default: {
             const unhandled = tooLarge.wall;
             throw new Error(`row-too-large refusal without an HTTP answer: ${String(unhandled)}`);
@@ -18,18 +29,24 @@ function rowTooLargeRefusal(tooLarge) {
 }
 export async function persistSubmitCtx(store, deps, claim, sessionId, fields) {
     try {
-        await store.putCtx(sessionId, buildCheckpointCtx(fields));
+        await store.putCtx(sessionId, buildCheckpointCtx(fields, deps.checkpointCtxSealing, sessionId));
         return undefined;
     }
     catch (err) {
         const tooLarge = err instanceof StoreRowTooLargeError ? err : undefined;
+        const unsealable = err instanceof CheckpointCtxUnsealableError ? err : undefined;
+        const known = tooLarge ?? unsealable;
         if (claim !== undefined) {
-            const why = tooLarge !== undefined ? tooLarge.message : `the run's resume inputs could not be stored: ${err instanceof Error ? err.message : String(err)}`;
+            const why = known !== undefined ? known.message : `the run's resume inputs could not be stored: ${err instanceof Error ? err.message : String(err)}`;
             await releaseClaimedRun(claim.runStore, claim.taskId, why, (releaseErr, step) => {
                 deps.logger?.warn("submit_ctx_run_release_failed", { taskId: claim.taskId, sessionId, step, err: releaseErr instanceof Error ? releaseErr.message : String(releaseErr) });
                 deps.metrics?.inc("submit_ctx_run_release_failed_total", { step });
             });
         }
+        if (unsealable !== undefined) {
+            deps.logger?.warn("submit_ctx_unsealable", { sessionId, taskId: claim?.taskId, field: unsealable.field, reason: unsealable.reason });
+            return unsealableRefusal(unsealable);
+        }
         if (tooLarge === undefined)
             throw err;
         deps.logger?.warn("submit_ctx_row_too_large", { sessionId, taskId: claim?.taskId, wall: tooLarge.wall, db: tooLarge.dbMessage });

package/dist/http/submit-replay.d.ts

@@ -9,7 +9,7 @@
  *
  * ## 判定(三条,按序;别的一律不放)
  *  · 这次提交自带 taskId 而命中的行**不是**那一条(`Idempotency-Key` 指向别的行)⇒ 冲突;
- *  · 调用方读不到这一行(属主门 = `runOwnerReadable`,「这个调用方读得到这一行 run 吗」的唯一谓词)⇒ 冲突;
+ *  · 调用方读不到这一行(属主门 = `runOwnerReadable`,「这个调用方读得到这一行 run 吗」的唯一谓词,经属主存取器 `owner-access.ts` 读)⇒ 冲突;
  *    冲突 ⇒ `409 conflict.run_exists`,体里**不回显**那条行的任何标识(不给跨租户预言机)。先于下一条判:读不到的行不比体。
  *  · 这次提交带 `Idempotency-Key`(`caller.idem` 在场)、那一行绑的**就是这把键**,而它记着的请求体指纹与这次不同 ⇒
  *    `409 conflict.idempotency_payload_mismatch`(同形 `{ error, errorCode }`,不回显键与那一行);**不**回放首发、不新建、那一行不动。
@@ -26,12 +26,13 @@ import type { RunIdemBinding, RunRecord } from "../plugins/store-contracts.js";
 import type { RunStore } from "../plugins/store-backend.js";
 import type { ServiceConfig } from "../config-types.js";
 import type { SubmitOutcome } from "./idempotency.js";
+import type { Principal } from "../security.js";
 /** 提交腿的回执形(闭集;穷举 `switch`,加一形不写这里 = 编译红)。 */
 export type SubmitReplayFace = "durable" | "sync";
 /** 发起这次提交的一方。 */
 export interface ReplayCaller {
-    /** 已验身份(`gatedPrincipal`)。 */
-    principal: string | undefined;
+    /** 已验身份(`gatedPrincipal` 的回值,`Principal` 品牌)。 */
+    principal: Principal | undefined;
     /** 这次提交自带的 taskId(`body.taskId`;A2A 派生值)。缺席 = 只凭 `Idempotency-Key` 命中。 */
     clientTaskId?: string;
     /** 这次提交的账本绑定(键 + 请求体指纹;`RunIdemBinding`)。`undefined` = 这次提交没带 `Idempotency-Key`(只凭 `body.taskId`)⇒ 不比体。

package/dist/http/submit-replay.js

@@ -1,17 +1,18 @@
-import { runOwnerReadable } from "./principal-gate.js";
+import { runRowReadable } from "./owner-access.js";
 import { readRunFace } from "./run-read-face.js";
+import { refusalBody } from "./refusal-body.js";
 export function isRunExistsConflictBody(body) {
     return typeof body === "object" && body !== null && body.errorCode === "conflict.run_exists";
 }
 export async function replayOfExistingRun(row, caller, face, deps, runStore) {
     const sameRun = caller.clientTaskId === undefined || caller.clientTaskId === row.taskId;
-    if (!sameRun || !runOwnerReadable(caller.principal, row.owner, deps.config)) {
-        return { status: 409, body: { error: "a run already exists for this submission's taskId or Idempotency-Key", errorCode: "conflict.run_exists" } };
+    if (!sameRun || !runRowReadable(deps.config, caller.principal, row.owner, "owner")) {
+        return { status: 409, body: refusalBody({ errorCode: "conflict.run_exists", message: "a run already exists for this submission's taskId or Idempotency-Key" }) };
     }
     if (caller.idem !== undefined) {
         const held = await runStore.bindIdemBodyFingerprint(row.taskId, caller.idem);
         if (held !== null && held !== caller.idem.bodyFingerprint) {
-            return { status: 409, body: { error: "this Idempotency-Key was already used for a different request body — a retry must resend the same body; send a different request with a new Idempotency-Key", errorCode: "conflict.idempotency_payload_mismatch" } };
+            return { status: 409, body: refusalBody({ errorCode: "conflict.idempotency_payload_mismatch", message: "this Idempotency-Key was already used for a different request body — a retry must resend the same body; send a different request with a new Idempotency-Key" }) };
         }
     }
     switch (face) {

package/dist/http/wire-types.d.ts

@@ -10,11 +10,12 @@ import type { A2aServerSpec, AgentDefinition, ApprovalReach, PermissionMode, Ski
 import type { RequestMcpServerSpec } from "../mcp-assertion-header.js";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 import type { buildSyncSubmitBody } from "./sync-submit-body.js";
+import type { EntryProblem } from "../entry-problems.js";
 export interface TaskRequestBody {
     objective: string;
     sessionId?: string;
     /** Which deployment SCENARIO assembles this task's tools/prompt/skills (the keys of the worker's scenario
-     *  table — e.g. "default"/"code"/"code-review"/"scan"). An INTENT bounded by the deployment's own table AND,
+     *  table — e.g. "default"/"code"/"code-review"/"scan"/"cowork"). An INTENT bounded by the deployment's own table AND,
      *  on a governed worker, by the principal's center-resolved allowlist: an unknown name is a typed 400
      *  `scenario_unknown`, a known-but-not-allowed one a typed 400 `scenario_not_allowed`; absent ⇒ the ruling's
      *  assigned scenario, else `DEFAULT_SCENARIO` (consumed at `boot/resolve-spec.ts` via `gateScenarioRequest`). A name
@@ -260,7 +261,7 @@ export interface TaskRequestBody {
     forwardSubagentEvents?: boolean;
     /** G3([ref] 壳侧承诺③/[ref]③):壳供 per-session scratchpad 路径(壳 vendored getScratchpadDir 的
      *  约定路径)。接受后优先于 server 自算,同源喂 envFacts.scratchpadDir 宣告(core 据它开根围栏的洞,
-     *  S-842 起是唯一写者)+ fs-write gate exemptDirs——壳提示词与 server 写门指同一个目录。验收 fail-closed(单用户 +
+     *  S-842 起是唯一写者,引擎的模式门也据它免问)—— 壳提示词与引擎的写根指同一个目录。验收 fail-closed(单用户 +
      *  host-semantics lane + 绝对路径/深度/长度门,规则在 env-facts.acceptShellScratchpadDir),拒收形
      *  warn 后回落自算——「没到货引擎忽略 = 无害 additive」的对偶:异形键忽略,任务照跑。 */
     scratchpadDir?: string;
@@ -349,11 +350,11 @@ export interface TaskRequestBody {
     toolMaterializeStrategy?: "static" | "swap";
     /** R4 (CC parity): the LIGHT top-level per-turn permission-mode intent (CC `permissionMode`). The shell sends
      *  the RAW mode (axis-agnostic, no client-side interpretation); the SERVICE interprets it tighten-only vs the
-     *  deployment baseline. All SIX core modes are honored (`plan` ⇒ read-only hands + `present_plan`;
-     *  `acceptEdits` selects how much the mode-derived fs-write ask gate asks; `bypassPermissions`/`auto`/`dontAsk` ride the
-     *  engine's own mode table verbatim — `dontAsk` refuses every ask by the mode, zero cards, the gate records
-     *  `deniedBy:"mode"`) — they can never subtract from deployment/operator policy, tightenTaskSpec deny-wins). Folds onto the SAME
-     *  tighten-only governance as `settings.permissions.defaultMode` (the heavier bundle), so it's a lighter alias, not a second path.
+     *  deployment baseline. All SIX core modes ride verbatim into `TaskSpec.permissionMode` and only the engine's mode table
+     *  interprets them (`plan` asks at the call for writes and non-read-only calls; `acceptEdits` writes inside the write roots — the
+     *  task root plus `additionalDirectories` — without asking; `dontAsk` refuses every ask by the mode, zero cards, the gate records
+     *  `deniedBy:"mode"`); none can subtract from deployment/operator policy or the request's own deny / ask rules (tightenTaskSpec
+     *  deny-wins). The top-level word wins over `settings.permissions.defaultMode` (the heavier bundle) — one precedence, read in one place.
      *  [ref]-②: CLOSED enum on the wire — an unknown word 400s at submit (`request.field_invalid`, sibling of
      *  promptProfile) instead of silently coercing to `default`; resume replay of a stored body stays lenient
      *  (coercePermissionMode).
@@ -401,10 +402,10 @@ export interface TaskRequestBody {
      *  记忆面暗的部署(引擎未接线 / 多租户)上 `memory` 整键本就缺席,本声明无处落也无事可关。
      *  Rides the persisted body onto resume legs(与 `memoryWrite` 同姿势)。
      *  ✅ **子代地板自 core 7.22.0 到货,本仓零接线**:core 的 `parentSpecSeatOf` 从**这条 run 自己的**
-     *  `spec.memory.enabled === false` 铸 `ParentSpecSeat.memoryOff`,`applyParentSpecSeat` 作**无条件
-     *  REMOVAL** 施加(改写成 `{ …子代自己的 scopes, enabled:false }`,永不删键)⇒ 父关 ⇒ 子代 / 孙代 /
+     *  `spec.memory.enabled === false` 铸座位的 `memory: { enabled: false }`(core 7.54.0 起是夹表座的一行;此前叫 `memoryOff`,已退役),
+     *  `applyParentSpecSeat` 按表**夹**到子代上(改写成 `{ …子代自己的 scopes, enabled:false }`,永不删键;子代的 `enabled:true` 抬不起)⇒ 父关 ⇒ 子代 / 孙代 /
      *  workflow 子 spec / 跨 run 唤醒与保留 resume 一律无记忆面。🚧 **tier-3 耐久复活不带**(core 已记残余)。
-     *  链路的机器锚:`test/memory-off-request.test.ts` ⑥ 段(亲读 core dist 的铸点与施加点)。 */
+     *  链路的机器锚:`test/memory-off-request.test.ts` ⑥ 段(经 core 包根 `parentSpecSeatOf` / `applyParentSpecSeat` 读铸与施)。 */
     memory?: "off";
     /** 142-S4 projectId 线程化([ref] §2):这个 run 归属的项目(center 登记簿键,generic lowercase
      *  UUID — core S1 `resolveProjectId` marker 或 S3 无仓 mint 的产物;客户端只透传,零铸造权威)。是「哪个
@@ -571,6 +572,10 @@ export type DecideBinding = {
     boundInputHash?: string;
     /** [ref] edit: operator-corrected tool args, applied by core AFTER the binding check, on approve only. */
     updatedInput?: unknown;
+    /** core 7.54.0: the words the approving person wrote on the card ("and tell the agent what to do next"). The decide door admits
+     *  the key only on a person's `approve` (a `deny` or a policy decide with it is a 400 `request.field_conflict`), and the outcome
+     *  mints carry it verbatim when present — the engine owns what counts as written (blank = nothing) and judges it again pre-CAS. */
+    feedback?: string;
 };
 /** [ref]([ref]④→[ref] 坐标轮换判定):409 `approval_stale` 拒体上的 additive 机读指路 ——
  *  **本会话当前 pending** 的 D-1 回显坐标,让持旧坐标的壳一跳重定位(免重拉列表)。
@@ -610,5 +615,7 @@ export type SyncSubmitBody = ReturnType<typeof buildSyncSubmitBody>;
 export interface SyncSubmitExtraKeys {
     notice?: string;
     wiringManifest?: WiringManifestReceipt;
+    /** 受理告知(`entry-problems.ts` 的条目形):放行侧选择器清单里什么也不放的条目,**present-iff** 有话说;流式腿的同名键在 `meta` 帧、异步腿的在 202 回执。 */
+    warnings?: readonly EntryProblem[];
 }
 //# sourceMappingURL=wire-types.d.ts.map

package/dist/index.d.ts

@@ -23,13 +23,15 @@ export { ensureTiDBTaskListSchema, ensurePgTaskListSchema } from "./plugins/task
 export { createAuthorizer, principalFrom, HttpError, type AuthContext, type OwnerAwareSessionStore, } from "./security.js";
 export { memoryScopeFor, memoryEngineBackendFor } from "./memory-scope.js";
 export type { TaskRequestBody } from "./http/wire-types.js";
+export { ensureCheckpointCtxSealing } from "./sealed-key.js";
+export type { CheckpointCtxSealing } from "./http/checkpoint-ctx.js";
 export { createHttpServer, type ServiceDeps, type RequestAuth, type FlatServiceDeps, type ServiceDepGroups, type ServiceCoreDeps, type ServiceStoreDeps, type ServiceCoordinatorDeps, type ServiceSeamDeps, type ServiceObservabilityDeps, type ServiceGovernanceDeps, type ServiceDeploymentDeps, type ServiceKnobDeps, } from "./http/server.js";
 export { createSideQueryLane, type KeyResolver, type SideQueryLane, type SideQueryLaneCtx } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey, type ModelKeyRef } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError, type ModelKeyPoison, type ModelKeyPoisonReason } from "./key-resolver.js";
 export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES, type CatalogEntryHeaderName } from "./model-entry-headers.js";
-export { judgeModelRouteGap, type ModelRouteGapReading, type ModelRouteGapOptions } from "./model-route-gap.js";
 export type { ModelRouteGap } from "./model-route-endpoint.js";
 export { judgeServedModelRoute, type ServedModelRouteView, type ServedModelRouteOptions, type ModelRouteEndpointVerdict } from "./model-route-endpoint.js";
 export type { UserInputLedgerStore, UserInputAcceptance, NewUserInputAcceptance, OpenScanCursor, OpenScanPage, SettleHow, WriterGoneEvidence } from "./user-input-ledger.js";
+export type { OrgDeliveryQuotaStore, OrgDeliveryQuotaPolicy } from "./plugins/org-delivery-quota-store.js";
 //# sourceMappingURL=index.d.ts.map