@sema-agent/server 7.133.0 → 7.134.0

package/deploy/sema-up/chart/templates/_helpers.tpl

@@ -0,0 +1,129 @@
+{{- /*
+  sealedKey 持久块的助手 —— 卷名 / 挂载路径 / 共享 pod 数 / 访问模式 / 耐久审批的渲值,各一处定义,主 worker(server.yaml)与
+  v4pro 变体(server-v4pro.yaml)同调,不各抄一份。
+
+  这是什么:server 的数据根下 `sealed-key/` 目录存两样东西 —— 模型钥匙(web-admin 贴的 `sealedApiKey` 的解封私钥)与停驻任务续跑上下文里
+  请求凭据的封签钥匙(子目录 `checkpoint-ctx-keys/`)。私钥只在这个目录里(不进库),所以它要**跨重启持久**、**每个副本是同一份**:
+  不持久 ⇒ 每次重启换钥匙,重启前停驻、带请求凭据的任务续跑恒 409 conflict.checkpoint_ctx_unsealable(reason key_not_held);
+  多副本各一份 ⇒ A 副本停驻的任务在 B 副本上同一个结局。
+
+  路径:镜像以 root 跑、本图表不设 LOCAL_DATA_ROOT / CONFIG_LOCAL_DIR / AGENT_DATA_DIR ⇒ 数据根是缺省 ~/.ai-agent = /root/.ai-agent。
+  给部署另设了数据根变量的人:挂载路径要跟着移(本图表不替部署设这几个变量)。
+*/ -}}
+
+{{- /* 卷 / PVC 的名字。 */ -}}
+{{- define "sema.sealedKey.claimName" -}}sema-server-sealed-key{{- end -}}
+
+{{- /* 容器内挂载点 = <数据根>/sealed-key(整个目录:模型钥匙 + checkpoint-ctx-keys/ 同一卷)。 */ -}}
+{{- define "sema.sealedKey.mountPath" -}}/root/.ai-agent/sealed-key{{- end -}}
+
+{{- /*
+  持久开关,且**只收布尔**:`--set-string ...enabled=false` / values 里带引号的 "false" 是字符串,模板里字符串恒为真 ⇒ 会静默保持持久开,
+  与写的人的意思相反,所以非布尔渲染即拒。输出 "true" / "false"。
+*/ -}}
+{{- define "sema.sealedKey.enabled" -}}
+{{- $v := .Values.sealedKey.persistence.enabled -}}
+{{- if not (kindIs "bool" $v) -}}
+{{- fail (printf "sealedKey.persistence.enabled must be a boolean (true or false), got %s %q — a string such as \"false\" is truthy in a template and would silently keep the volume on" (kindOf $v) (toString $v)) -}}
+{{- end -}}
+{{- $v -}}
+{{- end -}}
+
+{{- /* 一只 Deployment 的副本数:缺省(null,k8s 按 1 只起)不当 0 只数;其余按整数。 */ -}}
+{{- define "sema.sealedKey.replicasOf" -}}
+{{- if kindIs "invalid" . -}}1{{- else -}}{{- int . -}}{{- end -}}
+{{- end -}}
+
+{{- /* 共享这只卷的 pod 数:主 worker 的副本数 + 启用的 v4pro 变体的副本数(两者读同一个库里的停驻行,所以挂同一只卷)。 */ -}}
+{{- define "sema.sealedKey.podCount" -}}
+{{- $n := int (include "sema.sealedKey.replicasOf" .Values.server.replicas) -}}
+{{- if .Values.serverV4pro.enabled -}}
+{{- $n = add $n (int (include "sema.sealedKey.replicasOf" .Values.serverV4pro.replicas)) -}}
+{{- end -}}
+{{- $n -}}
+{{- end -}}
+
+{{- /*
+  访问模式:`sealedKey.persistence.accessMode` 留空 = 随共享 pod 数派生(一只 ReadWriteOnce,多只 ReadWriteMany —— 要集群的存储类支持 RWX,见 values.yaml sealedKey 块);
+  写了 ReadWriteOnce / ReadWriteMany = 显式盖。显式盖的用处:单节点、多副本 —— 所有 pod 在同一个节点上,RWO 就够,不必为它给节点装 NFS 客户端;
+  盖成 RWO 而 pod 其实会落在不同节点是写的人的前提(新 Pod 会卡在「卷被别的节点挂着」)。其它词渲染即拒。
+*/ -}}
+{{- define "sema.sealedKey.accessMode" -}}
+{{- $raw := .Values.sealedKey.persistence.accessMode -}}
+{{- $m := "" -}}
+{{- if not (kindIs "invalid" $raw) -}}
+{{- $m = toString $raw -}}
+{{- end -}}
+{{- if not (has $m (list "" "ReadWriteOnce" "ReadWriteMany")) -}}
+{{- fail (printf "sealedKey.persistence.accessMode must be empty (derive from the number of pods sharing the volume), \"ReadWriteOnce\" or \"ReadWriteMany\", got %q" $m) -}}
+{{- end -}}
+{{- if ne $m "" -}}
+{{- $m -}}
+{{- else if gt (int (include "sema.sealedKey.podCount" .)) 1 -}}
+ReadWriteMany
+{{- else -}}
+ReadWriteOnce
+{{- end -}}
+{{- end -}}
+
+{{- /*
+  Deployment 的更新策略:有效访问模式是 ReadWriteOnce ⇒ `Recreate`(`nindent 2` 接在 `replicas:` 之后)。RWO 卷同时只能被一个节点挂,默认的滚动更新先起新 Pod、
+  旧 Pod 要等新 Pod 就绪才放卷 —— 新 Pod 落在别的节点就永远等不到卷。代价:升级窗口内这一只 Deployment 短暂没有副本(只有一只 pod 的形本来就没有别的副本可接)。
+  RWX 与持久关闭不碰策略。
+*/ -}}
+{{- define "sema.sealedKey.strategy" -}}
+{{- /* 访问模式先取(取值即校验):持久关闭时写了非闭集词也拒,「其它词渲染即拒」不看开关。 */ -}}
+{{- $mode := include "sema.sealedKey.accessMode" . -}}
+{{- if and (eq (include "sema.sealedKey.enabled" .) "true") (eq $mode "ReadWriteOnce") -}}
+strategy: { type: Recreate }
+{{- end -}}
+{{- end -}}
+
+{{- /*
+  `server.durableApproval`(耐久审批,env DURABLE_APPROVAL)渲给 worker 的值:"" = 不渲(开关归引擎按姿态定),"true" / "false" = 显式。
+  布尔与字符串写法同义;其它词渲染即拒。持久被关(sealedKey.persistence.enabled=false)⇒ 固定 "false" —— 钥匙跨不过重启,耐久审批铸出来的停驻行
+  就是续不了的行,所以图表替部署**显式**关掉它(不是靠引擎的缺省碰巧关);同一份 values 又把它点名成 true ⇒ 渲染即拒,两个键各说各的就是矛盾。
+  `kindIs "invalid"` 判 nil(`--set server.durableApproval=null` 删键):不能用 `default ""` —— 布尔 false 在 `default` 里算空,会把显式 false 吞成「没表态」。
+*/ -}}
+{{- define "sema.durableApproval" -}}
+{{- $raw := .Values.server.durableApproval -}}
+{{- $want := "" -}}
+{{- if not (kindIs "invalid" $raw) -}}
+{{- $want = lower (trim (toString $raw)) -}}
+{{- end -}}
+{{- if not (has $want (list "" "true" "false")) -}}
+{{- fail (printf "server.durableApproval must be \"true\", \"false\" or empty (empty = the engine decides by posture), got %q" $want) -}}
+{{- end -}}
+{{- if eq (include "sema.sealedKey.enabled" .) "true" -}}
+{{- $want -}}
+{{- else -}}
+{{- if eq $want "true" -}}
+{{- fail "server.durableApproval=true cannot be combined with sealedKey.persistence.enabled=false: durable approvals park tasks whose request credentials are sealed under keys kept in the sealed-key volume, and without that volume every restart replaces the keys so no parked task could resume. Keep sealedKey.persistence.enabled=true (the default), or drop server.durableApproval (with persistence off the chart sets DURABLE_APPROVAL=false itself)" -}}
+{{- end -}}
+false
+{{- end -}}
+{{- end -}}
+
+{{- /* worker 容器 env 里的耐久审批一条(`nindent 12` 之后接在 env 列表里);值为空 ⇒ 什么都不出。 */ -}}
+{{- define "sema.sealedKey.env" -}}
+{{- with (include "sema.durableApproval" .) -}}
+- { name: DURABLE_APPROVAL, value: {{ . | quote }} }
+{{- end -}}
+{{- end -}}
+
+{{- /* worker 容器的 volumeMounts 块(`nindent 10`);持久关 ⇒ 什么都不出。 */ -}}
+{{- define "sema.sealedKey.volumeMounts" -}}
+{{- if eq (include "sema.sealedKey.enabled" .) "true" -}}
+volumeMounts:
+  - { name: sealed-key, mountPath: {{ include "sema.sealedKey.mountPath" . | quote }} }
+{{- end -}}
+{{- end -}}
+
+{{- /* Pod 的 volumes 块(`nindent 6`);持久关 ⇒ 什么都不出。 */ -}}
+{{- define "sema.sealedKey.volumes" -}}
+{{- if eq (include "sema.sealedKey.enabled" .) "true" -}}
+volumes:
+  - name: sealed-key
+    persistentVolumeClaim: { claimName: {{ include "sema.sealedKey.claimName" . }} }
+{{- end -}}
+{{- end -}}

package/deploy/sema-up/chart/templates/sealed-key.yaml

@@ -0,0 +1,24 @@
+# ── 停驻封签钥匙的持久卷(sealedKey.persistence.enabled,缺省开)──────────────────────────
+#    server 的 <数据根>/sealed-key/ 整个目录(模型钥匙 + 子目录 checkpoint-ctx-keys/ 的停驻行封签钥匙)挂这一只 PVC,
+#    主 worker 与启用的 v4pro 变体共用。私钥只在这里(不进库):卷丢了,封在停驻行里的请求凭据就开不开。
+#    访问模式随共享这只卷的 pod 数(助手 sema.sealedKey.accessMode):一只 ReadWriteOnce,多只 ReadWriteMany(要集群的存储类支持 RWX)。
+#    ⚠ PVC 的 accessModes 建好后不可改:副本数跨过 1 的边界(1 ⇄ 多)会让升级撞「spec is immutable」—— 响亮,不静默;见 values.yaml sealedKey 块。
+#    有效访问模式是 ReadWriteOnce 时 server / v4pro 两只 Deployment 用 Recreate(助手 sema.sealedKey.strategy)。
+{{- if eq (include "sema.sealedKey.enabled" .) "true" }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "sema.sealedKey.claimName" . }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    # 卷里是私钥:丢了,库里停驻行的请求凭据就开不开。`helm uninstall` 与「关持久」的 upgrade 都不顺手删它(确认不要了再 kubectl delete pvc)。
+    helm.sh/resource-policy: keep
+spec:
+  accessModes: [{{ include "sema.sealedKey.accessMode" . }}]
+{{- if .Values.sealedKey.persistence.storageClass }}
+  storageClassName: {{ .Values.sealedKey.persistence.storageClass | quote }}
+{{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.sealedKey.persistence.size | quote }}
+{{- end }}

package/deploy/sema-up/chart/templates/server-v4pro.yaml

@@ -11,6 +11,9 @@ metadata:
   labels: { app: sema-server-v4pro }
 spec:
   replicas: {{ .Values.serverV4pro.replicas }}
+{{- with (include "sema.sealedKey.strategy" .) }}
+{{ . | indent 2 }}
+{{- end }}
   selector:
     matchLabels: { app: sema-server-v4pro }
   template:
@@ -75,10 +78,21 @@ spec:
             - { name: K8S_SANDBOX_IMAGE, value: {{ .Values.sandbox.image | quote }} }
             - { name: K8S_SANDBOX_IPV6, value: {{ .Values.sandbox.ipv6 | quote }} }
             - { name: K8S_TOKEN, valueFrom: { secretKeyRef: { name: sema-runner-token-copy, key: token } } }
+{{- /* 耐久审批的显式表态与停驻封签钥匙卷同源(助手 sema.durableApproval / sema.sealedKey.*,见 _helpers.tpl):关持久 ⇒ 显式 false;留空 ⇒ 不渲。 */}}
+{{- with (include "sema.sealedKey.env" .) }}
+{{ . | indent 12 }}
+{{- end }}
           readinessProbe:  # the only probe path is /readyz (/health is diagnostic, always 200)
             httpGet: { path: /readyz, port: 8090 }
             initialDelaySeconds: 5
             periodSeconds: 5
+{{- /* <数据根>/sealed-key 的持久卷(整个目录:模型钥匙 + 停驻封签钥匙);关持久时两块都不出。 */}}
+{{- with (include "sema.sealedKey.volumeMounts" .) }}
+{{ . | indent 10 }}
+{{- end }}
+{{- with (include "sema.sealedKey.volumes" .) }}
+{{ . | indent 6 }}
+{{- end }}
 ---
 apiVersion: v1
 kind: Service

package/deploy/sema-up/chart/templates/server.yaml

@@ -16,6 +16,9 @@ metadata:
   namespace: {{ .Release.Namespace }}
 spec:
   replicas: {{ .Values.server.replicas }}
+{{- with (include "sema.sealedKey.strategy" .) }}
+{{ . | indent 2 }}
+{{- end }}
   selector:
     matchLabels: { app: sema-server }
   template:
@@ -88,10 +91,21 @@ spec:
             - { name: K8S_SANDBOX_IMAGE, value: {{ .Values.sandbox.image | quote }} }
             - { name: K8S_SANDBOX_IPV6, value: {{ .Values.sandbox.ipv6 | quote }} }
             - { name: K8S_TOKEN, valueFrom: { secretKeyRef: { name: sema-runner-token-copy, key: token } } }
+{{- /* 耐久审批的显式表态与停驻封签钥匙卷同源(助手 sema.durableApproval / sema.sealedKey.*,见 _helpers.tpl):关持久 ⇒ 显式 false;留空 ⇒ 不渲。 */}}
+{{- with (include "sema.sealedKey.env" .) }}
+{{ . | indent 12 }}
+{{- end }}
           readinessProbe:  # the only probe path is /readyz (/health is diagnostic, always 200)
             httpGet: { path: /readyz, port: 8090 }
             initialDelaySeconds: 5
             periodSeconds: 5
+{{- /* <数据根>/sealed-key 的持久卷(整个目录:模型钥匙 + 停驻封签钥匙);关持久时两块都不出。 */}}
+{{- with (include "sema.sealedKey.volumeMounts" .) }}
+{{ . | indent 10 }}
+{{- end }}
+{{- with (include "sema.sealedKey.volumes" .) }}
+{{ . | indent 6 }}
+{{- end }}
 ---
 apiVersion: v1
 kind: Service

package/deploy/sema-up/chart/values-full-single.yaml

@@ -1,5 +1,5 @@
 # full-single(单节点 k3s dev/测试)覆盖:1 实例 PG、preferred 反亲和(required 在单机=永久
-# Pending——真踩)、2 副本 server。用法:
+# Pending——真踩)、2 副本 server(钥匙卷 RWO,见文末)。用法:
 #   helm upgrade --install sema-stack ./chart -n sema --create-namespace \
 #     -f chart/values-full-single.yaml --set server.image=… --set …(凭据)
 pg:
@@ -7,3 +7,7 @@ pg:
   antiAffinity: preferred
 server:
   replicas: 2
+# 钥匙卷:单节点上的 2 个副本在同一个节点,ReadWriteOnce 的卷同节点可共用 —— 不必为它给节点装 NFS 客户端(缺省的 ReadWriteMany 要 RWX 存储类)。
+sealedKey:
+  persistence:
+    accessMode: ReadWriteOnce

package/deploy/sema-up/chart/values.yaml

@@ -49,6 +49,10 @@ server:
   modelApiKey: ""          # REQUIRED
   modelVision: "false"
   requirePrincipal: "false"   # users=multi 时 true(身份隔离;compose 路径同名 env)
+  # 耐久审批(env DURABLE_APPROVAL;停驻 / 续跑 / /v1/approvals 整条路由)。留空 = 图表不渲这个 env,开关归引擎按姿态定
+  # (单用户 + 有耐久店 ⇒ 开;requirePrincipal=true 的多用户形 ⇒ 关);"true" / "false" = 显式表态,原样渲给每只 worker。
+  # sealedKey.persistence.enabled=false 时图表固定渲 "false"(钥匙跨不过重启,停驻行就续不了);此处再写 "true" ⇒ 渲染即拒。
+  durableApproval: ""
   # region=global 时置 "global"(B5 env-first);cn 留空 = 域内默认
   sandboxPkgSource: ""
   # k8s exec lane 的 TLS 姿势:true=渲染 K8S_INSECURE_TLS=true(chart 0.1.0 as-built);
@@ -66,6 +70,36 @@ server:
   s3PublicBucket: ""
   sendUserFileSandboxPutEndpoint: ""
 
+# 停驻封签钥匙的持久卷:server 的 <数据根>/sealed-key/ 整个目录挂一只 PVC(缺省开)。
+#   为什么:耐久审批(单用户 + 有耐久店时引擎缺省就开)停驻的任务,续跑上下文里请求自带的凭据只以封签落盘,封签的私钥只在这个目录里
+#   (子目录 checkpoint-ctx-keys/;同目录还有模型钥匙)——钥匙不进库。目录不持久 ⇒ 每次重启换一把钥匙;多副本各一份 ⇒ 换副本就换了钥匙。
+#   两种结局相同:重启 / 换副本之前停驻、带请求凭据的任务续跑恒答 409 conflict.checkpoint_ctx_unsealable(reason key_not_held),只能作为新任务重提。
+#   挂在哪:容器内 /root/.ai-agent/sealed-key(镜像以 root 跑、本图表不设数据根变量 ⇒ 数据根是缺省 /root/.ai-agent)。
+#   主 worker 与启用的 serverV4pro 变体共用同一只 PVC(它们读同一个库里的停驻行)。
+#   访问模式缺省随共享这只卷的 pod 数(server.replicas + 启用的 serverV4pro.replicas):1 只 ⇒ ReadWriteOnce;多只 ⇒ ReadWriteMany;`accessMode` 可显式盖(见下)。
+#   有效访问模式是 ReadWriteOnce 时,server / serverV4pro 两只 Deployment 用 Recreate 更新策略(RWO 卷同时只能被一个节点挂,滚动更新的新 Pod 落在别的节点就永远等不到卷;
+#   代价:升级窗口内这一只 Deployment 短暂没有副本)。
+#   ⚠ ReadWriteMany 要集群的存储类支持 RWX(Longhorn 的 RWX 走 NFS 共享管理器,每个节点要装 NFS 客户端 —— cluster-up.sh 不替你装;NFS / CephFS 类存储本就支持;
+#   local-path 与多数云盘类不支持,PVC 会一直 Pending、server Pod 起不来)。没有 RWX 的集群出路有三:server.replicas=1(RWO 即可);
+#   单节点多副本(所有 pod 在同一个节点)显式 accessMode: ReadWriteOnce(随包的 values-full-single.yaml 就是这么写的);或关掉持久(下面 enabled: false,耐久审批随之关 —— 代价见下)。
+#   ⚠ PVC 的 accessModes 建好后不可改:副本数跨过 1 的边界(1 ⇄ 多;启用 v4pro 也算一只)时 helm upgrade 会撞 PVC「spec is immutable」—— 响亮失败,不静默;
+#   这只卷里是私钥,不要为了过这个错直接删 PVC:先把停驻行结掉(随包排空检查脚本数一数)或备份钥匙文件,再换卷。
+#   PVC 带 helm.sh/resource-policy: keep:`helm uninstall` 与把 enabled 改成 false 的 upgrade 都不删它(钥匙留着;确认不要了再 `kubectl -n <ns> delete pvc sema-server-sealed-key`);
+#   同名 release 重装会接管这只留下的 PVC。
+#   ⚠ 空卷上多副本并发首启:每个副本看到空目录各自生成一把钥匙,各副本只持有自己那一把,直到下次重启 —— 首装后 `kubectl -n <ns> rollout restart deploy/sema-server`
+#   一次(启用 serverV4pro 时再加 deploy/sema-server-v4pro;NOTES 也说这句),重启之后每个副本读到目录里的全部钥匙,从此一致。
+sealedKey:
+  persistence:
+    # true(缺省)= 建 PVC 并挂到上面的路径。
+    # false = 不建卷、不挂载,图表**显式**给每只 worker 设 DURABLE_APPROVAL=false(不产生续不了的停驻行;NOTES 也打印这一句);
+    #   此时 server.durableApproval 再写 "true" ⇒ 渲染即拒。代价:耐久审批整条关(审批卡停驻 / 续跑、/v1/approvals 路由、/v1/capabilities 的 approvals 位);
+    #   web-admin 贴的模型钥匙 sealedApiKey 的私钥也跨不过重启(重启后那些条目答 stale_ciphertext,要对着新公钥重封)。
+    #   只收布尔:字符串 "false" 在模板里恒为真,会静默保持开着,所以渲染即拒。
+    enabled: true
+    size: 64Mi         # 只放几个几百字节的钥匙文件;留余量给文件系统开销
+    storageClass: ""   # 空 = 集群默认 SC;访问模式是 ReadWriteMany 时要点名一个支持它的类
+    accessMode: ""     # 空 = 随共享 pod 数派生(1 只 RWO,多只 RWX);"ReadWriteOnce" / "ReadWriteMany" = 显式盖,其它词渲染即拒
+
 # v4-pro 变体 worker(2026-07-11 手工 kubectl 资源收编进 chart;同镜像/同 env 面,仅 MODEL_ID 不同;
 # 公网入口=Gcore LB listener 8091 → nodePort,LB 面不归 chart 管)
 serverV4pro:

package/dist/approval-ask-audit-store.d.ts

@@ -23,7 +23,7 @@
  *  - **不翻 `streamApproval` 能力位**([ref] 当时的裁 (c);⚠️ **这一位已由 S-384 翻真,不是被本店翻的**):
  *    当年不翻的理由是「该位在 SQL 车道隐含 durable park 兜底,local 给不了」+「local 的 ask 账是进程内
  *    易失形」。后半条已由 `FileApprovalAskStore` 消掉(持久账落地);前半条的答案一直在谓词里 ——
- *    `resolveStreamApprovalGate` 的 `parkFacility` 合取项要求 `backend.checkpoint` 在场 ∧ `DURABLE_APPROVAL`,
+ *    `resolveStreamApprovalGate` 的 park 设施(`checkpointStore`)合取项要求 `backend.checkpoint` 在场 ∧ `DURABLE_APPROVAL`,
  *    所以位报 true 的 local 部署**必然**配齐了 File 形 checkpoint 店(`durable-approval-local-e2e` 第一格
  *    实证:park 行跨双 kill 存活、重启后 decide 驱动 resume 真跑完)。本店与那一位自此无关:它治的是
  *    **活卡窗内崩溃**(park 还没落盘)那一格的零痕迹病,而那一格无论位真位假都不复活 run。

package/dist/approval-card.d.ts

@@ -717,8 +717,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
     }, z.core.$strict>>;
-    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
     fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
     sourceTaskId: z.ZodOptional<z.ZodString>;
     sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -855,8 +855,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
         }, z.core.$strict>>;
-        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
         fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
         sourceTaskId: z.ZodOptional<z.ZodString>;
         sourceAgentName: z.ZodOptional<z.ZodString>;

package/dist/approval-card.js

@@ -1,10 +1,9 @@
 import { z } from "zod";
-import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, BOUND_GRANT_ABSENCES, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, RESUME_STARTUP_CAUSES, RULE_OFFERS_ABSENCES, STEER_REPLAY_FACETS, isAskClass, isAskOrigin, isAutoModeFallbackCause, isMintableProbeReason, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
+import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, BOUND_GRANT_ABSENCES, MAX_RULE_TEXT_CHARS, PERSISTED_RULE_MATCHES, UNCOVERED_SEGMENT_REASONS, READ_ROOT_CANDIDATE_DIR_MAX, RESUME_STARTUP_CAUSES, RULE_OFFERS_ABSENCES, STEER_REPLAY_FACETS, isAskClass, isAskOrigin, isAutoModeFallbackCause, isMintableProbeReason, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
 import { redactSecrets } from "./trace/redact.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { capText } from "./caller-text-echo.js";
 import { retireParkArmWords, retireStoredCardWords } from "./retired-card-words.js";
-import { PERSISTED_RULE_MATCHES, UNCOVERED_SEGMENT_REASONS } from "./permission-rule-vocab.js";
 export const MAX_AGENT_NAME = 200;
 const MAX_IDENT = 200;
 export const MAX_RULE_OFFERS = 4;

package/dist/approval-content-kind.d.ts

@@ -32,8 +32,11 @@ export interface ParkedGateFace {
     readonly approvalCard?: unknown;
 }
 /**
- * 停驻行的卡 = core `summarizeCheckpoint` 投给 `CheckpointSummary.approvalCard` 的那一个词:只在审批门(门型的寄存臂是
- * `tool_approval`,读 core `PAUSE_REGISTRY`)上读,词经 {@link readApprovalCard}。非审批门(计划审阅 / 资源 / 收尾)恒无卡。
+ * 停驻行的卡 —— 读法只有引擎那一只:core 包根导出 `parkedApprovalCardOf(gate)`(core 7.54.0 #1468 K2;审批门 = 门型的寄存臂是 `tool_approval`,
+ * 只在那里读卡,只有闭集成员算卡)。四态逐一处置(穷举 `switch`:core 加一态 ⇒ 编译红):`card` ⇒ 那个词;`no_card` / `not_approval` ⇒ 无卡;
+ * `unknown_word`(引擎交回**未经筛**的存储原值)⇒ 无卡 + 响亮:计一次 `server.approval-card.closed-word-out-of-set`(与 {@link readApprovalCard} 同一只计数、
+ * 同一只回显口径 —— 截 40、脱敏,对象只报形名)。修前本函数自己判「是不是审批门」(读 `PAUSE_REGISTRY` 的寄存臂)再交 {@link readApprovalCard},
+ * 与引擎的 `summarizeCheckpoint` 是两份读法。
  */
 export declare function parkedApprovalCard(gate: ParkedGateFace | undefined): ToolApprovalCard | undefined;
 /**

package/dist/approval-content-kind.js

@@ -1,5 +1,5 @@
 export { ASK_USER_QUESTION_TOOL_NAME } from "@sema-agent/core";
-import { PAUSE_REGISTRY, TOOL_APPROVAL_CARDS, facetOf, isGateKind } from "@sema-agent/core";
+import { TOOL_APPROVAL_CARDS, facetOf, isGateKind, parkedApprovalCardOf } from "@sema-agent/core";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { redactSecrets } from "./trace/redact.js";
 export function readApprovalCard(raw) {
@@ -13,9 +13,22 @@ export function readApprovalCard(raw) {
     return undefined;
 }
 export function parkedApprovalCard(gate) {
-    if (gate === undefined || !isGateKind(gate.kind) || PAUSE_REGISTRY[gate.kind].pending !== "tool_approval")
+    if (gate === undefined)
         return undefined;
-    return readApprovalCard(gate.approvalCard);
+    const reading = parkedApprovalCardOf({ kind: gate.kind, approvalCard: gate.approvalCard });
+    switch (reading.kind) {
+        case "card":
+            return reading.card;
+        case "no_card":
+        case "not_approval":
+            return undefined;
+        case "unknown_word":
+            return readApprovalCard(reading.word);
+        default: {
+            const unreachable = reading;
+            throw new Error(`unhandled parked approval card reading: ${JSON.stringify(unreachable)}`);
+        }
+    }
 }
 export function parkedFacetOf(gate) {
     return gate !== undefined && isGateKind(gate.kind) ? facetOf({ kind: gate.kind, approvalCard: gate.approvalCard }) : undefined;

package/dist/approval-gate-currency.d.ts

@@ -0,0 +1,72 @@
+/**
+ * 一张停驻审批卡的「门」此刻还是不是它 —— 应答口判 `approval_stale` 与按问读口 `state` 的**同一只判官**。
+ *
+ * ## 病灶(为什么要有这一只)
+ * 问账行 `PARKED` 是终态(`approval-ask-machine.ts`:`PARKED: []`):赎回腿的单赢者是 **checkpoint 的 CAS**,取消腿动的也是 checkpoint(先 `expire` 门、再驱 run 终局),
+ * 两条腿都不写 ask 行。于是「这张卡的门还在不在」这件事只有 checkpoint 店知道;读口若只看行,就会在卡被答过 / run 被取消之后继续说 `parked` 并指路去决定,
+ * 而应答口对同一张卡早已答 `409 approval_stale`。同一件事两个读法 —— 本模块把它收成一个:读的是同一个问题、同一个来源。
+ *
+ * ## 判官
+ * 问题:**这把 gate token 是不是该会话当前待决的审批门?**(应答口的答法:`resumeCheckpoint` 的 stale 臂 —— 回显的 token ≠ 该会话当前待决的审批门 ⇒ `409 approval_stale`。)
+ *  · {@link currentApprovalGateToken} —— 该会话当前待决的审批门(审批门型优先,没有再退到任一待决行);应答口读它,读口读它,别处不再内联第二份;
+ *  · {@link readGateCurrency} —— 一把 token 对着它的读数:`current` / `absent`(店里没有这一行)/ `settled`(行在,但不再是当前待决门:已结算、已过期、被取代);
+ *  · {@link createParkedGateRead} —— 协调器读口的门读席:把读数译成读口要的四种读法({@link ParkedGateReading}),`state` 闭集不加字。
+ *
+ * ## `settled` 怎么译(读口只说 checkpoint 上有凭据的话;一条规矩)
+ * 落盘的行不受类型面约束(旧版 / 手改 / 坏体 / 更新版本 core 写下的行可带闭集外的词或坏形),所以已结算门只按**一条规矩**读:
+ *  ① 两个闭集词(行的 `status`、结算记录的种类 `settlement.kind`)各查一张穷举表,**同一查法**({@link throughTable}:只认表自己的键,非字符串不进表):
+ *    表明说 `decided` ⇒ 往下读;明说 `void` ⇒ `void`(没有人决过它,答案无处兑现 —— 已过期〔取消 / 收割〕、仍待决却不是当前门〔被取代,应答口答 stale〕、
+ *    结算种类是引擎窗到期 / 宿主 SLA 扫 / 无人可答的失败族);**表外 ⇒ `unknown`**(读不懂的词撑不起「有人决过」,也撑不起「没有人决过它」);
+ *  ② 结算赢家的门记录 `resolvedOutcome.gateOutcome` 先过 core 唯一的门记录筛 `screenGateOutcome`(**档案读法**:读回的耐久行,闭集 = 今日成员 ∪ 已退役词;
+ *    坏形记缺陷、绝不抛;本仓 `trace/project.ts` 投影同一种记录也只经这一只筛),有缺陷 ⇒ `unknown`,过了筛才读它的成员;
+ *  ③ 分类之前记录要**读得全**:有结算记录、时刻(引擎写进赢家的 `settlement.when`)是有限数、赢家绑的是这一行的调用且判词是 allow / deny(与
+ *    `findDecidedApprovalsForBinding` 同一只 {@link approvalDecisionOfWinner})—— 缺一个都是 `unknown`(**不编一个首决**;读口答 404,应答口对已结算的门答 409 `approval_stale`,两口不同判;
+ *    `void` 也要读得全:绑在别的调用上的结算说的不是这张卡);读全了再按**结算种类**表分类:人 / 策略的四个种类 ⇒ `decided`(理由取自赢家的 `reason`),其余十个 ⇒ `void`
+ *    (按种类不按当事方:跨版本稳定的是种类词,变过义的是当事方词 —— 此前版本的策略拒记 `policy_refused` + `who.party:"none"`,此后记 `"policy"`,按当事方查会把那一代合法历史记录读成 `void`);
+ *  ④ 读的只是行的内容、不碰店:内容坏到读的时候抛(行上缺了必填成员)同样是坏行 ⇒ `unknown`,不冒成店故障(读口对店故障退回 `parked`)。
+ * `unknown` 的这一类(`decision_unreadable`)带上读不出的那几处(缺陷句,非空):读口答 404 `tool_approval.not_pending`,并记一行 error(首句 + 计数)。
+ * 行没了 ⇒ `unknown`(`row_absent`;应答口 PARKED 臂的 404 `not_found.approval` 同判)。
+ *
+ * ## 盲区(core 的筛不判的两处,如实写下:一处本判官手判有限数,一处本判官也不核)
+ *  · 结算时刻 `settlement.when`:筛不判,本判官手判「有限数」;而本仓另一个读同一种记录的读者(trace 投影)把 `when` 原样放上 wire —— 同一个坏时刻,两个读者两种答法;
+ *  · 方向与配对:赢家的方向(`resolvedOutcome.decision`)与记录自己的种类 / 处置说的方向是否一致,以及种类 × 当事方的配对 —— 筛不判,本判官也不核:读口以赢家的方向为准、读的是种类。
+ * 只有坏行 / 手改行才走得到这两处。候引擎的筛把时刻、方向与种类 × 当事方配对一并判了,两个读者同时退掉各自的手判(配对今天没有手判可退 —— 它无人判)。
+ */
+import { type Checkpoint, type CheckpointToken, type SettlementKind } from "@sema-agent/core";
+import { type PendingRowBinding } from "./plugins/checkpoint-store-sql.js";
+import { type ParkedGateRead } from "./tool-approval.js";
+/** 判官要的两个店口(三后端同形;窄接口让测试与装配都不必拿整只店)。 */
+export interface GateCurrencyStore {
+    get(token: CheckpointToken): Promise<Checkpoint | null>;
+    findPendingTokenBySession(sessionId: string, scope?: string, binding?: PendingRowBinding): Promise<CheckpointToken | null | undefined>;
+}
+/**
+ * 该会话**当前待决的审批门**的 token:审批门型({@link APPROVAL_GATE_KINDS})优先 —— 同会话 `task_done` 纯 park 与新 run 的审批 park 可以并存(表无 per-session pending 唯一约束),
+ * 无序读会选中别的门型 —— 没有审批门才退到任一待决行(错门型诊断由 `/decide` 的 gate-kind 守卫点名)。应答口的 stale 臂与按问读口读这一只。
+ */
+export declare function currentApprovalGateToken(cs: Pick<GateCurrencyStore, "findPendingTokenBySession">, sessionId: string): Promise<CheckpointToken | null | undefined>;
+/** 一把 gate token 对着判官的读数。 */
+export type GateCurrency = {
+    readonly kind: "current";
+} | {
+    readonly kind: "absent";
+} | {
+    readonly kind: "settled";
+    readonly checkpoint: Checkpoint;
+};
+/** 这把 gate token 是不是它那条会话当前待决的审批门。读不出(店抛错)⇒ 原样上抛,由调用方的故障姿势处置。 */
+export declare function readGateCurrency(cs: GateCurrencyStore, gateToken: string): Promise<GateCurrency>;
+/** 一个闭集词对已结算门的读法类:有人 / 有策略决过(往下读决议),或没有人决过它。 */
+type SettledClass = "decided" | "void";
+/**
+ * 结算种类(core `SETTLEMENT_KINDS`)→ 这次结算算不算「有人 / 有策略决过」。`human_*`(人)与 `policy_*`(部署的策略)四个词是仅有的决议种类;其余十个 ——
+ * 引擎自己的窗到期 · 宿主窗 / 宿主 SLA 扫 · 无人可答的失败族 —— 没有人决过它,不读成「决议:deny」(那会让壳把一次宿主超时清算渲成「被拒绝」)。
+ * 表的键是**种类**不是当事方:种类词跨版本稳定,当事方词变过义(此前版本的策略拒记 `who.party:"none"`),按当事方查会把那一代合法历史记录读错。core 现成的两张种类表
+ * (是不是拒绝 / 有没有人评判过)答的是别的问题:`human_refused` 与 `approval_window_expired` 同是拒绝,这里一个是决议、一个不是,所以不从它们派生。
+ * 表穷举(与上面 `status` 表同形、同一查法):core 给种类闭集加词而不在此表态 ⇒ 编译红。
+ */
+export declare const SETTLEMENT_KIND_READING: Record<SettlementKind, SettledClass>;
+/** 协调器读口的门读席({@link ParkedGateRead}):装配点把 checkpoint 店递进来,协调器本身不认识 checkpoint 的形。 */
+export declare function createParkedGateRead(cs: GateCurrencyStore): ParkedGateRead;
+export {};
+//# sourceMappingURL=approval-gate-currency.d.ts.map

package/dist/approval-gate-currency.js

@@ -0,0 +1,94 @@
+import { screenGateOutcome } from "@sema-agent/core";
+import { approvalDecisionOfWinner } from "./plugins/checkpoint-store-sql.js";
+import { APPROVAL_GATE_KINDS } from "./tool-approval.js";
+export async function currentApprovalGateToken(cs, sessionId) {
+    return (await cs.findPendingTokenBySession(sessionId, undefined, { gateKinds: APPROVAL_GATE_KINDS })) ?? (await cs.findPendingTokenBySession(sessionId));
+}
+export async function readGateCurrency(cs, gateToken) {
+    const first = await cs.get(gateToken);
+    if (first === null)
+        return { kind: "absent" };
+    if (first.status !== "pending")
+        return { kind: "settled", checkpoint: first };
+    const current = await currentApprovalGateToken(cs, first.sessionId);
+    if (current === gateToken)
+        return { kind: "current" };
+    const fresh = await cs.get(gateToken);
+    return fresh === null ? { kind: "absent" } : { kind: "settled", checkpoint: fresh };
+}
+const SETTLED_GATE_READING = { resolved: "decided", expired: "void", pending: "void" };
+export const SETTLEMENT_KIND_READING = {
+    human_allowed: "decided",
+    human_refused: "decided",
+    policy_allowed: "decided",
+    policy_refused: "decided",
+    approval_window_expired: "void",
+    denial_limit_window_expired: "void",
+    park_sla_expired: "void",
+    no_approver: "void",
+    approver_unavailable: "void",
+    approver_error: "void",
+    approver_contract: "void",
+    presentation_failed: "void",
+    blanket_allow_refused: "void",
+    task_aborted: "void",
+};
+function unreadable(defects) {
+    return { kind: "unknown", why: "decision_unreadable", defects };
+}
+function throughTable(table, word, field) {
+    if (typeof word !== "string" || !Object.hasOwn(table, word))
+        return unreadable([`${field} has no reading in this server's table of its closed set`]);
+    return table[word] === "decided" ? "decided" : { kind: "void" };
+}
+function settledReading(checkpoint, gateBoundCallId) {
+    try {
+        return readSettledRow(checkpoint, gateBoundCallId);
+    }
+    catch (e) {
+        return unreadable([`the settled row could not be read (${e instanceof Error ? e.name : "non-Error throw"})`]);
+    }
+}
+function readSettledRow(checkpoint, gateBoundCallId) {
+    const byStatus = throughTable(SETTLED_GATE_READING, checkpoint.status, "checkpoint status");
+    if (byStatus !== "decided")
+        return byStatus;
+    const winner = checkpoint.resolvedOutcome;
+    const recorded = winner?.gateOutcome;
+    const [defect, ...more] = screenGateOutcome(recorded, { reading: "archive" });
+    if (defect !== undefined)
+        return unreadable([defect, ...more]);
+    const settlement = recorded?.settlement;
+    if (settlement === undefined)
+        return unreadable(["the gate record carries no settlement: no decider and no time"]);
+    if (!Number.isFinite(settlement.when))
+        return unreadable(["settlement.when is not a finite epoch-ms time"]);
+    const boundCallId = gateBoundCallId ?? (checkpoint.pendingAction.kind === "tool_approval" ? checkpoint.pendingAction.toolCallId : "");
+    const direction = approvalDecisionOfWinner(winner, boundCallId);
+    if (direction === null)
+        return unreadable([`the resolved winner is not an allow / deny bound to call "${boundCallId}"`]);
+    const byKind = throughTable(SETTLEMENT_KIND_READING, settlement.kind, "settlement.kind");
+    if (byKind !== "decided")
+        return byKind;
+    const note = typeof winner?.reason === "string" && winner.reason !== "" ? winner.reason : undefined;
+    return { kind: "decided", decision: direction === "approve" ? "allow" : "deny", decidedAtMs: settlement.when, ...(note !== undefined ? { decisionNote: note } : {}) };
+}
+export function createParkedGateRead(cs) {
+    return async ({ gateToken, gateBoundCallId }) => {
+        const currency = await readGateCurrency(cs, gateToken);
+        switch (currency.kind) {
+            case "current":
+                return { kind: "open" };
+            case "absent":
+                return { kind: "unknown", why: "row_absent" };
+            case "settled":
+                return settledReading(currency.checkpoint, gateBoundCallId);
+            default: {
+                const unhandled = currency;
+                void unhandled;
+                return { kind: "unknown", why: "row_absent" };
+            }
+        }
+    };
+}
+//# sourceMappingURL=approval-gate-currency.js.map

package/dist/approval.d.ts

@@ -184,6 +184,12 @@ export declare function createDeploymentListExemption(store: Pick<ApprovalExempt
     info(event: string, fields?: Record<string, unknown>): void;
     warn(event: string, fields?: Record<string, unknown>): void;
 }, leg?: "parked_revive"): DeploymentListExemption;
+/**
+ * **每腿自动批额度的审批人名**(本仓闭词;core `AskOutcome.approver` 契约逐字「a closed word the host owns, never a person」)。
+ * 结算记录读 `policy_allowed` / `who.party: "policy"` / `who.approver` = 本词 —— 审计读者按它认出「这一次放行是部署的自动批额度答的」,
+ * 与无人值守腿的 `unattended_class_answer`(`unattended-permission-mode.ts`)同族。
+ */
+export declare const AUTO_APPROVE_BUDGET_APPROVER = "auto_approve_budget";
 /**
  * **请求叶策略:`settings.permissions.neverAuto`**(S-1351)—— 命中名单的工具恒问真人;名单外「本层没有意见」(裸 allow)。叶只管请求自己写的那张表,部署的 `APPROVAL_NEVER_AUTO`
  * 在基线里({@link createDurableAskPolicy}),两者经 `tightenGoverned` 的 deny-wins 折叠取并:请求叶只会**多**问,删不掉基线里的任何一行。