@sema-agent/server 7.133.0 → 7.134.0

package/dist/approval.js

@@ -1,4 +1,4 @@
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "@sema-agent/core";
+import { createApprovalPolicy, isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "@sema-agent/core";
 import { operatorAlwaysHumanAsk, operatorAsk, requestAlwaysHumanAsk } from "./operator-ask.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 import { isExplicitPosture } from "./posture-source.js";
@@ -119,8 +119,17 @@ function createNameSetMatcher(names) {
         return (toolName) => exact.has(toolName);
     return (toolName) => exact.has(toolName) || covering.some((rule) => namespacedRuleNameCovers(rule, toolName));
 }
-function grantedByRule() {
-    return { action: "allow", decisionReason: "rule" };
+export const AUTO_APPROVE_BUDGET_APPROVER = "auto_approve_budget";
+function budgetSeatAnswer(req, requireHit, signal) {
+    let answered = false;
+    const seat = createApprovalPolicy({
+        requireApproval: [requireHit],
+        approve: () => {
+            answered = true;
+            return { allow: true, settledBy: "policy", approver: AUTO_APPROVE_BUDGET_APPROVER };
+        },
+    });
+    return { answered: () => answered, verdict: Promise.resolve(seat.check(req, signal)) };
 }
 export function createRequestNeverAutoPolicy(names, source) {
     const verdictOf = createApprovalListVerdict({ requireApproval: [], neverAuto: names });
@@ -149,7 +158,7 @@ export function createDurableAskPolicy(opts) {
     let autoApproved = 0;
     const isQuestionTool = (name) => name === ASK_USER_QUESTION_TOOL_NAME;
     return {
-        check: (req) => {
+        check: (req, signal) => {
             const verdict = verdictOf(req);
             switch (verdict.list) {
                 case "deny":
@@ -157,7 +166,7 @@ export function createDurableAskPolicy(opts) {
                 case "never_auto":
                     return operatorAlwaysHumanAsk(`APPROVAL_NEVER_AUTO(${verdict.hit})`, `human approval required to run "${req.toolName}"`);
                 case "require":
-                    return decideRequired(req, verdict.hit);
+                    return decideRequired(req, verdict.hit, signal);
                 case "none":
                     return { action: "allow" };
                 default: {
@@ -167,7 +176,7 @@ export function createDurableAskPolicy(opts) {
             }
         },
     };
-    function decideRequired(req, requireHit) {
+    function decideRequired(req, requireHit, signal) {
         const rem = req.budget?.resourceRemainingMicroUsd;
         if (rem !== undefined && rem <= 0) {
             return operatorAlwaysHumanAsk("RESOURCE_SUSPEND budget exhausted", `durable resource budget exhausted — human approval required to run "${req.toolName}"`);
@@ -180,17 +189,25 @@ export function createDurableAskPolicy(opts) {
                     exemption.onExempted(req.toolName);
                     return { action: "allow" };
                 }
-                return budgetOrAsk(req, ask);
+                return budgetOrAsk(req, ask, requireHit, signal);
             })();
         }
-        return budgetOrAsk(req, ask);
+        return budgetOrAsk(req, ask, requireHit, signal);
     }
-    function budgetOrAsk(req, ask) {
-        if (heldRuleName(req, isQuestionTool) === undefined && budget > 0 && autoApproved < budget) {
-            autoApproved++;
-            return grantedByRule();
-        }
-        return ask;
+    function budgetOrAsk(req, ask, requireHit, signal) {
+        if (heldRuleName(req, isQuestionTool) !== undefined || budget <= 0 || autoApproved >= budget)
+            return ask;
+        autoApproved++;
+        const { answered, verdict } = budgetSeatAnswer(req, requireHit, signal);
+        return verdict.then((d) => {
+            if (answered() && d.action === "allow")
+                return d;
+            autoApproved--;
+            return ask;
+        }, (err) => {
+            autoApproved--;
+            throw err;
+        });
     }
 }
 //# sourceMappingURL=approval.js.map

package/dist/boot/coordinators.d.ts

@@ -14,6 +14,7 @@ import { QuestionCoordinator } from "../question.js";
 import { ToolApprovalCoordinator, type ParkedAskRedeem } from "../tool-approval.js";
 import { FileApprovalAskAuditStore } from "../approval-ask-audit-store.js";
 import type { ParkCommitWatch } from "../plugins/park-commit-watch.js";
+import { type GateCurrencyStore } from "../approval-gate-currency.js";
 import { SendUserFileEmitter } from "../capabilities/send-user-file-tool.js";
 import { TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
 import type { StoreBackend } from "../plugins/store-backend.js";
@@ -36,13 +37,17 @@ export interface LiveCoordinatorsCtx {
     /** S-929 F1:checkpoint 店的 park 提交观察层(stage-06 与店同一处铸;在场 ⇔ 有 checkpoint 店)。协调器据它判「有序关停下的 park 路由
      *  提交了没有」—— 审计 settle 行等 park 提交落定才写。缺席 = 没有 park 设施(core 在 ask 回调处就收场,没有提交这一步)。 */
     parkCommits?: ParkCommitWatch;
+    /** S-1915:checkpoint 店(stage-06 的**同一只**,与 `parkCommits` 同源;在场 ⇔ 有 park 设施)。协调器的按问读口据它判一张 `PARKED` 卡的门此刻还是不是该会话当前待决的审批门
+     *  (判官 = `approval-gate-currency.ts`,应答口判 `approval_stale` 读的同一只)。缺席 ⇒ 读口只能说行说的话(`parked`)。
+     *  也是流内审批协议上场门的 park 设施位:在场性与实例是一个事实 —— 门的 `active` 臂交出去的就是这一只,缺席 ⇒ 协议不上场(`no_park_facility`)。 */
+    checkpointStore?: GateCurrencyStore;
 }
 export declare function createLiveCoordinators(ctx: LiveCoordinatorsCtx): {
     elicitation: ElicitationCoordinator | undefined;
     question: QuestionCoordinator | undefined;
     toolApproval: ToolApprovalCoordinator | undefined;
     durableEnabled: boolean;
-    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate;
+    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate<GateCurrencyStore>;
     approvalAskAudit: FileApprovalAskAuditStore | undefined;
     approvalExemptionStore: import("../plugins/approval-exemption-store.js").ApprovalExemptionStore | undefined;
     sendUserFileEmitter: SendUserFileEmitter | undefined;

package/dist/boot/coordinators.js

@@ -3,6 +3,7 @@ import { QuestionCoordinator } from "../question.js";
 import { ToolApprovalCoordinator, resolveStreamApprovalGate } from "../tool-approval.js";
 import { deploymentListAsks } from "../approval.js";
 import { FileApprovalAskAuditStore } from "../approval-ask-audit-store.js";
+import { createParkedGateRead } from "../approval-gate-currency.js";
 import { SendUserFileEmitter, SEND_USER_FILE_MAX_BYTES, sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { createSandboxFileSend, TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
 import { createSendUserFileIssuer } from "../plugins/send-user-file.js";
@@ -11,15 +12,16 @@ import { basename, resolve } from "node:path";
 import { toolsRunOnThisHost } from "../task-cwd.js";
 import { stat as fsStat, readFile as fsReadFile } from "node:fs/promises";
 export function createLiveCoordinators(ctx) {
-    const { config, logger, backend, sendUserFileTaskEnvs, ruleConsent, ruleScopeRootFor, getParkedRedeem, parkCommits } = ctx;
+    const { config, logger, backend, sendUserFileTaskEnvs, ruleConsent, ruleScopeRootFor, getParkedRedeem, parkCommits, checkpointStore } = ctx;
     const elicitation = config.mcpElicitation.enabled ? new ElicitationCoordinator(config.mcpElicitation.throttle) : undefined;
     const question = config.askQuestionEnabled ? new QuestionCoordinator(config.questionThrottle) : undefined;
-    const durableEnabled = backend?.checkpoint !== undefined && config.durableApproval === true;
+    const parkStore = checkpointStore;
+    const durableEnabled = parkStore !== undefined;
     const streamApprovalGate = resolveStreamApprovalGate({
         toolApprovalEnabled: config.toolApprovalEnabled === true,
         streamApprovalEnabled: config.streamApproval.enabled,
         backend,
-        parkFacility: durableEnabled,
+        checkpointStore: parkStore,
     });
     if (config.streamApproval.enabled && !streamApprovalGate.active) {
         logger.info("stream_approval_disabled", {
@@ -58,6 +60,7 @@ export function createLiveCoordinators(ctx) {
             ...(ruleScopeRootFor !== undefined ? { ruleScopeRootFor } : {}),
             unattendedPolicy: config.unattendedApprovalPolicy,
             ...(getParkedRedeem !== undefined ? { parkedRedeem: getParkedRedeem } : {}),
+            ...(checkpointStore !== undefined ? { parkedGate: createParkedGateRead(checkpointStore) } : {}),
             ...(approvalAskAudit !== undefined ? { askAudit: approvalAskAudit } : {}),
             ...(approvalExemptionStore !== undefined
                 ? { sessionGrants: approvalExemptionStore, deploymentListAsks: (call) => deploymentListAsks(config, call) }

package/dist/boot/leader.d.ts

@@ -23,6 +23,8 @@ export interface LeaderCtx {
     toolResultStore: ToolResultStoreFull | undefined;
     sessionStore: ReturnType<typeof createSessionStore>;
     checkpointStore: CheckpointStoreFull | undefined;
+    /** S-1907:停驻行凭据的封签器(与 HTTP 面 `ServiceDeps.checkpointCtxSealing` 同一只;起服第 6 段已对「店在、它不在」拒启)。必填键,值可为 undefined。 */
+    checkpointCtxSealing: import("../http/checkpoint-ctx.js").CheckpointCtxSealing | undefined;
     /** [ref] 件B/C/D([ref],codex R2-F1):部署治理三座席 —— leader 车道的每一只 Runner 都要带上它,
      *  否则开了 leader 端点的部署就有一条在部署治理**之外**的执行面(合规否决/锁都够不着)。 */
     governanceSeams: import("./governance-seams.js").GovernanceSeams;

package/dist/boot/leader.js

@@ -22,7 +22,7 @@ export function assertLeaderDurableStore(leaderEnabled, hasLeaderRunStore) {
         "(#193 车4 件2 capability gate; the DB_BACKEND literal check in config.ts is the intent half of the same rule)");
 }
 export function createLeaderFace(ctx) {
-    const { config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, governanceSeams } = ctx;
+    const { config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, checkpointCtxSealing, governanceSeams } = ctx;
     const leaderMinio = process.env.MINIO_ENDPOINT && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
         ? {
             s3: {
@@ -74,6 +74,7 @@ export function createLeaderFace(ctx) {
                     durable: () => hasApprovalListIntent(config)
                         ? {
                             checkpointStore,
+                            ctxSealer: checkpointCtxSealing,
                             requireApproval: config.approvalRequire,
                             deny: config.approvalDeny,
                             autoBudget: config.approvalAutoBudget,

package/dist/boot/read-deny-anchor-audit.js

@@ -1,9 +1,9 @@
-import { compileReadDeny, readDenyPatternRun } from "@sema-agent/core";
+import { compileReadDeny, readDenyRowAnchor } from "@sema-agent/core";
 import { echoCallerText } from "../caller-text-echo.js";
 export const READ_DENY_AUDIT_MAX_NAMED_ROWS = 20;
 const NAMED_ROW_ECHO_CHARS = 200;
 function isAnchoredCanonicalRow(canonical) {
-    return readDenyPatternRun(canonical).homeAnchored || canonical.startsWith("/");
+    return readDenyRowAnchor(canonical) !== "none";
 }
 export function auditReadDenyAnchoring(ctx) {
     if (ctx.rows === undefined || ctx.rows.length === 0)

package/dist/boot/runner-deps.d.ts

@@ -9,7 +9,7 @@
  * `Runner.swapDeps` 换进,见 boot/stage-08-reapers.ts)。
  * `getRunStore()` 是唯一的晚绑取值(runStore 在本段之后才构造),原文靠同作用域前向引用。
  */
-import { type CacheBreakFinding, type RunnerDeps, type WorkflowRunStore, type AskOutcome } from "@sema-agent/core";
+import { type CacheBreakFinding, type CrossBoundaryPosture, type RunnerDeps, type WorkflowRunStore, type AskOutcome } from "@sema-agent/core";
 import type { createBrain } from "../brain.js";
 import type { buildPricing, createTracer } from "../budget.js";
 import type { ServiceConfig } from "../config.js";
@@ -241,7 +241,7 @@ export interface RunnerDepsCtx {
 }
 /** [ref] A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "crossBoundaryPosture" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
 /**
  * [ref] A10 留档发现②(review 2026-07-29,[ref]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -316,10 +316,23 @@ export declare function createEngineNoticeSeat(logger: {
  * 「键为 undefined」与「键缺席」对引擎逐字等价)。**不复制引擎缺省**(`roots`/`static-face`/`carry`/`open`/
  * CC parity 20/200 一个都不抄):上游改缺省之日起本仓不会成为第二份真源。
  */
-export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "allowedTools" | "agentConfigDir">;
+export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "allowedTools" | "agentConfigDir" | "crossBoundaryPosture">;
 /** 本族读的配置切面:席名与 config 键同名的那几席 + 运维 allow 表(席 `allowedTools` ← config `approvalGrant`,env 名 `APPROVAL_GRANT` 不改)
- *  + LKG 覆写路径(`readDenyPatterns` 席并入它派生的读拒行,`lkgReadDenyRows`)。 */
-export type DeploymentPostureConfig = Pick<ServiceConfig, Exclude<keyof DeploymentPostureSeats, "allowedTools"> | "approvalGrant" | "configLkgPath">;
+ *  + LKG 覆写路径(`readDenyPatterns` 席并入它派生的读拒行,`lkgReadDenyRows`)+ 主体门(席 `crossBoundaryPosture` ← config `requirePrincipal`)。 */
+export type DeploymentPostureConfig = Pick<ServiceConfig, Exclude<keyof DeploymentPostureSeats, "allowedTools" | "crossBoundaryPosture"> | "approvalGrant" | "configLkgPath" | "requirePrincipal">;
+/**
+ * 设备车道发射闸的**部署姿态**(core 7.54.0 [ref] O9b:`RunnerDeps.crossBoundaryPosture`)—— 由主体门派生,不是第二根旋钮:
+ * `REQUIRE_PRINCIPAL=true`(每个请求带一个经认证的主体 = 多个租户共用这台 worker)⇒ `"multi_tenant"`;否则 ⇒ `"single_user"`。
+ * 映射是一张以 core 闭集为键的表 {@link CROSS_BOUNDARY_POSTURE_REQUIRES_PRINCIPAL}(`satisfies Record<CrossBoundaryPosture, boolean>`):core 给姿态加第三个词 ⇒ 表缺键、编译红,
+ * 由人判它对应哪种部署 —— 不会被一个 `? :` 静默吞掉。
+ * 律:**每一台 worker 显式声明、同一舰队同值**(主体门本就是舰队级配置)—— 缺席时 core 对宿主父腿不启站,并在每条武装腿铸 operator 通告
+ * `config.cross_boundary_posture_undeclared`;本仓因此从不留空。取值点只有 {@link buildDeploymentPostureSeats} 一处。
+ */
+export declare const CROSS_BOUNDARY_POSTURE_REQUIRES_PRINCIPAL: {
+    readonly multi_tenant: true;
+    readonly single_user: false;
+};
+export declare function crossBoundaryPostureOf(requirePrincipal: boolean): CrossBoundaryPosture;
 export declare function buildDeploymentPostureSeats(config: DeploymentPostureConfig): DeploymentPostureSeats;
 /**
  * 部署读拒行**进场**的唯一告知点(非锚定行一行 `read_deny_unanchored_rows`;判据与行形在 `read-deny-anchor-audit.ts`)。律:**一份读拒行的值第一次装进 Runner 席时点名一次** ——

package/dist/boot/runner-deps.js

@@ -58,6 +58,14 @@ export function createEngineNoticeSeat(logger, router = defaultEngineNoticeRoute
     const warn = logger?.warn?.bind(logger);
     return warn ? { onNotice: createEngineNoticeForwarder({ warn }, router) } : {};
 }
+export const CROSS_BOUNDARY_POSTURE_REQUIRES_PRINCIPAL = { multi_tenant: true, single_user: false };
+export function crossBoundaryPostureOf(requirePrincipal) {
+    for (const w of Object.keys(CROSS_BOUNDARY_POSTURE_REQUIRES_PRINCIPAL)) {
+        if (CROSS_BOUNDARY_POSTURE_REQUIRES_PRINCIPAL[w] === requirePrincipal)
+            return w;
+    }
+    throw new Error(`cross-boundary posture table has no word for requirePrincipal=${requirePrincipal} (the table must map both values)`);
+}
 export function buildDeploymentPostureSeats(config) {
     const crossSessionLayers = buildCrossSessionInboundLayers(config);
     const lkgRows = lkgReadDenyRows(config.configLkgPath);
@@ -76,6 +84,7 @@ export function buildDeploymentPostureSeats(config) {
         crossSessionDialogExpiry: crossSessionDialogExpiryOf(config),
         writeProtectedPaths: config.writeProtectedPaths?.entries,
         allowedTools: config.approvalGrant.length > 0 ? config.approvalGrant : undefined,
+        crossBoundaryPosture: crossBoundaryPostureOf(config.requirePrincipal),
     };
     return seats;
 }

package/dist/boot/stage-06-runners.d.ts

@@ -9,11 +9,12 @@
 import { Runner } from "@sema-agent/core";
 import { ForkRoutingSessionStore } from "../plugins/fork-routing-session-store.js";
 import type { runStage05 } from "./stage-05-execution-env.js";
-export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>): {
+export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>): Promise<{
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     approvalExemptionStore: import("../plugins/approval-exemption-store.js").ApprovalExemptionStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    checkpointCtxSealing: import("../http/checkpoint-ctx.js").CheckpointCtxSealing | undefined;
     parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
@@ -41,7 +42,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     sessionTitler: import("../session-titler.js").SessionTitler | undefined;
     sharedMemoryStore: import("../plugins/shared-memory-store-sql.js").SqlSharedMemoryStore | undefined;
     sqlWorkflowRunStore: import("@sema-agent/core").WorkflowRunStore | undefined;
-    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate;
+    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate<import("../approval-gate-currency.js").GateCurrencyStore>;
     subRunner: Runner;
     subRunnerSessions: ForkRoutingSessionStore;
     subagentSteerRegistry: import("../orchestration/subagent-steer.js").SubagentSteerRegistry;
@@ -148,5 +149,5 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;
-};
+}>;
 //# sourceMappingURL=stage-06-runners.d.ts.map

package/dist/boot/stage-06-runners.js

@@ -15,7 +15,10 @@ import { buildConsolidationValveAudit, createMemoryConsolidationFaces, createOpe
 import { createPerModelAuthSeat } from "./side-query-lane.js";
 import { createWorkflowOrchestration } from "./workflow-orchestration.js";
 import { createLiveCoordinators } from "./coordinators.js";
+import { assertApprovalAskRuleMaterialOnBackend } from "./stores.js";
 import { createParkCommitWatch } from "../plugins/park-commit-watch.js";
+import { CHECKPOINT_CTX_SEALING_REQUIRED } from "../http/checkpoint-ctx.js";
+import { sealCheckpointCtxCredentialsM28 } from "../checkpoint-ctx-seal-m28.js";
 import { createRuntimeCaps } from "./runtime-caps.js";
 import { createEngineNoticeForwarder, createRunnerDeps, createSharedRunnerDeps } from "./runner-deps.js";
 import { defaultEngineNoticeRouter } from "../trace/engine-notice-wire.js";
@@ -25,17 +28,27 @@ import { createSharedMemoryScopeAuthorizer } from "../shared-memory-scope-author
 import { mountOrgDeliveryGate } from "./org-delivery.js";
 import { parkedAskRedeem, runStore } from "./late-binds.js";
 import { withInternalRunEnvs } from "../internal-run-env.js";
-export function runStage06(ctx) {
+export async function runStage06(ctx) {
     const { backend, backgroundAgentStore, brain, engineDataRoot, config, webAdmin, consolidationValve, deploymentMods, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecordStore, sessionCaptureRecords, sessionPolicyStore, sessionStore, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
     const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, workflowParkDecisions, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
     const parkCommitted = backend?.checkpoint && config.durableApproval ? createParkCommitWatch(backend.checkpoint(logger)) : undefined;
     const checkpointStore = parkCommitted?.store;
     const parkCommits = parkCommitted?.watch;
+    const checkpointCtxSealing = webAdmin.checkpointCtxSealing;
+    if (checkpointStore !== undefined) {
+        if (checkpointCtxSealing === undefined)
+            throw new Error(CHECKPOINT_CTX_SEALING_REQUIRED);
+        const m28 = await sealCheckpointCtxCredentialsM28(checkpointStore, checkpointCtxSealing, { today: new Date().toISOString().slice(0, 10) });
+        logger.info("checkpoint_ctx_credentials_sealed", { ...m28, note: "one-time migration M28: plaintext request credentials in suspended tasks' resume contexts sealed in place" });
+    }
     const { elicitation, question, toolApproval, durableEnabled, streamApprovalGate, approvalAskAudit, approvalExemptionStore, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({
         config, logger, backend, sendUserFileTaskEnvs, ruleConsent, parkCommits,
+        ...(checkpointStore !== undefined ? { checkpointStore } : {}),
         getParkedRedeem: () => parkedAskRedeem,
         ruleScopeRootFor: (sessionId) => cardRuleScopeRoot(sessionId !== undefined ? perSessionCwd.get(sessionId) : undefined, config),
     });
+    if (streamApprovalGate.active)
+        await assertApprovalAskRuleMaterialOnBackend(backend);
     const memoryOptOutGrantStore = backend?.memoryOptOutGrant();
     const { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver, runtimeCapsPeekResolver } = createRuntimeCaps({ config, logger, memoryOptOutGrant: memoryOptOutGrantStore });
     const orgMemoryAdmission = createOrgMemoryAdmissionWiring({ config, logger, metrics });
@@ -213,6 +226,6 @@ export function runStage06(ctx) {
         onError: runnerDeps.onError ? runnerDeps.onError : undefined,
     };
     const subRunner = new Runner(subRunnerDeps);
-    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowParkDecisions, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate };
+    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowParkDecisions, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate };
 }
 //# sourceMappingURL=stage-06-runners.js.map

package/dist/boot/stage-07-capability-layer.d.ts

@@ -29,6 +29,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    checkpointCtxSealing: import("../index.js").CheckpointCtxSealing | undefined;
     parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
@@ -56,7 +57,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     sessionTitler: import("../session-titler.js").SessionTitler | undefined;
     sharedMemoryStore: import("../plugins/shared-memory-store-sql.js").SqlSharedMemoryStore | undefined;
     sqlWorkflowRunStore: import("@sema-agent/core").WorkflowRunStore | undefined;
-    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate;
+    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate<import("../approval-gate-currency.js").GateCurrencyStore>;
     subRunner: import("@sema-agent/core").Runner;
     subRunnerSessions: import("../plugins/fork-routing-session-store.js").ForkRoutingSessionStore;
     subagentSteerRegistry: import("../orchestration/subagent-steer.js").SubagentSteerRegistry;

package/dist/boot/stage-08-reapers.d.ts

@@ -42,6 +42,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    checkpointCtxSealing: import("../index.js").CheckpointCtxSealing | undefined;
     parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
@@ -69,7 +70,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     sessionTitler: import("../session-titler.js").SessionTitler | undefined;
     sharedMemoryStore: import("../plugins/shared-memory-store-sql.js").SqlSharedMemoryStore | undefined;
     sqlWorkflowRunStore: import("@sema-agent/core").WorkflowRunStore | undefined;
-    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate;
+    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate<import("../approval-gate-currency.js").GateCurrencyStore>;
     subRunner: Runner;
     subRunnerSessions: import("../plugins/fork-routing-session-store.js").ForkRoutingSessionStore;
     subagentSteerRegistry: import("../orchestration/subagent-steer.js").SubagentSteerRegistry;

package/dist/boot/stage-09-leader.d.ts

@@ -66,6 +66,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    checkpointCtxSealing: import("../index.js").CheckpointCtxSealing | undefined;
     parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
@@ -93,7 +94,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     sessionTitler: import("../session-titler.js").SessionTitler | undefined;
     sharedMemoryStore: import("../plugins/shared-memory-store-sql.js").SqlSharedMemoryStore | undefined;
     sqlWorkflowRunStore: import("@sema-agent/core").WorkflowRunStore | undefined;
-    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate;
+    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate<import("../approval-gate-currency.js").GateCurrencyStore>;
     subRunner: import("@sema-agent/core").Runner;
     subRunnerSessions: import("../plugins/fork-routing-session-store.js").ForkRoutingSessionStore;
     subagentSteerRegistry: import("../orchestration/subagent-steer.js").SubagentSteerRegistry;

package/dist/boot/stage-09-leader.js

@@ -6,7 +6,7 @@ import { createLeaderFace } from "./leader.js";
 import { assertStaticWiringConsistent } from "../http/routes/diagnostics.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export function runStage09(ctx) {
-    const { approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, config, webAdmin, deviceLane, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryErasure, governanceSeams, localRoot, logger, mailboxRecipientLifecycle, mailboxStore, metrics, pricing, resumeAnchorStore, runStore, runnerDeps, sessionPolicyStore, sessionStore, streamApprovalGate, taskAttachmentStore, spaceReclaimer, taskListLane, toolResultStore, tracer, usageWindowStore, userInputLedgerStore, workflowCompletionInbox } = ctx;
+    const { approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, checkpointCtxSealing, config, webAdmin, deviceLane, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryErasure, governanceSeams, localRoot, logger, mailboxRecipientLifecycle, mailboxStore, metrics, pricing, resumeAnchorStore, runStore, runnerDeps, sessionPolicyStore, sessionStore, streamApprovalGate, taskAttachmentStore, spaceReclaimer, taskListLane, toolResultStore, tracer, usageWindowStore, userInputLedgerStore, workflowCompletionInbox } = ctx;
     const { ownerAware, sessionAudit, sessionWatchRegistry, purgeSession, instrumentDegenerate, planCacheProbe } = createSessionFaces({
         deviceStore: deviceLane?.store,
         dropSessionScoped,
@@ -17,7 +17,7 @@ export function runStage09(ctx) {
         userInputLedgerStore,
         ...(spaceReclaimer !== undefined ? { spaceReclaimer } : {}),
     });
-    const leaderEndpoint = createLeaderFace({ config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, governanceSeams, backend, tracer, usageWindowStore, promptSource: webAdmin.promptSource, onError: runnerDeps.onError });
+    const leaderEndpoint = createLeaderFace({ config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, checkpointCtxSealing, governanceSeams, backend, tracer, usageWindowStore, promptSource: webAdmin.promptSource, onError: runnerDeps.onError });
     const drainState = { draining: false };
     const authBridgeIssuer = authBridgeIssuerOf(config)?.issuer;
     const webAdminJwtVerifier = authBridgeIssuer

package/dist/boot/stage-10-http-server.d.ts

@@ -65,6 +65,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    checkpointCtxSealing: import("../index.js").CheckpointCtxSealing | undefined;
     parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
@@ -92,7 +93,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     sessionTitler: import("../session-titler.js").SessionTitler | undefined;
     sharedMemoryStore: import("../plugins/shared-memory-store-sql.js").SqlSharedMemoryStore | undefined;
     sqlWorkflowRunStore: import("@sema-agent/core").WorkflowRunStore | undefined;
-    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate;
+    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate<import("../approval-gate-currency.js").GateCurrencyStore>;
     subRunner: import("@sema-agent/core").Runner;
     subRunnerSessions: import("../plugins/fork-routing-session-store.js").ForkRoutingSessionStore;
     subagentSteerRegistry: import("../orchestration/subagent-steer.js").SubagentSteerRegistry;

package/dist/boot/stage-10-http-server.js

@@ -29,13 +29,14 @@ import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export async function runStage10(ctx) {
-    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, parkCommits, config, webAdmin, consolidationValve, costQuota, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
+    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, config, webAdmin, consolidationValve, costQuota, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
     const stores = {
         runStore,
         resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
         approvalExemptionStore: approvalExemptionStore ? approvalExemptionStore : undefined,
         approvalNonceStore: approvalNonceStore ? approvalNonceStore : undefined,
         checkpointStore,
+        checkpointCtxSealing,
         sessionPolicyStore: sessionPolicyStore ? sessionPolicyStore : undefined,
         ruleConsent,
         fileHistoryStore: fileHistoryStore ? fileHistoryStore : undefined,

package/dist/boot/stores.d.ts

@@ -13,6 +13,14 @@ export interface OpenStoresCtx {
     metrics: Metrics;
     localRoot: string;
 }
+/**
+ * durable 回决腿的规则位给 `approval_ask` 加了 `rule_command`/`rule_scope_root` 两列,而 `ensureAsk` 的 INSERT 与每一条读**无条件**引用它们 ⇒ 存量表上整条流内审批协议
+ * 静默塌掉(卡不落库、重放面恒空、迟到决议恒 404),而 `/v1/capabilities` 仍报 streamApproval active。判据与恢复动作见 `assertApprovalAskRuleMaterialSchema` 的头注。
+ *
+ * 🔴 **只在协议真会上场时探**(与卡编辑面那道探针同一条纪律),调用方只在 `streamApprovalGate.active` 为真时调本函数 —— 谓词是**协调器装配点那一次求值**的结果(`resolveStreamApprovalGate`),
+ * 不在这里手抄一份,也不在别处再求一遍(手抄的判据会漂,漂的方向要么是拒启误伤、要么是该拒不拒;再求一遍的 park 设施位手上没有那只店)。本函数只做探:有 SQL 池就探,local 后端无池则无事。
+ */
+export declare function assertApprovalAskRuleMaterialOnBackend(backend: StoreBackend | undefined): Promise<void>;
 export declare function openStores(ctx: OpenStoresCtx): Promise<{
     backend: StoreBackend | undefined;
     storePosture: import("../store-posture.js").StorePosture;

package/dist/boot/stores.js

@@ -34,7 +34,6 @@ import { assertApprovalAskRuleMaterialSchema } from "../plugins/approval-ask-sto
 import { assertSchemaMatchesCode } from "../plugins/schema-consistency.js";
 import { assertCheckpointColumnSchema } from "../plugins/checkpoint-store-sql.js";
 import { assertFileHistorySchema } from "../plugins/file-history-store-sql.js";
-import { resolveStreamApprovalGate } from "../tool-approval.js";
 import { buildMemoryBoundaryLaneFacts, buildMemoryWriteBoundaryAudit, effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 import { buildMemoryPosture } from "../memory-posture.js";
 import { establishSqlEnginePosture, sqlPoolsOf } from "../sql-engine-posture.js";
@@ -45,6 +44,14 @@ const DARK_REASON_PROSE = {
     multi_tenant_file_backend: () => "multi-tenant on the FILE backend (no tenant isolation; set MEMORY_ENGINE_BACKEND=pg|tidb to light up)",
     remote_lane_split: (lane) => `remote exec lane "${lane}" (worker/sandbox file planes split; MEMORY_ENGINE_REMOTE_LANE=allow overrides)`,
 };
+export async function assertApprovalAskRuleMaterialOnBackend(backend) {
+    const mysqlPool = backend?.mysqlPool?.();
+    const pgPool = backend?.pgPool?.();
+    if (pgPool)
+        await assertApprovalAskRuleMaterialSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
+    else if (mysqlPool)
+        await assertApprovalAskRuleMaterialSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+}
 export async function openStores(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     let backend;
@@ -83,17 +90,6 @@ export async function openStores(ctx) {
             else if (mysqlPool)
                 await assertPermissionRuleTicketSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
         }
-        if (resolveStreamApprovalGate({
-            toolApprovalEnabled: config.toolApprovalEnabled === true,
-            streamApprovalEnabled: config.streamApproval.enabled,
-            backend,
-            parkFacility: backend?.checkpoint !== undefined && config.durableApproval === true,
-        }).active) {
-            if (pgPool)
-                await assertApprovalAskRuleMaterialSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
-            else if (mysqlPool)
-                await assertApprovalAskRuleMaterialSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
-        }
         if (pgPool)
             await assertFileHistorySchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
         else if (mysqlPool)

package/dist/boot/web-admin.d.ts

@@ -10,6 +10,7 @@ import { type ModelKeyRef } from "../key-resolver.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import { type SealedKeyPublicFace } from "../sealed-key.js";
+import type { CheckpointCtxSealing } from "../http/checkpoint-ctx.js";
 import type { UnpricedCeilingVerdict } from "./unpriced-ceiling-verdict.js";
 import type { ConsolidationSeatWatch } from "./memory-consolidation.js";
 import type { DegradeRouteWatch } from "../brain.js";
@@ -45,6 +46,11 @@ export interface WebAdminRuntime {
      *  三形都建),失败 ⇒ `undefined`(`sealed_key_store_unavailable` 那一行已响亮告警)。店只在 boot 建一次、进程内不换钥匙,
      *  所以这是一个值,不是 getter。唯一读者 = `GET /v1/capabilities` 的 `sealedKey` 段(stage-10 经 deps 交过去)。 */
     readonly sealedKeyPublic: SealedKeyPublicFace | undefined;
+    /** S-1907:**停驻行凭据封签器**(`sealed-key.ts` `ensureCheckpointCtxSealing`:这一域自己的保管店 `<数据根>/sealed-key/checkpoint-ctx-keys/` —— 一个域一对钥匙,
+     *  与模型钥匙那只店不共用;封 = 最新公钥;开 = 按封签上的 id 精确选私钥、只认绑着本行会话的停驻行信封)。present-iff 这一域建店并自检成功(与模型钥匙店各自成败)。
+     *  读者:HTTP 面(`ServiceDeps.checkpointCtxSealing`,stage-10)、leader worker 的续跑上下文(stage-09)与一次性迁移 M28(stage-06);起服第 6 段对
+     *  「checkpoint 店在、它不在」拒启。私钥、保管目录、持有 id 列表照旧够不着(S-737 的结构性那一半不变)。 */
+    readonly checkpointCtxSealing: CheckpointCtxSealing | undefined;
     /** core `CenterPromptSource`(RunnerDeps / subRunner 必须同实例)。 */
     readonly promptSource: CenterPromptSource;
     /** center skills overlay → plugins 消费 → boot LKG 落盘/skill-stale 判定 → mcp 解析。返回新的 skills 表。 */

package/dist/boot/web-admin.js

@@ -20,7 +20,7 @@ import { centerManagedConfigKeys } from "../web-admin-client/apply-effective.js"
 import { createConfigProvider, raceBootFetch, serviceConfigSourceKind, BOOT_FETCH_DEFERRED } from "../config-provider.js";
 import { ConfigDirUntrustedError } from "../config-dir-trust.js";
 import { createKeyResolver } from "../key-resolver.js";
-import { buildSealedKeyPublicFace, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
+import { buildSealedKeyPublicFace, ensureCheckpointCtxSealing, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
 import { applyEffective, applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, mutateInPlace, logEffectiveDiff, applySkillsManifest, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, NO_CENTER_EFFECTIVE, isNoCenterEffective, fetchPromptArtifact } from "../web-admin-client/facade.js";
 import { buildConfigHandoff, buildRestartSignal, configHandoffMissing } from "../fleet/engine-signal.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../web-admin-client/mcp-revocation.js";
@@ -133,9 +133,10 @@ export async function createWebAdminRuntime(ctx) {
         }
         return r;
     };
+    const sealedKeyDir = join(config.localDataRoot ?? localRoot, "sealed-key");
     let sealedKeys;
     try {
-        sealedKeys = await ensureSealedKeyStore(join(config.localDataRoot ?? localRoot, "sealed-key"), logger);
+        sealedKeys = await ensureSealedKeyStore(sealedKeyDir, logger);
         void reportExecutionPublicKey({
             baseUrl: cc?.baseUrl,
             adminToken: process.env[WEB_ADMIN_ENV.adminToken],
@@ -147,6 +148,13 @@ export async function createWebAdminRuntime(ctx) {
     catch (err) {
         logger.warn("sealed_key_store_unavailable", { err: String(err), note: "sealed api keys cannot be unsealed on this host — models carrying sealedApiKey will fail loud per-model" });
     }
+    let checkpointCtxSealing;
+    try {
+        checkpointCtxSealing = await ensureCheckpointCtxSealing(sealedKeyDir, logger);
+    }
+    catch (err) {
+        logger.warn("checkpoint_ctx_sealing_unavailable", { err: err instanceof Error ? err.message : String(err), note: "suspended tasks' request credentials cannot be sealed on this host; with durable approvals on the boot refuses — make <data root>/sealed-key/checkpoint-ctx-keys/ creatable and chmod-able by the service, or repair / remove a key file there whose public and private halves do not belong together" });
+    }
     const configProvider = serviceConfigSourceKind(config) !== undefined
         ? createConfigProvider({
             ...(config.configProvider ? { provider: config.configProvider } : {}),
@@ -705,6 +713,7 @@ export async function createWebAdminRuntime(ctx) {
     return {
         providerKind: configProvider?.kind,
         sealedKeyPublic: sealedKeys === undefined ? undefined : buildSealedKeyPublicFace(sealedKeys),
+        checkpointCtxSealing,
         promptSource,
         takeMcpRevocations: () => {
             mcpRevocationWired = true;

package/dist/budget.js

@@ -2,6 +2,7 @@ import { isModelPriced, modelCostToPricing } from "@sema-agent/core";
 import { currentPrincipal } from "./observability/principal-context.js";
 import { isPermissionRuleEventKind, permissionRuleEventWordOf } from "./observability/permission-rule-events.js";
 import { promptManifestRecordOf, configAssembledRecordOf } from "./observability/prompt-manifest.js";
+import { crossBoundaryTaintEventData } from "./trace/project.js";
 export function buildPricing(models) {
     const pricing = {};
     for (const m of Object.values(models))
@@ -114,7 +115,10 @@ export function createTracer(metrics, costQuota, modelUsage, fleetUsage, fleetLe
         else if (e.kind === "config.assembled") {
             const rec = configAssembledRecordOf(e);
             if (rec)
-                promptManifests?.recordConfig(e.taskId, rec);
+                promptManifests?.recordCompanion(e.taskId, "config_assembled", rec);
+        }
+        else if (e.kind === "permission.cross_boundary_taint") {
+            promptManifests?.recordCompanion(e.taskId, "cross_boundary_taint", crossBoundaryTaintEventData(e));
         }
         else if (e.kind === "compaction.phase_timings") {
             const d = e.durationMs;