@sema-agent/server 7.135.0 → 7.137.0

package/dist/web-admin-client/http-client.js

@@ -3,7 +3,7 @@ import { readEffectiveWire, PrincipalCapsWire } from "@sema-agent/settings-schem
 import { separateRetiredDomains, splitFoldedReadWarnings, withDroppedCatalogEntries } from "./read-warnings.js";
 import { CENTER_PULL_TIMEOUT_MS, centerFetch } from "./center-request.js";
 import { answerStillCurrent } from "../center-credential.js";
-export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
+export async function fetchEffective(center, etag, fetchImpl, worker) {
     const { res, identity } = await centerFetch(center, { kind: "effective", worker }, { etag, timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (res.status === 304)
         return null;
@@ -25,7 +25,7 @@ export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
         ...(retiredDomains.length > 0 ? { retiredDomains: [...retiredDomains] } : {}),
     };
 }
-export async function fetchPrincipalCaps(center, principal, etag, fetchImpl = fetch, worker) {
+export async function fetchPrincipalCaps(center, principal, etag, fetchImpl, worker) {
     const raw = await requestPrincipalView(center, principal, etag, fetchImpl, worker);
     if (raw === null)
         return null;
@@ -99,7 +99,7 @@ async function requestPrincipalView(center, principal, etag, fetchImpl, worker)
     return { json, ...(responseEtag !== null ? { etag: responseEtag } : {}) };
 }
 const PrincipalOrgMemoryEnvelope = PrincipalCapsWire.pick({ principal: true, orgMemory: true });
-export async function fetchPrincipalOrgMemory(center, principal, fetchImpl = fetch, worker) {
+export async function fetchPrincipalOrgMemory(center, principal, fetchImpl, worker) {
     const raw = await requestPrincipalView(center, principal, undefined, fetchImpl, worker);
     if (raw === null)
         throw new Error("web-admin returned 304 to a non-conditional org-directory fetch");
@@ -118,7 +118,7 @@ export class WebAdminHttpError extends Error {
         this.name = "WebAdminHttpError";
     }
 }
-export async function fetchSkillContent(center, contentHash, fetchImpl = fetch) {
+export async function fetchSkillContent(center, contentHash, fetchImpl) {
     const { res } = await centerFetch(center, { kind: "skill-content", contentHash }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
         throw new WebAdminHttpError(`skill content HTTP ${res.status} for ${contentHash}`, res.status);
@@ -129,13 +129,13 @@ export async function fetchSkillContent(center, contentHash, fetchImpl = fetch)
         throw new Error(`skill content hash mismatch for ${contentHash}: computed sha256:${got}`);
     return content;
 }
-export async function fetchPromptArtifact(center, artifactDigest, fetchImpl = fetch) {
+export async function fetchPromptArtifact(center, artifactDigest, fetchImpl) {
     const { res } = await centerFetch(center, { kind: "prompt-artifact", digest: artifactDigest }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
         throw new WebAdminHttpError(`prompt artifact HTTP ${res.status} for ${artifactDigest}`, res.status);
     return await res.json();
 }
-export async function fetchPromptBlob(center, contentDigest, fetchImpl = fetch) {
+export async function fetchPromptBlob(center, contentDigest, fetchImpl) {
     const { res } = await centerFetch(center, { kind: "prompt-blob", digest: contentDigest }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
         throw new WebAdminHttpError(`prompt blob HTTP ${res.status} for ${contentDigest}`, res.status);

package/dist/web-admin-client/types.d.ts

@@ -75,11 +75,11 @@ export interface CenterModel {
      *  the ONLY way to keep per-model tuning that lived in env (`MODEL_FREQUENCY_PENALTY` etc.) — see the
      *  review-gw heterogeneous-roster migration. MUST be static per published version (prompt-cache prefix). */
     extraBody?: Record<string, unknown>;
-    /** registry-core 0.10.13 ([ref]/[ref]⑤c): per-model behavior-slot mitigation sentences, mirrors core
-     *  `Model.promptGuidance` (core 1.303+ assembles them into the volatile tail's per-model position).
-     *  Same category as `extraBody`: logical model metadata, carried verbatim — without this projection the
-     *  configured sentences parse fine in registry-core but never reach the assembly face ([ref]① 排雷:
-     *  the missing leg made every promptGuidance pilot a false control). */
+    /** registry-core 0.10.13 ([ref]/[ref]⑤c): per-model behavior-slot sentences. core 7.56.0 ([ref]) retired the engine seat
+     *  (`Model.promptGuidance`; per-model guidance is now a prompt overlay keyed on the model's declared traits), while the
+     *  settings-schema `ModelEntry` still accepts the key. It is carried here ONLY so the [ref] judge (`judgeCatalogEntry`)
+     *  can see it: a non-empty list refuses the entry (`config.model_entry_invalid`, field `promptGuidance`) instead of the
+     *  sentences being silently dropped; `toModel` never mints it onto a core `Model`. */
     promptGuidance?: string[];
     /**
      * [ref](7.108.0)—— 这条条目发给供应商的**附加请求头**(部署 ↔ 供应商的契约;今天只有 `anthropic-beta`),上 core 的 per-model

package/dist/workspace-space.d.ts

@@ -63,6 +63,33 @@ export interface WorkspaceSpacePolicy {
 export interface WorkspaceSyncCapability extends WorkspaceSpacePolicy {
     timeoutMs: number;
 }
+/** `WORKSPACE_SNAPSHOT_PREFIX` unset ⇒ this prefix (the first segment of every snapshot object key of both lanes). */
+export declare const WORKSPACE_SNAPSHOT_PREFIX_DEFAULT = "kata";
+/**
+ * The ONE form of a snapshot-key segment — the partition (incarnation / session id), the snapshot id, the object name and each segment of
+ * the key prefix all pass it before a key is signed: it starts with a letter or digit, then letters, digits, `.`, `_`, `-`. No `/`, no `..`,
+ * no empty segment, no character a key could be rewritten or traversed by.
+ */
+export declare const SNAPSHOT_KEY_SEGMENT: RegExp;
+/** The refusal code of a `WORKSPACE_SNAPSHOT_PREFIX` outside the closed form (the `config.*` family; fatal-exit prints it). */
+export declare const WORKSPACE_SNAPSHOT_PREFIX_INVALID = "config.workspace_snapshot_prefix_invalid";
+/**
+ * Why a snapshot key prefix is outside the closed form (`undefined` = inside): a prefix is a `/`-separated path of {@link SNAPSHOT_KEY_SEGMENT}s —
+ * one segment (`kata`, the form every release has accepted) or several (`libA/ws`, so one bucket can be partitioned by owner). Answers the
+ * first bad segment (1-based) and why. The ONE judge: the config loader refuses boot with it, the adapter refuses to sign a key with it.
+ */
+export declare function snapshotKeyPrefixProblem(prefix: string): {
+    readonly segment: number;
+    readonly of: number;
+    readonly value: string;
+    readonly why: string;
+} | undefined;
+/**
+ * `WORKSPACE_SNAPSHOT_PREFIX` — the key prefix of both lanes' snapshot objects (`<prefix>/<incarnation>/space/…`, `<prefix>/<sessionId>/…`): a
+ * `/`-separated path of plain segments, one or more (`kata`, `libA/ws`). Unset / empty ⇒ `undefined` (the adapter's default
+ * {@link WORKSPACE_SNAPSHOT_PREFIX_DEFAULT} holds). A bad value refuses boot naming the first bad segment — the value is a path, never a secret, so it is echoed.
+ */
+export declare function parseWorkspaceSnapshotPrefix(raw: string | undefined): string | undefined;
 /** The refusal code of a `WORKSPACE_SNAPSHOT_EXCLUDE` item outside the closed form (the `config.*` family; fatal-exit prints it). */
 export declare const WORKSPACE_SNAPSHOT_EXCLUDE_INVALID = "config.workspace_snapshot_exclude_invalid";
 /**

package/dist/workspace-space.js

@@ -9,6 +9,32 @@ export const WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE = { min: 30_000, max: 3_600_000
 export function workspaceSnapshotTimeoutOf(lane) {
     return lane.workspaceSnapshotTimeoutMs ?? WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT;
 }
+export const WORKSPACE_SNAPSHOT_PREFIX_DEFAULT = "kata";
+export const SNAPSHOT_KEY_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+export const WORKSPACE_SNAPSHOT_PREFIX_INVALID = "config.workspace_snapshot_prefix_invalid";
+export function snapshotKeyPrefixProblem(prefix) {
+    const segments = prefix.split("/");
+    for (const [i, value] of segments.entries()) {
+        if (SNAPSHOT_KEY_SEGMENT.test(value))
+            continue;
+        const why = value === ""
+            ? "empty (a leading, trailing or doubled /)"
+            : value === "." || value === ".."
+                ? "a . / .. segment (it would walk out of its own prefix)"
+                : "not a plain key segment (it must start with a letter or digit and hold only letters, digits, . _ -)";
+        return { segment: i + 1, of: segments.length, value, why };
+    }
+    return undefined;
+}
+export function parseWorkspaceSnapshotPrefix(raw) {
+    if (raw === undefined || raw === "")
+        return undefined;
+    const bad = snapshotKeyPrefixProblem(raw);
+    if (bad === undefined)
+        return raw;
+    throw Object.assign(new Error(`env WORKSPACE_SNAPSHOT_PREFIX: segment #${bad.segment} of ${bad.of} (${JSON.stringify(bad.value)}) is ${bad.why} — the prefix is a "/"-separated path of plain key segments ` +
+        "(each starts with a letter or digit, then letters, digits, . _ -; e.g. WORKSPACE_SNAPSHOT_PREFIX=kata or libA/ws); refusing to start rather than sign snapshot keys under a prefix that does not say what it means"), { code: WORKSPACE_SNAPSHOT_PREFIX_INVALID });
+}
 export const WORKSPACE_SNAPSHOT_EXCLUDE_INVALID = "config.workspace_snapshot_exclude_invalid";
 export function parseWorkspaceSnapshotExclude(raw) {
     if (raw === undefined || raw.trim() === "")

package/docs/DEVICE-EXECUTOR-PROTOCOL.md

@@ -18,8 +18,11 @@ dials the device, so the device needs no inbound port, no public address and no
 
 **Discovery before you connect**: `GET /v1/capabilities` carries a `deviceExecutor` key — either `false`
 (this deployment has no device lane) or an object `{ enabled: true, protocolVersion, maxInflightPerDevice,
-wsPath, management }`. Read `wsPath` from there rather than hardcoding it: the path is part of the wire
-contract and reading it means a future path change is not a cross-repo break. `protocolVersion` tells you
+wsPath, management, relayUrl? }`. Read `wsPath` from there rather than hardcoding it: the path is part of the wire
+contract and reading it means a future path change is not a cross-repo break. `relayUrl` (server 7.137.0+) is present
+only when the operator declared one (`DEVICE_RELAY_URL`): the engine sits behind a relay or gateway and the device
+must dial that absolute `ws://` / `wss://` URL verbatim instead of the engine's own address — do not rebuild it from
+the engine address and `wsPath`. Absent ⇒ dial the engine's own address at `wsPath`, as before. `protocolVersion` tells you
 which protocol **revision** the server speaks before you spend a handshake finding out (§2.1: the revision decides
 which `errorCode` words the server accepts from you).
 
@@ -136,7 +139,8 @@ Ask for a new enrollment token and try again."* Do not retry the same token afte
 
 ### 1.2 Connecting
 
-Open a WebSocket to `wsPath` (`GET`, standard upgrade). The server refuses the upgrade with `404` for any
+Open a WebSocket to `relayUrl` when the capability carries one, otherwise to `wsPath` on the engine's own
+address (`GET`, standard upgrade). The server refuses the upgrade with `404` for any
 other path, and with `503` while the replica is draining or when its pre-auth connection caps are full.
 There is no authentication in the upgrade headers — the handshake happens **inside** the protocol.
 
@@ -336,7 +340,7 @@ base64 inside JSON fields.
 | Constant | Value | Meaning |
 |---|---|---|
 | `DEVICE_WS_PATH` | `/v1/device/ws` | the upgrade path (prefer the `wsPath` from `/v1/capabilities`) |
-| `DEVICE_PROTOCOL_VERSION` | `2` | the protocol revision this server speaks (the highest it accepts) |
+| `DEVICE_PROTOCOL_VERSION` | `3` | the protocol revision this server speaks (the highest it accepts) |
 | `DEVICE_MIN_PROTOCOL_VERSION` | `1` | the lowest revision it accepts; below it (or above the highest), a loud `helloReject` — never a silent downgrade |
 | `DEVICE_HELLO_DOMAIN_TAG` | `sema.device.hello.v1` | the handshake signature domain tag (§1.3) |
 
@@ -365,6 +369,7 @@ the union of the rows up to *N*, and the full set at the current revision is the
 |---|---|
 | `1` | `aborted`, `already_exists`, `auth_failed`, `callback_error`, `invalid`, `is_directory`, `not_directory`, `not_found`, `not_supported`, `outcome_unknown`, `permission_denied`, `precondition_failed`, `shell_unavailable`, `spawn_error`, `suspended`, `target_unavailable`, `timeout`, `transport_lost`, `unknown` |
 | `2` | `liveness_no_output` |
+| `3` | `name_too_long` |
 
 Rules: adding a frame or a field is additive and does not raise the revision; adding a word to a closed set the
 server *accepts from you* (today: the `errorCode` set) raises `DEVICE_PROTOCOL_VERSION` and adds a row here; a
@@ -560,7 +565,7 @@ a moment ago. If you omit `created`, the consumer reports the weaker of the two
 
 `message` is required on the failure arm and is shown to the model — make it specific.
 
-This is the full set at the current revision (`2`); the revision table in §2.1 says which revision each word arrived
+This is the full set at the current revision (`3`); the revision table in §2.1 says which revision each word arrived
 with, and an executor sends only the words of the revision it declared (§1.2).
 
 <!-- closed-set: DEVICE_OUTCOME_ERROR_CODES -->
@@ -574,6 +579,7 @@ with, and an executor sends only the words of the revision it declared (§1.2).
 | `invalid` | the arguments do not make sense for this target (e.g. `readLink` on a non-symlink) |
 | `is_directory` | a file operation hit a directory |
 | `liveness_no_output` | **you** killed the command because it produced no output for your own silence window (a hung command); the wall-clock budget `timeoutMs` running out stays `timeout`. The frame has no field for the window length — do not invent one |
+| `name_too_long` | a component of the path is longer than the filesystem's name limit (`NAME_MAX`, 255 bytes; POSIX `ENAMETOOLONG` for such a component) — no directory can hold that name, so it is read upstream as an absence, like `not_found`. A path that is only too long as a whole while every component is short stays `unknown` (such a file may exist, reached from a directory below it). On an exec instruction it is a protocol violation (use `spawn_error` when the process could not be started) and the server reads it as `unknown` |
 | `not_directory` | a directory operation hit a non-directory |
 | `not_found` | the path does not exist |
 | `not_supported` | you do not implement this face (prefer simply not declaring it) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.135.0",
+  "version": "7.137.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -37,6 +37,7 @@
     "scripts/drain-check.pg.sql",
     "deploy/sema-up",
     "docs/DEVICE-EXECUTOR-PROTOCOL.md",
+    "wire-changes/",
     "USAGE.md",
     "MIGRATION.md"
   ],
@@ -68,8 +69,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.55.0",
-    "@sema-agent/settings-schema": "14.4.0",
+    "@sema-agent/core": "7.56.0",
+    "@sema-agent/settings-schema": "14.5.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",

package/scripts/drain-check-local.mjs

@@ -31,7 +31,7 @@
  *    `dist/orchestration/workflow-agent-session-index.js` 取 —— 本脚本只按 runId 折叠;读不出的行计入 `corrupt`(rc 2:读不出的那一行可能正是点名某张待批卡的那一份);
  *    窗与删码:本判据是一次性迁移 M9 的读侧半场 —— 窗口与删码清单见引擎启动期一次性迁移登记表(one-time-migrations)M9 一行,随 M9 一起删;这里不写第二份窗。
  *  · `parked-tool-lists`(升级到 7.132.0 前)/ `own-tool-lists-rollback`(从 7.132.0 回滚前):停驻行记下的工具名清单 / 7.52 写下的 `ownToolLists`(判据与出路见判据表那两条的注);
- *  · `sealed-credentials-rollback`(从 7.134.0 回滚前):续跑上下文的凭据位上带封签的 pending 行(7.133.x 读不懂封签,续跑时把这些位当没有;判据与出路见判据表那一条的注);
+ *  · `sealed-credentials-rollback`(从 7.134.0 回滚前;从 7.135.0 / 7.136.0 回滚到上一版前同用):续跑上下文的凭据位上带封签的 pending 行(7.133.x 读不懂封签,续跑时把这些位当没有;判据与出路见判据表那一条的注);
  *  · `retired-mode-seed`(换钉 7.113.0 前,core 7.39.0 删掉退役 mode-seed 的一次性迁移):pending 行的 `state.inheritedGate` 仍带退役成员;
  *  · `permissions-allow-list`(换钉 7.117.0 前,本服务把 `settings.permissions.allow` 整份交给引擎的 allow 层):pending 行所在会话的续跑上下文
  *    (`checkpoint-ctx/*.json` 的信封 `{ sessionId, updatedAt, ctx }`)里,`ctx.body.settings.permissions.allow` 是非空数组,且 `ctx.permissionsAllowReading` 不是 `"allow_layer"`
@@ -466,6 +466,7 @@ export const DRAIN_CRITERIA = [
   {
     // 从 7.134.0 回滚到 7.133.x 之前:pending 行所在会话的续跑上下文里,提交体的凭据位(MCP / A2A 请求头与 env、settings.env、settings.webSearch.apiKey、http hook 请求头;7.135.0 起另有 command hook 的插件选项)
     // (从 7.135.0 回滚到 7.134.x 之前同用本判据:7.134.x 不认插件选项上的封签,续跑时那份 hooks 整只不采纳;本判据数任何凭据位上的封签,这一类在候选里)
+    // (从 7.136.0 回滚到 7.135.x 之前同用本判据:7.136.0 起子进程的命令行 —— MCP stdio 传输与 command hook 条目的 command / args —— 也封成封签,带它们的行盖第 3 代,7.135.x 整行拒续跑;这一类在候选里)
     // 上带封签 —— 7.134.0 封好才落盘,7.133.x 读不懂封签、续跑时把这些位当作没有(无凭据照跑、不报错)。出路:回滚前把它们决掉或取消(随包 `MIGRATION.md` 7.134.0 节)。
     // 判据函数是服务里那一只(`sealedCredentialFieldOf`,经编译产物 `dist/http/checkpoint-ctx.js` 取;走法与封口 / 开口 / 一次性迁移同一只),本脚本不写第二份;
     // 命中行点名第一处凭据位(`field=`,键名;值从不出来);读不懂的 ctx 档 / 索引账本行计入 `corrupt`(rc 2)。

package/scripts/drain-check.mysql.sql

@@ -17,7 +17,7 @@
 --   workflow-park-holder    换钉 7.118.0 之前 / 从 7.118.0 回滚到 7.117.x 之前:此刻待批、且子会话被 workflow park 索引点名的卡(workflow 子代卡;见该段注)。
 --   parked-tool-lists       升级到 7.132.0 之前:停驻行记着子代工具天花板 / 冻结的父约束链 / Skill 卡的清单绑定(7.52 在认领前按规范拼写读它们)的**候选**(见该段注)。
 --   own-tool-lists-rollback 从 7.132.0 回滚到 7.131.x 之前:7.132.0 停驻、带 state.ownToolLists 的行(7.131.x 读不了)。
---   sealed-credentials-rollback 从 7.134.0 回滚到 7.133.x(或从 7.135.0 回滚到 7.134.x)之前:停驻、续跑上下文里提交体的凭据位上带封签的行(7.133.x 读不懂封签,续跑时把这些位当没有)的**候选**(见该段注)。
+--   sealed-credentials-rollback 从 7.134.0 回滚到 7.133.x(或从 7.135.0 回滚到 7.134.x、从 7.136.0 回滚到 7.135.x)之前:停驻、续跑上下文里提交体的凭据位上带封签的行(7.133.x 读不懂封签,续跑时把这些位当没有)的**候选**(见该段注)。
 --   permissions-allow-list  换钉 7.117.0 之前:停驻、提交体 settings.permissions.allow 是非空数组且读法记号不是当前的 "allow_layer"(无记号 = 名单时代;"statement" = 表态时代)。
 --   retired-mode-seed       换钉 7.113.0 之前:检查点的 inheritedGate 里仍带退役 mode-seed 成员。
 
@@ -123,6 +123,8 @@ WHERE k.status = 'pending'
 -- JSON 串值恰为这个格式词即数(封签只落在凭据位上;体里别处恰好写着这个词的串值也会被数到 —— 多数,不漏)。本地脚本同名判据走服务里那一只凭据位走法(精确)。
 -- 从 7.135.0 回滚到 7.134.x 之前同用本判据:7.135.0 起 command hook 条目的插件选项(settings.hooks.<事件>[].hooks[].plugin.options)也封成封签,7.134.x 不认这一位,
 -- 续跑时那份 hooks 整只不采纳(其中的守卫不再拦)。本判据数任何凭据位上带封签的行,所以这一类也在候选里(超集)。
+-- 从 7.136.0 回滚到 7.135.x 之前同用本判据:7.136.0 起子进程的命令行(MCP stdio 传输与 command hook 条目的 command / args)也封成封签,带它们的行
+-- 盖第 3 代读法记号,7.135.x 对这样的行整行拒续跑(409 conflict.checkpoint_ctx_unsealable)。这一类同样在候选里(超集)。
 SELECT 'sealed-credentials-rollback' AS criterion, COUNT(*) AS hit_rows,
        COALESCE(GROUP_CONCAT(k.session_id ORDER BY k.created_at_ms DESC SEPARATOR ','), '') AS sessions
 FROM checkpoint k

package/scripts/drain-check.pg.sql

@@ -16,7 +16,7 @@
 --   workflow-park-holder    换钉 7.118.0 之前 / 从 7.118.0 回滚到 7.117.x 之前:此刻待批、且子会话被 workflow park 索引点名的卡(workflow 子代卡;见该段注)。
 --   parked-tool-lists       升级到 7.132.0 之前:停驻行记着子代工具天花板 / 冻结的父约束链 / Skill 卡的清单绑定(7.52 在认领前按规范拼写读它们)的**候选**(见该段注)。
 --   own-tool-lists-rollback 从 7.132.0 回滚到 7.131.x 之前:7.132.0 停驻、带 state.ownToolLists 的行(7.131.x 读不了)。
---   sealed-credentials-rollback 从 7.134.0 回滚到 7.133.x(或从 7.135.0 回滚到 7.134.x)之前:停驻、续跑上下文里提交体的凭据位上带封签的行(7.133.x 读不懂封签,续跑时把这些位当没有)的**候选**(见该段注)。
+--   sealed-credentials-rollback 从 7.134.0 回滚到 7.133.x(或从 7.135.0 回滚到 7.134.x、从 7.136.0 回滚到 7.135.x)之前:停驻、续跑上下文里提交体的凭据位上带封签的行(7.133.x 读不懂封签,续跑时把这些位当没有)的**候选**(见该段注)。
 --   permissions-allow-list  换钉 7.117.0 之前:停驻、提交体 settings.permissions.allow 是非空数组且读法记号不是当前的 "allow_layer"(无记号 = 名单时代;"statement" = 表态时代)。
 --   retired-mode-seed       换钉 7.113.0 之前:检查点的 inheritedGate 里仍带退役 mode-seed 成员。
 
@@ -131,6 +131,8 @@ WHERE k.status = 'pending'
 -- JSON 串值恰为这个格式词即数(封签只落在凭据位上;体里别处恰好写着这个词的串值也会被数到 —— 多数,不漏)。本地脚本同名判据走服务里那一只凭据位走法(精确)。
 -- 从 7.135.0 回滚到 7.134.x 之前同用本判据:7.135.0 起 command hook 条目的插件选项(settings.hooks.<事件>[].hooks[].plugin.options)也封成封签,7.134.x 不认这一位,
 -- 续跑时那份 hooks 整只不采纳(其中的守卫不再拦)。本判据数任何凭据位上带封签的行,所以这一类也在候选里(超集)。
+-- 从 7.136.0 回滚到 7.135.x 之前同用本判据:7.136.0 起子进程的命令行(MCP stdio 传输与 command hook 条目的 command / args)也封成封签,带它们的行
+-- 盖第 3 代读法记号,7.135.x 对这样的行整行拒续跑(409 conflict.checkpoint_ctx_unsealable)。这一类同样在候选里(超集)。
 SELECT 'sealed-credentials-rollback' AS criterion, count(*) AS hit_rows,
        coalesce(string_agg(k.session_id, ',' ORDER BY k.created_at_ms DESC), '') AS sessions
 FROM checkpoint k

package/skills/schedule.md

@@ -13,7 +13,7 @@ Parameters:
 
 - `prompt` (string, required): fully self-contained instructions for the future task. It runs unattended — inline every path, id, and acceptance criterion it needs; never reference "the file we discussed".
 - `schedule` (union, required) — pick the kind by intent:
-  - Recurring: `{ "kind": "cron", "expr": "M H DoM Mon DoW" }` — standard 5-field cron in the user's LOCAL timezone (a 6-field form with leading seconds is also accepted). `"0 9 * * *"` means 9am local; no timezone conversion needed.
+  - Recurring: `{ "kind": "cron", "expr": "M H DoM Mon DoW" }` — standard 5-field cron in the user's LOCAL timezone. There is no seconds field: a 6-field expression is rejected ("its leading seconds field is not supported — the resident scheduler fires on 5-field cron, so one minute is the finest granularity available."), so drop the leading field and retry. `"0 9 * * *"` means 9am local; no timezone conversion needed.
   - One-shot at a wall-clock time: `{ "kind": "at", "atMs": <epoch ms> }`.
   - One-shot after a delay: `{ "kind": "delay", "delaySec": <seconds> }`.
 - `label` (string, optional): short name. Also the dedup key — creating again with the same schedule+label upserts (idempotent), so use a stable label when updating a task instead of piling up duplicates.

package/wire-changes/server@7.104.0.json

@@ -0,0 +1,134 @@
+{
+  "repo": "server",
+  "version": "7.104.0",
+  "from": "v7.103.2",
+  "fromCommit": "ed4de0dbd34447a9f40b3ea8933982e222e845b8",
+  "to": "v7.104.0",
+  "generator": "scripts/wire-changes-server.mjs",
+  "sources": [
+    "docs/ASSISTANT-WIRE-CONTRACT.md#A.1",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#A.1b",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#B.1",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#B.2",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#D.3",
+    "src/trace/wire-projection-faces.ts"
+  ],
+  "added": [
+    {
+      "id": "A1",
+      "source": "capability",
+      "member": "sealedKey",
+      "text": "附录 B.1 能力位新增 `sealedKey`(谓词类 设施依赖)"
+    },
+    {
+      "id": "A2",
+      "source": "engineNotice",
+      "member": "session.records_skipped",
+      "text": "附录 D.3 engine_notice 码新增 `session.records_skipped`(detail `{ dropped, entriesKept, sessionId }` —— `dropped` = 这次回放 core 报的跳过条数;`entriesKept` = 打开成功后数出的幸存条目数(core 的**全部**条目型都算,会话头不算)。两个都是直接观察到的数,**不做算术**(不存在「总数」这个键);`entriesKept === 0` = 会话头在、条目一条没剩(上下文为空,这一轮照跑)。不带路径、行号、坏体形词(那些只进运维日志)。⚠️ **无 `runId`**(铸在会话店的打开函数里;归属看它落在哪条 run 的流 / 账本上))"
+    },
+    {
+      "id": "A3",
+      "source": "errorCode",
+      "member": "config.tool_contract_too_long",
+      "text": "附录 A.1 / A.1b 错误码新增 `config.tool_contract_too_long`(状态码 503)"
+    },
+    {
+      "id": "A4",
+      "source": "errorCode",
+      "member": "config.tool_name_too_long",
+      "text": "附录 A.1 / A.1b 错误码新增 `config.tool_name_too_long`(状态码 503)"
+    },
+    {
+      "id": "A5",
+      "source": "errorCode",
+      "member": "config.tool_roster_bound",
+      "text": "附录 A.1 / A.1b 错误码新增 `config.tool_roster_bound`(状态码 503)"
+    },
+    {
+      "id": "A6",
+      "source": "errorCode",
+      "member": "conflict.session_children_alive",
+      "text": "附录 A.1 / A.1b 错误码新增 `conflict.session_children_alive`(状态码 409)"
+    },
+    {
+      "id": "A7",
+      "source": "errorCode",
+      "member": "corrupt_session",
+      "text": "附录 A.1 / A.1b 错误码新增 `corrupt_session`(状态码 500)"
+    },
+    {
+      "id": "A8",
+      "source": "errorCode",
+      "member": "rewind.capture_disabled",
+      "text": "附录 A.1 / A.1b 错误码新增 `rewind.capture_disabled`(状态码 422)"
+    },
+    {
+      "id": "A9",
+      "source": "errorCode",
+      "member": "rewind.store_unconfigured",
+      "text": "附录 A.1 / A.1b 错误码新增 `rewind.store_unconfigured`(状态码 409)"
+    },
+    {
+      "id": "A10",
+      "source": "wireFace.excluded",
+      "member": "wiring_manifest_operator.fileHistory",
+      "text": "投影面 wiring_manifest_operator 起投 core 键 fileHistory(从 excluded 撤出)"
+    },
+    {
+      "id": "A11",
+      "source": "wireFace.excluded",
+      "member": "wiring_manifest_tenant.fileHistory",
+      "text": "投影面 wiring_manifest_tenant 起投 core 键 fileHistory(从 excluded 撤出)"
+    }
+  ],
+  "registered": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [
+    {
+      "set": "errorCode",
+      "at": [
+        "docs/ASSISTANT-WIRE-CONTRACT.md#A.1",
+        "docs/ASSISTANT-WIRE-CONTRACT.md#A.1b"
+      ],
+      "added": [
+        "config.tool_contract_too_long",
+        "config.tool_name_too_long",
+        "config.tool_roster_bound",
+        "conflict.session_children_alive",
+        "corrupt_session",
+        "rewind.capture_disabled",
+        "rewind.store_unconfigured"
+      ],
+      "registered": [],
+      "removed": [],
+      "breaking": false
+    },
+    {
+      "set": "capability",
+      "at": [
+        "docs/ASSISTANT-WIRE-CONTRACT.md#B.1"
+      ],
+      "added": [
+        "sealedKey"
+      ],
+      "registered": [],
+      "removed": [],
+      "breaking": false
+    },
+    {
+      "set": "engineNotice",
+      "at": [
+        "docs/ASSISTANT-WIRE-CONTRACT.md#D.3"
+      ],
+      "added": [
+        "session.records_skipped"
+      ],
+      "registered": [],
+      "removed": [],
+      "breaking": false
+    }
+  ],
+  "breaking": 0
+}

package/wire-changes/server@7.105.0.json

@@ -0,0 +1,53 @@
+{
+  "repo": "server",
+  "version": "7.105.0",
+  "from": "v7.104.0",
+  "fromCommit": "a99e8fb3006b80f447e1c8bf4874d66b609fb1bb",
+  "to": "v7.105.0",
+  "generator": "scripts/wire-changes-server.mjs",
+  "sources": [
+    "docs/ASSISTANT-WIRE-CONTRACT.md#A.1",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#A.1b",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#B.1",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#B.2",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#D.3",
+    "src/trace/wire-projection-faces.ts"
+  ],
+  "added": [
+    {
+      "id": "A1",
+      "source": "errorCode",
+      "member": "rules.legacy_tool_name",
+      "text": "附录 A.1 / A.1b 错误码新增 `rules.legacy_tool_name`(状态码 400)"
+    }
+  ],
+  "registered": [],
+  "removed": [
+    {
+      "id": "R1",
+      "source": "errorCode",
+      "member": "limit.retention_evicted",
+      "text": "附录 A.1 / A.1b 错误码删除 `limit.retention_evicted`(原状态码 416)"
+    }
+  ],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [
+    {
+      "set": "errorCode",
+      "at": [
+        "docs/ASSISTANT-WIRE-CONTRACT.md#A.1",
+        "docs/ASSISTANT-WIRE-CONTRACT.md#A.1b"
+      ],
+      "added": [
+        "rules.legacy_tool_name"
+      ],
+      "registered": [],
+      "removed": [
+        "limit.retention_evicted"
+      ],
+      "breaking": true
+    }
+  ],
+  "breaking": 1
+}