@sema-agent/server 7.132.0 → 7.134.0

package/dist/boot/leader.d.ts

@@ -23,6 +23,8 @@ export interface LeaderCtx {
     toolResultStore: ToolResultStoreFull | undefined;
     sessionStore: ReturnType<typeof createSessionStore>;
     checkpointStore: CheckpointStoreFull | undefined;
+    /** S-1907:停驻行凭据的封签器(与 HTTP 面 `ServiceDeps.checkpointCtxSealing` 同一只;起服第 6 段已对「店在、它不在」拒启)。必填键,值可为 undefined。 */
+    checkpointCtxSealing: import("../http/checkpoint-ctx.js").CheckpointCtxSealing | undefined;
     /** [ref] 件B/C/D([ref],codex R2-F1):部署治理三座席 —— leader 车道的每一只 Runner 都要带上它,
      *  否则开了 leader 端点的部署就有一条在部署治理**之外**的执行面(合规否决/锁都够不着)。 */
     governanceSeams: import("./governance-seams.js").GovernanceSeams;

package/dist/boot/leader.js

@@ -1,4 +1,5 @@
 import { createLeaderEndpoint } from "../leader/endpoint.js";
+import { createLeaderRunVisibility } from "../http/owner-access.js";
 import { createLeaderRunner } from "../leader/wire.js";
 import { buildDeploymentPostureSeats } from "./runner-deps.js";
 import { hasApprovalListIntent } from "../approval.js";
@@ -21,7 +22,7 @@ export function assertLeaderDurableStore(leaderEnabled, hasLeaderRunStore) {
         "(#193 车4 件2 capability gate; the DB_BACKEND literal check in config.ts is the intent half of the same rule)");
 }
 export function createLeaderFace(ctx) {
-    const { config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, governanceSeams } = ctx;
+    const { config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, checkpointCtxSealing, governanceSeams } = ctx;
     const leaderMinio = process.env.MINIO_ENDPOINT && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
         ? {
             s3: {
@@ -73,6 +74,7 @@ export function createLeaderFace(ctx) {
                     durable: () => hasApprovalListIntent(config)
                         ? {
                             checkpointStore,
+                            ctxSealer: checkpointCtxSealing,
                             requireApproval: config.approvalRequire,
                             deny: config.approvalDeny,
                             autoBudget: config.approvalAutoBudget,
@@ -86,6 +88,7 @@ export function createLeaderFace(ctx) {
             logger,
             requiredFields: ["objective", "durableRemote", "testCmd", "seedCmd", "baseSha"],
             ...(leaderRunStore ? { store: leaderRunStore } : {}),
+            ownerVisible: createLeaderRunVisibility(config),
         })
         : undefined;
     if (leaderEndpoint)

package/dist/boot/memory-boundary.js

@@ -1,5 +1,5 @@
 import { resolve } from "node:path";
-import { executionLaneCaps, executionLaneOf } from "../execution-lane-caps.js";
+import { executionLaneCaps, executionLaneOf, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 export function effectiveMemoryPersistenceCapable(config) {
     if (config.memoryPersistenceCapable !== undefined)
         return config.memoryPersistenceCapable;
@@ -11,7 +11,7 @@ export function buildMemoryBoundaryLaneFacts(config, processCwd) {
     return {
         lane,
         hostSemanticsLane: caps.hostFilePlane === "supported",
-        coreRemoteExecutionEnv: caps.coreRemoteExecutionEnv === "supported",
+        coreRemoteExecutionEnv: laneWiresExecutionEnv(lane),
         containmentRoots: lane === "in-process" ? [processCwd] : [],
     };
 }

package/dist/boot/memory-consolidation.d.ts

@@ -298,9 +298,9 @@ export declare function judgeConsolidationValve(input: ConsolidationValveInput):
  *
  * consolidation 要后端自带引擎控制面归属 ⇒ 今天只有 file 记忆后端满足 ⇒ 本仓只在**单用户**形
  * (`REQUIRE_PRINCIPAL !== true`)上装配记忆引擎 —— 而那种部署的 `OPERATOR_PRINCIPALS` 通常是**空的**。
- * 空名单下 `explicitOperatorOk` 对任何身份恒假(那是它与 `isOperator` 刻意分家的地方:空名单绝不等于
- * 「人人都是 operator」),于是:阀门开着、启动成功、两口挂着、**每一次调用 403**,能力位诚实地报
- * `false` —— 唯独运维不知道为什么,而他刚刚显式拧了一根写着 "on" 的旋钮。
+ * 没有运维名册(名单空且没有单用户声明 `OPERATOR_SINGLE_USER`)时 `explicitOperatorOk` 对任何身份恒假(「谁是 operator」的唯一读法:空名单绝不等于
+ * 「人人都是 operator」),于是:阀门开着、启动成功、两口挂着、**每一次调用 501 `capability.operator_principals_required`**(运维面同一只拒发口;403 只留给名单非空而你不在名单上),
+ * 能力位诚实地报 `false` —— 唯独运维不知道为什么,而他刚刚显式拧了一根写着 "on" 的旋钮。
  *
  * ## 为什么是 warn 而不是拒启(与 D1 的三条拒启臂**刻意不同档**)
  *
@@ -322,7 +322,8 @@ export declare function judgeConsolidationValve(input: ConsolidationValveInput):
 export declare function buildConsolidationValveAudit(input: {
     /** 阀门判决({@link resolveConsolidationValve} 的 `enabled` + `source`)。 */
     valve: Pick<ConsolidationValve, "enabled" | "source">;
-    operatorPrincipals: readonly string[];
+    /** 这台部署有没有运维名册(`operatorRosterPresent`:名单非空 ∨ 单用户声明)—— 判据不在本函数里另写一份。 */
+    operatorRosterPresent: boolean;
     /** 这台部署配了任何一把 service 凭证吗(`config.authToken` 或 `config.authTokens` 非空)。 */
     hasServiceAuth: boolean;
     /** 本地开发的显式逃生口(`ALLOW_UNAUTHED_WRITES=true`)。 */

package/dist/boot/memory-consolidation.js

@@ -1,5 +1,6 @@
 import { redactSecrets } from "../trace/redact.js";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { buildOperatorRosterWayOut } from "../http/principal-gate.js";
 import { memoryMountRootOf } from "../memory-scope.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { DEFAULT_MODEL_REF, resolveMainModel } from "../model-select.js";
@@ -266,15 +267,15 @@ export function buildConsolidationValveAudit(input) {
     if (!input.valve.enabled || input.valve.source !== "explicit")
         return { warnings: [] };
     const warnings = [];
-    if (input.operatorPrincipals.length === 0) {
+    if (!input.operatorRosterPresent) {
         warnings.push({
             tag: "memory_consolidation_valve_unreachable",
             detail: "MEMORY_CONSOLIDATION_DRIVER=on armed the consolidation valve and both admin endpoints are mounted, but " +
-                "OPERATOR_PRINCIPALS is EMPTY — an empty operator list means NO ONE is an operator (it deliberately does " +
-                "not mean 'everyone'), so POST /v1/admin/memory/consolidation/run and GET /v1/admin/memory/consolidation " +
-                "answer 403 auth.operator_only to every caller and capabilities.memoryConsolidationDriver reports false. " +
-                "Set OPERATOR_PRINCIPALS to the principal(s) allowed to drive consolidation, and send that principal in " +
-                "the configured principal header. (Not a startup refusal: OPERATOR_PRINCIPALS is shared by every operator " +
+                "this worker has no operator: OPERATOR_PRINCIPALS is EMPTY and OPERATOR_SINGLE_USER is not set — an empty operator list means NO ONE " +
+                "is an operator (it deliberately does not mean 'everyone'), so POST /v1/admin/memory/consolidation/run and GET /v1/admin/memory/consolidation " +
+                "answer 501 capability.operator_principals_required to every caller and capabilities.memoryConsolidationDriver reports false. " +
+                `To fix: ${buildOperatorRosterWayOut()}. With OPERATOR_PRINCIPALS, callers must send a listed principal in the configured principal header; a single-user declaration needs no principal. ` +
+                "(Not a startup refusal: the operator roster is shared by every operator " +
                 "endpoint on this worker, so one valve must not decide whether the whole worker starts.)",
         });
     }

package/dist/boot/org-delivery.d.ts

@@ -0,0 +1,28 @@
+/**
+ * [ref] §10.2 —— 跨主体投递门的**装配点**(门本体与规则在 `src/org-delivery-gate.ts`)。
+ *
+ * 挂载规则(一条):**部署声明了 principal 收件箱的消费方 ⟺ 门在座**。声明 = `RunnerDeps.principalInboxConsumer`
+ * (由 `PRINCIPAL_INBOX_ASSISTANT` 铸,`boot/runner-deps.ts`);门要的四件 —— 消费方、耐久 mailbox、org 成员目录、配额店 ——
+ * 是这条声明的**前提**,不是可选项:声明在而任一件缺 ⇒ **拒启**,拒句点名缺哪件。不存在「声明了但门没挂」的静默半态:
+ * 那一形下收件箱有消费方却没有任何合法的写入方,运维以为跨主体投递开着,wire 上它恒 501。
+ *
+ * 消费方取自**同一个** `RunnerDeps` 对象(`principalInboxConsumerOf(runnerDeps)`),不从 config 再读一遍(core 契约原句:
+ * 「over the same RunnerDeps the deployment runs its legs with」)。
+ */
+import { type MailboxStore, type OrgDeliveryGate, type RunnerDeps } from "@sema-agent/core";
+import type { OrgMemoryDirectory } from "../org-memory-admission.js";
+import type { StoreBackend } from "../plugins/store-backend.js";
+import type { Logger } from "../observability/logger.js";
+export interface OrgDeliveryMountInput {
+    /** 主 Runner 的那一份 `RunnerDeps`(消费方声明从它读)。 */
+    readonly runnerDeps: Pick<RunnerDeps, "principalInboxConsumer">;
+    /** 记忆准入 / memory-policy / 共享记忆读面共用的那一个目录实例(`boot/org-memory.ts`)。 */
+    readonly directory: OrgMemoryDirectory | undefined;
+    /** 与引擎 `RunnerDeps.mailboxStore` 同一只店。 */
+    readonly mailboxStore: MailboxStore | undefined;
+    readonly backend: Pick<StoreBackend, "orgDeliveryQuota"> | undefined;
+    readonly logger: Pick<Logger, "info">;
+}
+/** 门在座 ⇒ 门;部署没声明消费方 ⇒ `undefined`;声明了而前提缺 ⇒ 抛(拒启)。 */
+export declare function mountOrgDeliveryGate(input: OrgDeliveryMountInput): OrgDeliveryGate | undefined;
+//# sourceMappingURL=org-delivery.d.ts.map

package/dist/boot/org-delivery.js

@@ -0,0 +1,20 @@
+import { principalInboxConsumerOf } from "@sema-agent/core";
+import { createOrgDeliveryGate } from "../org-delivery-gate.js";
+export function mountOrgDeliveryGate(input) {
+    const consumer = principalInboxConsumerOf(input.runnerDeps);
+    if (consumer.kind === "none")
+        return undefined;
+    const { mailboxStore, directory, backend } = input;
+    if (mailboxStore === undefined || directory === undefined || backend === undefined) {
+        const missing = [
+            ...(mailboxStore === undefined ? ["a durable mailbox store (DB_BACKEND=mysql|pg|local)"] : []),
+            ...(directory === undefined ? ["an organization membership directory (a web-admin center, or MEMORY_ORG_DIRECTORY_JSON)"] : []),
+            ...(backend === undefined ? ["a store backend for the delivery quota (DB_BACKEND=mysql|pg|local)"] : []),
+        ];
+        throw new Error(`PRINCIPAL_INBOX_ASSISTANT declares a principal-inbox consumer, so this deployment must mount the organization delivery gate — but it lacks ${missing.join("; ")}. ` +
+            `Refusing to boot rather than run with a declared inbox that nothing may legitimately write to; provide the missing pieces or unset PRINCIPAL_INBOX_ASSISTANT.`);
+    }
+    input.logger.info("org_delivery_gate_mounted", { consumer: consumer.kind });
+    return createOrgDeliveryGate({ directory, mailbox: mailboxStore, quota: backend.orgDeliveryQuota(), consumer });
+}
+//# sourceMappingURL=org-delivery.js.map

package/dist/boot/read-deny-anchor-audit.js

@@ -1,9 +1,9 @@
-import { compileReadDeny, readDenyPatternRun } from "@sema-agent/core";
+import { compileReadDeny, readDenyRowAnchor } from "@sema-agent/core";
 import { echoCallerText } from "../caller-text-echo.js";
 export const READ_DENY_AUDIT_MAX_NAMED_ROWS = 20;
 const NAMED_ROW_ECHO_CHARS = 200;
 function isAnchoredCanonicalRow(canonical) {
-    return readDenyPatternRun(canonical).homeAnchored || canonical.startsWith("/");
+    return readDenyRowAnchor(canonical) !== "none";
 }
 export function auditReadDenyAnchoring(ctx) {
     if (ctx.rows === undefined || ctx.rows.length === 0)

package/dist/boot/reapers.d.ts

@@ -25,6 +25,7 @@ import type { FileHistoryErasureFace } from "../file-history-capture.js";
 import type { ApprovalNonceStore, CheckpointStoreFull, CostQuotaStore, ImageBake, RateLimiterStore, ServiceWorkflowJournalStore, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { ParkCommitWatch } from "../plugins/park-commit-watch.js";
+import { type AuditRotationPort } from "../approval-ask-retention.js";
 /** [ref] / [ref]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
  *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
  *  below are correct in DIRECTION (a hiccuping periodic sweep must never crash the whole tick loop — one bad
@@ -108,6 +109,8 @@ export interface ReapersCtx {
      *  受理的最后一刻),所以存量是「到达率 × TTL」而不是历史总量,清扫无需分批。无 backend 的 env-only
      *  部署 ⇒ undefined ⇒ 本腿零调用(那种部署也没有 durable 审批门)。 */
     approvalNonceStore: ApprovalNonceStore | undefined;
+    /** local 车道的审批审计账(装配三合取见 `boot/coordinators.ts`;SQL 车道 / 审批关着 ⇒ undefined)—— 本 tick 只用它的**留存轮转**一手。 */
+    approvalAskAudit: AuditRotationPort | undefined;
     /** 晚绑(server 造出来才有)——见文件头「位置即契约」①。 */
     getRunDenySweep: () => ((now: number) => Promise<void>) | undefined;
 }

package/dist/boot/reapers.js

@@ -4,6 +4,7 @@ import { CostQuota } from "../observability/cost-quota.js";
 import { isAdoptionQuiescing, trackMaintenanceLeg } from "../adoption/quiesce.js";
 import { createApprovalReconciler } from "../approval-reconciler.js";
 import { createE2bOrphanSandboxProvider, reclaimOrphanE2bSandboxes, E2B_ORPHAN_GRACE_MS } from "../plugins/e2b-orphan-reclaim.js";
+import { APPROVAL_ASK_RETENTION_PASS_MS, runApprovalAskRetentionPass } from "../approval-ask-retention.js";
 export const REAPER_FAILURE_WARN_THRESHOLD = 5;
 export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAILURE_WARN_THRESHOLD) {
     let streak = 0;
@@ -56,7 +57,7 @@ export function createPlacementAwareReapSessions(deps) {
     };
 }
 export function startReapers(ctx) {
-    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits, rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, userInputLedger, } = ctx;
+    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits, rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, userInputLedger, approvalAskAudit, } = ctx;
     const leg = (p) => {
         if (p !== undefined)
             trackMaintenanceLeg(p);
@@ -101,6 +102,17 @@ export function startReapers(ctx) {
     const leaderRunStaleGuard = createThrottledReaperCatch("leader_run_reap_stale", logger);
     const leaderRunStore = config.leaderEnabled ? backend?.leaderRun?.() : undefined;
     const scratchpadSweepStaleGuard = createThrottledReaperCatch("scratchpad_sweep_stale", logger);
+    const approvalAskRetentionMs = config.approvalAskRetentionMs;
+    const approvalAskRetentionGuard = createThrottledReaperCatch("approval_ask_retention", logger);
+    let approvalAskRetentionLastRunMs = Number.NEGATIVE_INFINITY;
+    let approvalAskRetentionInFlight = false;
+    logger.info("approval_ask_retention", {
+        windowMs: approvalAskRetentionMs,
+        ledgers: { asks: backend !== undefined, audit: approvalAskAudit !== undefined },
+        note: approvalAskRetentionMs > 0
+            ? "settled approval asks quiet for longer than windowMs are deleted whole from the approval ledgers on the maintenance tick (at most once an hour); unsettled asks, and every ask hanging off something that can still move (a running / parked run or delegated child, by run id or session), are never aged out. APPROVAL_ASK_RETENTION_MS=0 keeps everything."
+            : "APPROVAL_ASK_RETENTION_MS=0 — the approval ledgers are kept forever (nothing is aged out).",
+    });
     const approvalReconcileGuard = createThrottledReaperCatch("approval_reconcile", logger);
     const approvalSuspendedPollGuard = createThrottledReaperCatch("approval_suspended_poll", logger);
     let approvalSuspendedPollInFlight = false;
@@ -325,6 +337,14 @@ export function startReapers(ctx) {
             if (permissionRuleStores?.reapExpired === undefined)
                 permissionRuleReapInFlight = false;
         }
+        if (approvalAskRetentionMs > 0 && runStore !== undefined && !approvalAskRetentionInFlight && Date.now() - approvalAskRetentionLastRunMs >= APPROVAL_ASK_RETENTION_PASS_MS && (backend !== undefined || approvalAskAudit !== undefined)) {
+            approvalAskRetentionInFlight = true;
+            approvalAskRetentionLastRunMs = Date.now();
+            leg(Promise.resolve()
+                .then(() => runApprovalAskRetentionPass({ askStore: backend?.approvalAsk(), audit: approvalAskAudit, runs: runStore, backgroundAgents: backgroundAgentStore, checkpoints: backend?.checkpointReadView(), cutoffMs: Date.now() - approvalAskRetentionMs, logger, metrics }))
+                .then(() => approvalAskRetentionGuard.onSuccess(), approvalAskRetentionGuard.onError)
+                .finally(() => (approvalAskRetentionInFlight = false)));
+        }
         if (config.scratchpadSweepTtlMs > 0) {
             leg(sweepStaleScratchpads(config.localDataRoot ?? localRoot, { olderThanMs: config.scratchpadSweepTtlMs })
                 .then((removed) => {

package/dist/boot/resolve-spec.d.ts

@@ -16,6 +16,7 @@ import type { StoreBackend } from "../plugins/store-backend.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import { type createPrincipalEntitlementsClient } from "../runtime-caps-resolver.js";
 import { type OwnerAwareSessionStore } from "../security.js";
+import type { MemorySyncRunner } from "../memory-sync-client.js";
 import type { RunnerDepsOnAsk } from "./runner-deps.js";
 type PrincipalCaps = ReturnType<typeof createPrincipalEntitlementsClient>;
 /** `resolveSpec` 原先从 `main()` 闭包里拿到的全部 boot 局部量。 */
@@ -56,6 +57,8 @@ export interface ResolveSpecCtx {
         backend: MemoryBackend;
         root: string;
     } | undefined;
+    /** S-640:记忆同步腿(开 `MEMORY_SYNC_*` 且记忆引擎接线时在场)—— 项目层准备一步把本任务的项目层交给它跟踪(`memory-project-layer.ts`)。 */
+    memorySyncRunner: MemorySyncRunner | undefined;
     durableEnabled: boolean;
     /** [ref] ([ref] 案二):活体 AskUserQuestion 面(QuestionCoordinator 的判决探针切面)。在场(=
      *  ASK_QUESTION_ENABLED)时 durable question 门按活流上下文分腿、spec 不再 stamp QUESTION_AWAITS_RESUME

package/dist/boot/resolve-spec.js

@@ -1,11 +1,11 @@
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
-import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE, deriveAskEffective, expandTiers, modePolicyOf, resolveAskSeamForm } from "@sema-agent/core";
+import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, deriveAskEffective, expandTiers, modePolicyOf, resolveAskSeamForm } from "@sema-agent/core";
 import { cappedCeiling } from "../budget.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
-import { buildPromptSeats, createScenarioGate, mergeUserSkills, selectScenario } from "../capabilities/scenarios.js";
+import { buildExcludeToolsSeat, buildPromptSeats, createScenarioGate, mergeUserSkills, selectScenario } from "../capabilities/scenarios.js";
 import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildApprovalGrantNotice, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
@@ -17,7 +17,7 @@ import { HOST_POSTURE_REFUSED_CODE, taskInheritEnvRefusal, taskWriteFaceRefusal
 import { headerStr } from "../http/principal-gate.js";
 import { explicitOperatorOk } from "../http/server.js";
 import { isAtMentionable, matchCatalogModel, modelSupportsImages, refusedCatalogEntry, resolveTaskModel, selectableCatalog, terminalCatalogName } from "../model-select.js";
-import { modelUnavailableMessage } from "../model-entry-refusal.js";
+import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { PerTaskImageRegistry, resolveSandboxImageRef } from "../per-task-image.js";
 import { isRemoteScratchpadLane, remoteScratchpadDirFor } from "../plugins/remote-scratchpad.js";
 import { bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
@@ -27,7 +27,9 @@ import { tightenGoverned } from "../governance-overrides.js";
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { applyRuntimeGovernance } from "../runtime-governance.js";
 import { HttpError, createCodedHttpError, encodeCheckpointScope } from "../security.js";
-import { memoryProjectKeyFor, memorySpecForRequest } from "../memory-scope.js";
+import { sessionFaceReadOf } from "../session-incarnation.js";
+import { memorySpecForRequest } from "../memory-scope.js";
+import { createMemoryProjectLayers } from "../memory-project-layer.js";
 import { inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { a2aForScenario, mcpForScenario } from "../web-admin-client/facade.js";
 import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptProfileFromBody, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolMaterializeStrategyFromBody, allowToolsSpecFragment, toolNameListFromBody } from "../spec-fields.js";
@@ -37,17 +39,21 @@ import { assertRequestA2aUnlocked, resolveRequestA2a } from "../task-a2a.js";
 import { assertRequestMcpEntries, assertRequestMcpUnlocked, resolveRequestMcp } from "../task-mcp.js";
 import { storedToolAxesRereadM19 } from "../stored-request-tool-axes-m19.js";
 import { storedHooksRereadM20 } from "../stored-request-hooks-m20.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, REQUEST_SETTINGS_REFUSAL_PREFIX, acceptAppendSystemPrompt, applyTaskSettings, effectivePermissionMode, effectiveThinking, parseTaskSettings, taskHooksHonored, settingsPermissionBucketIssue, withPermissionMode } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_RULE_REFUSAL_CODE, SettingsRuleRefusalError, acceptAppendSystemPrompt, applyTaskSettings, createWorkflowAskPolicy, effectivePermissionMode, effectiveThinking, parseTaskSettings, taskHooksHonored, settingsPermissionBucketIssue } from "../task-settings.js";
+import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
+import { entryProblemsFacts } from "../entry-problems.js";
 import { inertToolListEntryOf } from "../rule-entry-list.js";
 import { TENANCY_WALL_CLOCK_BASE_SEC, enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
-import { executionLaneCaps, executionLaneHomeDir, executionLaneOf } from "../execution-lane-caps.js";
+import { executionLaneHomeDir, executionLaneOf, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
+import { fieldConflictFacts } from "../field-conflict.js";
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
     const scenarioGate = createScenarioGate({ config, scenarios, principalCaps, logger }, "enforce");
+    const readSessionFace = sessionFaceReadOf(ownerAware);
     assertGuardPatternsUsable(config);
     const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, {
         approvalSeat: durableEnabled ? "durable" : "absent",
@@ -59,6 +65,7 @@ export function createResolveSpec(ctx) {
         const sessionCwd = auth?.sessionId ? effectiveHostWorkspace(perSessionCwd.get(auth.sessionId), {}) : undefined;
         return sessionCwd ?? (config.remoteExec === undefined ? process.cwd() : undefined);
     };
+    const memoryProjectLayers = createMemoryProjectLayers({ backend: memoryEngine?.backend, syncRunner: memorySyncRunner, log: logger });
     if (onlySensitiveBaseline)
         logger.warn(onlySensitiveBaseline.event, onlySensitiveBaseline.fields);
     const approvalGrantNotice = buildApprovalGrantNotice(config);
@@ -81,7 +88,7 @@ export function createResolveSpec(ctx) {
                 cwdHonored: cwdHonored(config),
             });
             if (conflict) {
-                throw new HttpError(400, `cwd "${conflict.cwd.asSpelled}" is inside this session's scratchpad "${conflict.scratchpadDir.asSpelled}" — the scratchpad is the fs-write gate's EXEMPT directory, so a task rooted there would auto-approve every write under its own root and the engine refuses to build the gate at all (config.write_exempt_dir_covers_root). Point cwd at the project directory instead (or send no cwd and let the session keep the one it has): this session registers the cwd you send, so a task that happens not to mount the write gate would still leave every LATER task on this session rooted in the exemption. A workflow that really is meant to write without prompts says so with a knob that means it (a permission mode, an open write face) and still keeps its root outside the scratchpad — those knobs do not lift this refusal, because the conflict is between two fields of this request, not a permission level.`, { code: "request.field_conflict", extra: { cwd: conflict.cwd, scratchpadDir: conflict.scratchpadDir } });
+                throw new HttpError(400, `cwd "${conflict.cwd.asSpelled}" is inside this session's scratchpad "${conflict.scratchpadDir.asSpelled}" — the scratchpad is the fs-write gate's EXEMPT directory, so a task rooted there would auto-approve every write under its own root and the engine refuses to build the gate at all (config.write_exempt_dir_covers_root). Point cwd at the project directory instead (or send no cwd and let the session keep the one it has): this session registers the cwd you send, so a task that happens not to mount the write gate would still leave every LATER task on this session rooted in the exemption. A workflow that really is meant to write without prompts says so with a knob that means it (a permission mode, an open write face) and still keeps its root outside the scratchpad — those knobs do not lift this refusal, because the conflict is between two fields of this request, not a permission level.`, { code: "request.field_conflict", extra: { ...fieldConflictFacts("scratchpad_root", body.scratchpadDir === conflict.scratchpadDir.asSpelled ? ["cwd", "scratchpadDir"] : ["cwd"]), cwd: conflict.cwd, scratchpadDir: conflict.scratchpadDir } });
             }
         }
         const offFieldIssue = singleMemberOffFieldIssue(body);
@@ -109,6 +116,11 @@ export function createResolveSpec(ctx) {
             if (bucketIssue)
                 throw new HttpError(400, bucketIssue.message, { code: "request.field_invalid", extra: bucketIssue.fields });
         }
+        {
+            const seatIssue = tightenOnlySeatIssue(body.settings);
+            if (seatIssue)
+                throw new HttpError(400, seatIssue.message, { code: "request.field_invalid", extra: seatIssue.fields });
+        }
         {
             const replay = opts?.leg === "resume";
             const inertList = inertToolListEntryOf(body, replay ? ["deny"] : undefined);
@@ -136,8 +148,9 @@ export function createResolveSpec(ctx) {
         }
         const lane = bindSettingsCwdEnvAndModel(body, auth, gated, opts);
         const anchors = await resolveHistoryAnchors(body, auth);
-        const spec = assembleSpecLiteral(body, auth, req, opts, { ...gated, ...lane, ...anchors }, effMode);
-        const folded = await foldGovernanceAndSettings(body, auth, spec, gated, effMode);
+        const projectKey = memoryEngine ? await memoryProjectLayers.prepare(config, auth?.memoryScope, realTaskRootOf(auth)) : undefined;
+        const spec = assembleSpecLiteral(body, auth, req, opts, { ...gated, ...lane, ...anchors, projectKey }, effMode);
+        const folded = await foldGovernanceAndSettings(body, auth, spec, gated);
         const final = await applyImageFactsAndRouting(body, auth, folded.governed, {
             scenarioName: gated.scenarioName,
             scratchpadDir: folded.scratchpadDir,
@@ -149,7 +162,7 @@ export function createResolveSpec(ctx) {
     const gateScenarioAndAppend = async (body, auth, opts) => {
         const scenarioName = await scenarioGate(auth?.principal, body.scenario);
         gateExecutionLane(await principalCaps?.executionRuling(auth?.principal), executionLaneOf(config.remoteExec?.provider), logger);
-        const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, auth?.sessionId !== undefined ? { sessionId: auth.sessionId } : {});
+        const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, auth?.sessionId !== undefined ? { sessionId: auth.sessionId, delegationRoot: { sessionId: auth.sessionId, incarnation: (await readSessionFace?.(auth.sessionId))?.incarnation ?? null } } : {});
         const acceptedAppend = acceptAppendSystemPrompt(body.appendSystemPrompt, (detail) => logger.warn("append_system_prompt_dropped", { detail, sessionId: auth?.sessionId ?? null }));
         const objective = typeof body.objective === "string" ? body.objective : "";
         const parsedSettings = parseTaskSettings(body.settings, opts?.leg === "fresh" || !taskHooksHonored(config) ? {} : { storedHooksReread: storedHooksRereadM20(new Date().toISOString().slice(0, 10)) });
@@ -274,22 +287,22 @@ export function createResolveSpec(ctx) {
         if (picked.unavailable !== undefined) {
             const { requested, name, refusal, source } = picked.unavailable;
             if (opts?.leg === "fresh") {
-                throw new HttpError(400, modelUnavailableMessage(source === "mention" ? "@-mention" : "model", requested.slice(0, 120), name, refusal), { code: "request.model_unavailable" });
+                throw new HttpError(400, modelUnavailableMessage(source === "mention" ? "@-mention" : "model", requested, name, refusal), { code: "request.model_unavailable" });
             }
             metrics.inc("task_model_unavailable_fallback_total");
-            logger.warn("task_model_unavailable_fallback", { requested: requested.slice(0, 120), name, code: refusal.code, source, fallback: picked.model, sessionId: auth?.sessionId ?? null });
+            logger.warn("task_model_unavailable_fallback", { requested: echoModelRef(requested), name, code: refusal.code, source, fallback: picked.model, sessionId: auth?.sessionId ?? null });
         }
         if (picked.notAllowed !== undefined) {
             const { requested, resolved, source } = picked.notAllowed;
             if (opts?.leg === "fresh") {
-                throw new HttpError(400, `model "${requested.slice(0, 120)}" is not @-mentionable on this deployment (it resolves to catalog model "${resolved}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
+                throw new HttpError(400, `model "${echoModelRef(requested)}" is not @-mentionable on this deployment (it resolves to catalog model "${resolved}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
             }
             metrics.inc("task_model_not_allowlisted_resume_total");
-            logger.warn("task_model_not_allowlisted_resume", { requested: requested.slice(0, 120), resolved, source, sessionId: auth?.sessionId ?? null, note: "resumed leg keeps running the model it was started on — the allowlist gates fresh picks only" });
+            logger.warn("task_model_not_allowlisted_resume", { requested: echoModelRef(requested), resolved, source, sessionId: auth?.sessionId ?? null, note: "resumed leg keeps running the model it was started on — the allowlist gates fresh picks only" });
         }
         if (picked.unknownExplicit !== undefined) {
             metrics.inc("task_model_unknown_fallback_total");
-            logger.warn("task_model_unknown_fallback", { requested: picked.unknownExplicit.slice(0, 120), fallback: picked.model, sessionId: auth?.sessionId ?? null });
+            logger.warn("task_model_unknown_fallback", { requested: echoModelRef(picked.unknownExplicit), fallback: picked.model, sessionId: auth?.sessionId ?? null });
         }
         if (Array.isArray(body.images) && body.images.length > 0 && !modelSupportsImages(wireCatalog[picked.model])) {
             metrics.inc("images_omitted_total", { model: picked.model });
@@ -338,7 +351,7 @@ export function createResolveSpec(ctx) {
         return deriveAskEffective(askForm.form, "unresolved") === "human_reachable";
     };
     const assembleSpecLiteral = (body, auth, req, opts, parts, effMode) => {
-        const { scenarioName, cap, hands, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, } = parts;
+        const { scenarioName, cap, hands, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, projectKey, } = parts;
         const storedToolAxes = opts?.leg === "fresh" ? undefined : storedToolAxesRereadM19(new Date().toISOString().slice(0, 10));
         const spec = {
             objective: attachmentNotice ? `${picked.cleanedObjective}\n\n${attachmentNotice}` : picked.cleanedObjective,
@@ -380,7 +393,7 @@ export function createResolveSpec(ctx) {
                 ? { retainBackgroundProcesses: true }
                 : {}),
             ...(body.excludeAllTools === true ? { excludeAllTools: true } : {}),
-            ...(() => { const v = toolNameListFromBody(body.excludeTools); return v ? { excludeTools: v } : {}; })(),
+            ...buildExcludeToolsSeat(cap.excludeTools, toolNameListFromBody(body.excludeTools)),
             ...allowToolsSpecFragment(body.allowTools),
             ...(() => { const v = toolNameListFromBody(body.deferTools); return v ? { deferTools: v } : {}; })(),
             ...(() => { const v = promptProfileFromBody(body.promptProfile); return v ? { promptProfile: v } : {}; })(),
@@ -389,7 +402,7 @@ export function createResolveSpec(ctx) {
             ...(declaresInteractivePosture(body, req, opts) ? { interactionPosture: "interactive" } : {}),
             ...(body.approvalReach !== undefined ? { approvalReach: body.approvalReach } : {}),
             ...(typeof body.oneShot === "boolean" ? { oneShot: body.oneShot } : {}),
-            resilience: normalizeResilience(body.resilience, explicitOperatorOk(auth?.principal, config.operatorPrincipals)),
+            resilience: normalizeResilience(body.resilience, explicitOperatorOk(auth?.principal, config)),
             finalVerification: cap.finalVerification === true || body.finalVerification === true ? true : undefined,
             attachments: normalizeAttachments(body.attachments),
             ...(taskHooks ? { mods: [taskHooks] } : {}),
@@ -400,23 +413,23 @@ export function createResolveSpec(ctx) {
                 const cm = matchCatalogModel(body.compactionModel, wireCatalog, config.modelRefusals);
                 const refusedCm = cm === undefined ? refusedCatalogEntry(body.compactionModel, config.modelRefusals) : undefined;
                 if (refusedCm !== undefined && opts?.leg === "fresh") {
-                    throw new HttpError(400, modelUnavailableMessage("compactionModel", body.compactionModel.slice(0, 120), refusedCm.name, refusedCm.refusal), { code: "request.model_unavailable" });
+                    throw new HttpError(400, modelUnavailableMessage("compactionModel", body.compactionModel, refusedCm.name, refusedCm.refusal), { code: "request.model_unavailable" });
                 }
                 if (cm === undefined) {
                     if (opts?.leg === "fresh") {
-                        throw new HttpError(400, `unknown compactionModel "${body.compactionModel.slice(0, 120)}" — not in the configured catalog (name, tier word, or id; a catalog refresh may have removed it mid-request)`);
+                        throw new HttpError(400, `unknown compactionModel "${echoModelRef(body.compactionModel)}" — not in the configured catalog (name, tier word, or id; a catalog refresh may have removed it mid-request)`);
                     }
                     metrics.inc("task_model_unknown_fallback_total");
-                    logger.warn("compaction_model_unknown_fallback", { requested: body.compactionModel.slice(0, 120), sessionId: auth?.sessionId ?? null });
+                    logger.warn("compaction_model_unknown_fallback", { requested: echoModelRef(body.compactionModel), sessionId: auth?.sessionId ?? null });
                     return {};
                 }
                 if (!isAtMentionable(cm, wireCatalog, config.atMention, config.modelRefusals)) {
                     const terminal = terminalCatalogName(cm, wireCatalog, config.modelRefusals) ?? cm;
                     if (opts?.leg === "fresh") {
-                        throw new HttpError(400, `compactionModel "${body.compactionModel.slice(0, 120)}" is not @-mentionable on this deployment (it resolves to catalog model "${terminal}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
+                        throw new HttpError(400, `compactionModel "${echoModelRef(body.compactionModel)}" is not @-mentionable on this deployment (it resolves to catalog model "${terminal}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
                     }
                     metrics.inc("task_model_not_allowlisted_resume_total");
-                    logger.warn("task_model_not_allowlisted_resume", { requested: body.compactionModel.slice(0, 120), resolved: terminal, source: "compaction", sessionId: auth?.sessionId ?? null, note: "resumed leg keeps the compaction model it was started with — the allowlist gates fresh picks only" });
+                    logger.warn("task_model_not_allowlisted_resume", { requested: echoModelRef(body.compactionModel), resolved: terminal, source: "compaction", sessionId: auth?.sessionId ?? null, note: "resumed leg keeps the compaction model it was started with — the allowlist gates fresh picks only" });
                 }
                 return { compactionModel: cm };
             })()),
@@ -459,7 +472,7 @@ export function createResolveSpec(ctx) {
             })(),
             ...(config.requirePrincipal !== true ? { backgroundScope: "session" } : {}),
             memory: memoryEngine
-                ? memorySpecForRequest(auth?.memoryScope, memoryProjectKeyFor(config, auth?.memoryScope, realTaskRootOf(auth)), body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }, { memory: body.memory, memoryCapture: body.memoryCapture })
+                ? memorySpecForRequest(auth?.memoryScope, projectKey, body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }, { memory: body.memory, memoryCapture: body.memoryCapture })
                 : undefined,
             ...((v) => (v !== undefined ? { memoryPersistenceCapable: v } : {}))(effectiveMemoryPersistenceCapable(config)),
             tools: ((base) => {
@@ -505,7 +518,7 @@ export function createResolveSpec(ctx) {
         };
         return spec;
     };
-    const foldGovernanceAndSettings = async (body, auth, spec, gated, effMode) => {
+    const foldGovernanceAndSettings = async (body, auth, spec, gated) => {
         const { acceptedAppend, parsedSettings } = gated;
         const hostSemanticsLane = !isSandboxPathAdjudicationLane(config.remoteExec?.provider);
         const laneHomeBase = () => {
@@ -533,7 +546,7 @@ export function createResolveSpec(ctx) {
             };
         const governedBase = applyRuntimeGovernance(spec, createDeploymentGovernanceInputs(config, pathAdjudication));
         let governed = governedBase;
-        let effectiveSettings = effMode ? withPermissionMode(parsedSettings.settings, effMode) : parsedSettings.settings;
+        let effectiveSettings = parsedSettings.settings;
         if (effectiveSettings?.outputStyle && acceptedAppend && acceptedAppend.length + 2 + effectiveSettings.outputStyle.length > MAX_SETTINGS_OUTPUT_STYLE_CHARS) {
             logger.warn("output_style_dropped", { detail: `combined append carriers exceed the ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} cap (rider ${acceptedAppend.length} + style ${effectiveSettings.outputStyle.length}) — style dropped (pre-cap stored body on a resume leg?)`, sessionId: auth?.sessionId ?? null });
             const { outputStyle: _dropped2, ...rest2 } = effectiveSettings;
@@ -549,65 +562,31 @@ export function createResolveSpec(ctx) {
                 ? await ensureScratchpadDir(config.localDataRoot ?? localRoot, auth.sessionId, (msg, meta) => logger.warn(msg, { ...(meta ?? {}), sessionId: auth.sessionId }))
                 : undefined);
         if (effectiveSettings) {
-            const gateCommon = {
-                ...(approvalExemptionStore && auth?.sessionId
-                    ? {
-                        isExempt: async (toolName) => {
-                            const hit = await approvalExemptionStore.has(auth.sessionId, toolName);
-                            if (hit)
-                                logger.info("fs_write_gate_exempted", { toolName, sessionId: auth.sessionId });
-                            return hit;
-                        },
-                    }
-                    : {}),
+            const ruleBases = {
+                ...(pathAdjudication.taskRoot !== undefined ? { taskRoot: pathAdjudication.taskRoot } : {}),
+                ...(pathAdjudication.taskHome !== undefined ? { taskHome: pathAdjudication.taskHome } : {}),
             };
-            const fsWriteGate = hostSemanticsLane
-                ? {
-                    env: pathAdjudication.env,
-                    ...(pathAdjudication.cwd !== undefined ? { cwd: pathAdjudication.cwd } : {}),
-                    ...(pathAdjudication.taskRoot !== undefined ? { taskRoot: pathAdjudication.taskRoot } : {}),
-                    ...(pathAdjudication.taskHome !== undefined ? { taskHome: pathAdjudication.taskHome } : {}),
-                    ...(scratchpadDir ? { scratchpadDir } : {}),
-                    ...gateCommon,
-                }
-                :
-                    (() => {
-                        const sandboxScratchpadDir = isRemoteScratchpadLane(config.remoteExec?.provider) ? remoteScratchpadDirFor(auth?.sessionId) : undefined;
-                        return {
-                            env: pathAdjudication.env,
-                            ...(pathAdjudication.taskHome !== undefined ? { taskHome: pathAdjudication.taskHome } : {}),
-                            ...gateCommon,
-                            ...(sandboxScratchpadDir ? { scratchpadDir: sandboxScratchpadDir } : {}),
-                            ...(gateCommon.isExempt
-                                ? {
-                                    isExempt: (toolName, canonicalPath) => canonicalPath.startsWith("/") ? gateCommon.isExempt(toolName) : false,
-                                }
-                                : {}),
-                        };
-                    })();
-            const workflowGate = approvalExemptionStore && auth?.sessionId
-                ? {
-                    isExempt: async (toolName) => {
-                        const hit = await approvalExemptionStore.has(auth.sessionId, toolName);
-                        if (hit)
-                            logger.info("workflow_gate_exempted", { toolName, sessionId: auth.sessionId });
-                        return hit;
-                    },
-                }
-                : undefined;
             try {
-                governed = applyTaskSettings(governedBase, effectiveSettings, fsWriteGate, workflowGate);
+                governed = applyTaskSettings(governedBase, effectiveSettings, ruleBases);
             }
             catch (e) {
-                if (e.code === WRITE_EXEMPT_DIR_COVERS_ROOT_CODE) {
-                    throw new HttpError(400, e.message, {
-                        code: "request.field_conflict",
-                        ...(e.detail !== undefined ? { extra: { writeExemptDirCoversRoot: e.detail } } : {}),
-                    });
-                }
+                if (e instanceof SettingsRuleRefusalError)
+                    throw new HttpError(422, `${REQUEST_SETTINGS_REFUSAL_PREFIX}${e.message}`, { code: SETTINGS_RULE_REFUSAL_CODE, extra: { ...entryProblemsFacts(e.problems) } });
                 throw new HttpError(422, `${REQUEST_SETTINGS_REFUSAL_PREFIX}${e.message}`);
             }
         }
+        if (governed.selfOrchestration === true) {
+            governed = tightenGoverned(governed, {
+                toolPolicy: createWorkflowAskPolicy(approvalExemptionStore && auth?.sessionId
+                    ? async (toolName) => {
+                        const hit = await approvalExemptionStore.has(auth.sessionId, toolName);
+                        if (hit)
+                            logger.info("workflow_gate_exempted", { toolName, sessionId: auth.sessionId });
+                        return hit;
+                    }
+                    : undefined),
+            });
+        }
         return { governed, scratchpadDir, hostSemanticsLane };
     };
     const applyImageFactsAndRouting = async (body, auth, governed, folded) => {
@@ -631,7 +610,7 @@ export function createResolveSpec(ctx) {
             const resolved = await resolveSandboxImageRef({
                 profile: taskImageProfile,
                 ...(capsNeeded && capsNeeded.length > 0 ? { capabilitiesNeeded: capsNeeded } : {}),
-                viewer: { operator: explicitOperatorOk(auth.principal, config.operatorPrincipals), tenantId: auth.principal ?? null },
+                viewer: { operator: explicitOperatorOk(auth.principal, config), tenantId: auth.principal ?? null },
                 index: imageIndex,
             });
             if (!resolved.ok)
@@ -662,7 +641,7 @@ export function createResolveSpec(ctx) {
             const isolatedExecEnv = isIsolatedExecEnv(config.remoteExec?.provider, config.remoteExec?.provider === "k8s" ? config.remoteExec.runtimeClass : undefined);
             const decision = routeServiceTask({
                 isolatedExecEnv,
-                hasExecutionEnv: executionLaneCaps(executionLaneOf(config.remoteExec?.provider)).coreRemoteExecutionEnv === "supported",
+                hasExecutionEnv: laneWiresExecutionEnv(executionLaneOf(config.remoteExec?.provider)),
                 ...(config.autonomy ? { autonomy: config.autonomy } : {}),
             });
             logger.info("orchestration_routed", { mode: decision.mode, reason: decision.reason, sessionId: auth?.sessionId ?? null });