@sema-agent/server 7.136.0 → 7.137.0

package/dist/observability/fail-open.d.ts

@@ -193,7 +193,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.approvals.durable-row-checkpoint-id-missing": {
         readonly cls: "F";
-        readonly note: "7.133.0(`checkpoint-identity.ts` 的 `durableRowIdentity`;两只店的 `listPending` + `/v1/assistant/inbox` handler):三处 durable 读面(运维队列行 `GET /v1/approvals` 与 `/v1/approvals/stream` 的 `pending` 帧;停驻收件 `GET /v1/assistant/inbox` 的行)读到一行停驻门**没有可用的 `checkpointId`** ⇒ 这一行**照列、`checkpointId` 键缺席**(消费方按「这一行没有可 join 的身份」处理)。detail = `face=<approvals-queue|assistant-inbox> why=<absent|untrusted>`:`absent` = 行上没有这一格(core 5.42.0 之前停驻的老行 —— core 明写不回填);`untrusted` = 在场却没过信任边界(非串 / 空串 / 超长 / 含 resume token —— 数据污染;没过边界的值不上 wire)。放行(列、键缺席)的最坏后果 = 消费方对这一行做不了跨面 join(三面对账少一行)—— 行本身、决断口(`/v1/approvals/:sessionId/decide`,按会话)、到期收割都照常。不放行有两种形:整只拒的代价是一行老 / 坏行打掉整个租户的队列(列表 500、SSE 心跳照常而队列永远停在旧帧);把这一行藏起来的代价更糟 —— 人看不到要批的东西(审批面上的 fail-open,方向反了)。故 F 类;必须留痕(两种成因从此可分)。计数非零 = 有老 / 坏行在飞(列着、没身份);`/stream` 每 3s 一拍重读,同一行每拍计一次(量值 = 行 × 拍数,在场才是信号)。";
+        readonly note: "7.133.0(`checkpoint-identity.ts` 的 `durableRowIdentity`;两只店的 `listPending` + `/v1/assistant/inbox` handler):三处 durable 读面(运维队列行 `GET /v1/approvals` 与 `/v1/approvals/stream` 的 `pending` 帧;停驻收件 `GET /v1/assistant/inbox` 的行)读到一行停驻门**没有可用的 `checkpointId`** ⇒ 这一行**照列、`checkpointId` 键缺席**(消费方按「这一行没有可 join 的身份」处理)。detail = `face=<approvals-queue|assistant-inbox> why=<absent|untrusted>`:`absent` = 行上没有这一格(core 5.42.0 之前停驻的老行 —— core 明写不回填);`untrusted` = 在场却没过信任边界(非串 / 空串 / 超长 / 含 resume token —— 数据污染;没过边界的值不上 wire)。放行(列、键缺席)的最坏后果 = 消费方对这一行做不了跨面 join(三面对账少一行)—— 行本身、决断口(`/v1/approvals/:sessionId/decide`,按会话)、到期收割都照常。不放行有两种形:整只拒的代价是一行老 / 坏行打掉整个租户的队列(列表 500、SSE 心跳照常而队列永远停在旧帧);把这一行藏起来的代价更糟 —— 人看不到要批的东西(审批面上的 fail-open,方向反了)。故 F 类;必须留痕(两种成因从此可分)。计数非零 = 有老 / 坏行在飞(列着、没身份);`/stream` 每 3s 一拍重读,同一行每拍计一次(量值 = 行 × 拍数,在场才是信号)。 7.137.0 起第四面:park 账本行(`GET /v1/runs/:id/events` 的 `suspended` / `needs_review`;唯一构造器 `trace/project.ts` 的 `parkEventData`,写时判一次,detail `face=run-events-park`)—— 暂停因由上的门身份没过信任边界 ⇒ 行照写、`checkpointId` 键缺席(决断方回显不了这道门,退回不带键的决断或从 run 结果取原值;行本身、门、待批调用身份照常)。";
     };
     readonly "server.approvals.queue-row-gate-kind-missing": {
         readonly cls: "F";
@@ -499,6 +499,18 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "k8s 车道工作区空间结束时对**快照对象**的回收(`plugins/remote-env-k8s.ts` `createSpaceReclaimer` 的对象部分;与上一条同一只回收座、两条腿:会话删除协调器与托管留存 sweep):按空间的 `<前缀>/<化身>/space/` 分区(快照 + `latest`)和该会话停驻车道里名字带被结束住客归属记号的 `<前缀>/<会话 id>/*.tar.gz` 分别 LIST、逐个预签 DELETE;LIST 失败、DELETE 失败(HTTP 非 2xx / 非 404、网络)LIST 超过 1000 个对象被截断,或回收座一次调用的绝对截止(= 快照时限;卷回收也在内)到点〔切断在途请求、停掉余下的;这次调用里还没轮到的空间零请求、各记一次;没删的归生命周期规则〕,各记一次(detail `lane=space|park stage=list|delete|budget`;会话删除口把回收座脱离应答路径,座若抛了——契约禁止——记 `stage=seat_threw`)⇒ 这些对象留在桶里,会话照删(不挡删除)。放行的最坏后果 = 一份已无人能读的工作区快照留在桶里(会话已删,经 API 不可达;内容是用户工作区,所以不是「只占盘」—— 留到桶的生命周期规则把它过期掉为止);不碰任何别的空间、不是门不是凭据;反方向(清不掉对象就拒删会话)会让一个对象存储抖动挡住用户的删除权。故 F 类,但必须留痕:静默吞掉之后「这个会话删了、它的工作区内容还在不在桶里」在遥测里没有任何痕迹。同拍一行 `workspace_space_reclaim_failed`(`space` 前缀 / `sessionId` / `lane` / `stage` / `count` / `error`;一次调用里同类〔分区 × 阶段〕的失败合成一行,`count` = 撞上它的空间数,其余键点名调用里排第一的那个,计数仍逐空间;回收座同一时刻最多 4 个空间在收,sweep 与会话删除共用这一只门)。计数非零 = 有对象没回收掉,运维按行里的空间前缀 / 会话 id 去桶里手清,并核对象存储的可达性与 DELETE 权限。回收与同一空间的尚在途的 run 末提交不是互斥的:会话删除时没有活 run(409 挡),但上一条 run 的提交若恰在删除之后才落对象,这批对象不在本次回收射程内(同样归桶的生命周期规则)。停驻分区按会话 id 分区,所以只删名字带被结束住客归属记号的对象(不读任何钟)—— 会话 id 删后被别人重新登记,新住客停驻出的快照带它自己的记号、不碰;不带记号的旧形与 `none` 留给桶的生命周期规则。";
     };
+    readonly "server.sandbox-secret.seat-unverified": {
+        readonly cls: "F";
+        readonly note: "k8s 车道沙箱秘密座的起服核(`boot/execution-env.ts` `ensureSandboxSecretSeat`,第 5 段 await;只在 `K8S_SANDBOX_ENV` 点到了本进程环境里有的键时问):对沙箱命名空间 secrets 的 env 座那一行动词(create —— 适配器为 env Secret 真发的调用)各发一次 SelfSubjectAccessReview,**问不到**(请求失败 / 审查本身被拒 / 答复没有布尔 `status.allowed`)而没有一个动词答「不许」⇒ 照常起服(答了「不许」⇒ 拒启,不走本 tag)。放行的最坏后果 = RBAC 真缺时第一个要建 Secret 的 run 在连接时被拒(`auth_failed`)、它的 pod 被删 —— 名单值仍然只经该 pod 自己的 Secret,不回落成 pod spec 里的明文;不是门不是凭据的放宽,只是把「缺 RBAC」从起服挪到了第一次连接。detail = `namespace=<ns>` + 每个没问到的动词与原因(不带值)。同拍一行 `sandbox_secret_seat_unverified`。计数非零 = 这台部署起服时没能确认 Secret 动词,按 detail 核 API 可达性与该服务账号能不能建 SelfSubjectAccessReview。";
+    };
+    readonly "server.sandbox-pod-reaper.list-failed": {
+        readonly cls: "F";
+        readonly note: "k8s 车道沙箱 Pod 回收器(`plugins/k8s-pod-reaper.ts` `reapOnce`,维护 tick 每副本每 5 分钟一轮)按身份标签列沙箱命名空间的 Pod **失败**(API 不可达 / 403 / 非 2xx)⇒ 这一轮一只都不删、不抛,下一轮一个周期后照常再列。最坏后果 = 已结束的沙箱 Pod 与已终 run 的 Pod(连同它们以 `ownerReferences` 挂着的 Secret —— 部署名单值 / 成员凭据租约)在 etcd 里多留至少一个周期:是**静态数据**多留,不是凭据被用 —— 成员凭据的使用界是代理的租约(到点 destroy,不随回收器);run 收尾的正常删除路不经本腿。不是门 / 凭据的放宽 ⇒ F。计数逐轮一次 + 探针行(`namespace=` + 原因)+ 同拍一行 warn `sandbox_pod_reap_list_failed`;修前只一行 info 轮次行(`listed:false`),不计数、不响。计数持续非零 = 回收器连续列不到 Pod,按原因核 API 可达性与 Role 的 pods `list`。";
+    };
+    readonly "server.sandbox-pod.delete-failed": {
+        readonly cls: "F";
+        readonly note: "k8s 车道**删一只沙箱 pod 却没删成**,两个座一只上报口(`plugins/k8s-pod-delete-failure.ts` `reportPodDeleteFailed`;detail = `namespace=<ns> pod=<名> why=<原因词> cause=<http_<状态>|request_failed>`):①连接清理座(`plugins/remote-env-k8s.ts` `discardRefusedPod`,`why` = `env_secret_unsealed|lease_secret_unsealed|broker_image_pull_failed`):env Secret / 租约 Secret 建不成、或代理镜像拉不下 ⇒ 连接被拒、该 pod 要删,而这一删本身失败(请求抛 / API 回 403、5xx 等非 2xx 非 404)⇒ 拒答不变(仍是原来那一条),pod 与挂在它名下的 Secret(部署名单值 / 租约占位)留在命名空间里,由回收器兜(`plugins/k8s-pod-reaper.ts`:带 run 标签的按 run 终态删,不带的等容器全部结束后删);②回收器座(`plugins/k8s-pod-reaper.ts` `reapOnce` 的删一步,`why` = `reaper_containers_ended|reaper_run_ended_past_hold`):兜底本身删失败 ⇒ 这一只留到下一轮(一个周期后)再判再删,一只失败不挡同轮其余。最坏后果 = **静态数据**多留至少一个回收周期(与 `server.sandbox-pod-reaper.list-failed` 同一件事的另一半):没有值进 pod spec、没有连接被放过、成员凭据的使用界是代理的租约 ⇒ 不是门 / 凭据的放宽 ⇒ F。计数逐次 + 探针行 + 同拍一行 error `sandbox_pod_delete_failed`(pod / 命名空间 / 原因词 / 原因码,不带值、不带 API 文本;运维行座缺席或只有 warn 的座上行不发、计数照记);修前连接清理三处 `.catch(() => {})` 吞,零日志零计数,回收器的删失败只落一行 warn(不计数)。计数持续非零 = 删 pod 的 Role 动词(pods `delete`)或 API 可达性有问题,按 `cause` 核;`why` 以 `reaper_` 起头的计数持续非零 = 兜底本身删不动,残留会随轮次累积。";
+    };
     readonly "server.sandbox-egress.policy-gap": {
         readonly cls: "P-DEBT";
         readonly note: "k8s 车道沙箱出网的起服自检(`plugins/remote-env-k8s.ts` `checkSandboxEgressPolicy` 读节点表与沙箱 ns 的 NetworkPolicy,判法 `sandbox-egress-policy.ts` `sandboxEgressGaps`;起服一次、不挡起服)读出一个缺口 —— 某节点的 InternalIP / ExternalIP 落在一条放行 ipBlock 内(`kind=node_address_open`)、没有策略以 Egress 选中沙箱 pod(`kind=policy_absent`)、pod 保留 IPv6 而策略层担保不了 v6(`kind=ipv6_enabled`)、节点表或策略表读不到(`kind=unreadable what=nodes|networkpolicies`)⇒ 车道**照常起**,每个缺口一行 `sandbox_egress_policy_gap`(带后果句与去哪改)。归 P 类:出网策略是保护面,缺口意味着沙箱里的代码可能够到节点上的服务;归 DEBT 的理由:修法都在集群配置里(节点地址点名、kubelet 放行 v6 sysctl、CNI 的 v6 执行、RBAC),本服务改不了,而拒起车道会让缺省单节点装法(恒有 `ipv6_enabled`)升级即停摆沙箱执行 —— 车道自己的隔离(VM 边界、零 SA token)仍在。放行的最坏后果 = 读出缺口的那一面照旧可达,直到运维按行里的后果句改配置。计数非零 = 这台部署的沙箱出网面有读得出的缺口。读不出的面(宿主 DNAT 发布端口、「pod 所在节点恒放行」的实现差异、CNI 根本不执行策略)不在本 tag 的射程里。";

package/dist/observability/fail-open.js

@@ -174,7 +174,7 @@ export const FAIL_OPEN_TAGS = {
     },
     "server.approvals.durable-row-checkpoint-id-missing": {
         cls: "F",
-        note: "7.133.0(`checkpoint-identity.ts` 的 `durableRowIdentity`;两只店的 `listPending` + `/v1/assistant/inbox` handler):三处 durable 读面(运维队列行 `GET /v1/approvals` 与 `/v1/approvals/stream` 的 `pending` 帧;停驻收件 `GET /v1/assistant/inbox` 的行)读到一行停驻门**没有可用的 `checkpointId`** ⇒ 这一行**照列、`checkpointId` 键缺席**(消费方按「这一行没有可 join 的身份」处理)。detail = `face=<approvals-queue|assistant-inbox> why=<absent|untrusted>`:`absent` = 行上没有这一格(core 5.42.0 之前停驻的老行 —— core 明写不回填);`untrusted` = 在场却没过信任边界(非串 / 空串 / 超长 / 含 resume token —— 数据污染;没过边界的值不上 wire)。放行(列、键缺席)的最坏后果 = 消费方对这一行做不了跨面 join(三面对账少一行)—— 行本身、决断口(`/v1/approvals/:sessionId/decide`,按会话)、到期收割都照常。不放行有两种形:整只拒的代价是一行老 / 坏行打掉整个租户的队列(列表 500、SSE 心跳照常而队列永远停在旧帧);把这一行藏起来的代价更糟 —— 人看不到要批的东西(审批面上的 fail-open,方向反了)。故 F 类;必须留痕(两种成因从此可分)。计数非零 = 有老 / 坏行在飞(列着、没身份);`/stream` 每 3s 一拍重读,同一行每拍计一次(量值 = 行 × 拍数,在场才是信号)。",
+        note: "7.133.0(`checkpoint-identity.ts` 的 `durableRowIdentity`;两只店的 `listPending` + `/v1/assistant/inbox` handler):三处 durable 读面(运维队列行 `GET /v1/approvals` 与 `/v1/approvals/stream` 的 `pending` 帧;停驻收件 `GET /v1/assistant/inbox` 的行)读到一行停驻门**没有可用的 `checkpointId`** ⇒ 这一行**照列、`checkpointId` 键缺席**(消费方按「这一行没有可 join 的身份」处理)。detail = `face=<approvals-queue|assistant-inbox> why=<absent|untrusted>`:`absent` = 行上没有这一格(core 5.42.0 之前停驻的老行 —— core 明写不回填);`untrusted` = 在场却没过信任边界(非串 / 空串 / 超长 / 含 resume token —— 数据污染;没过边界的值不上 wire)。放行(列、键缺席)的最坏后果 = 消费方对这一行做不了跨面 join(三面对账少一行)—— 行本身、决断口(`/v1/approvals/:sessionId/decide`,按会话)、到期收割都照常。不放行有两种形:整只拒的代价是一行老 / 坏行打掉整个租户的队列(列表 500、SSE 心跳照常而队列永远停在旧帧);把这一行藏起来的代价更糟 —— 人看不到要批的东西(审批面上的 fail-open,方向反了)。故 F 类;必须留痕(两种成因从此可分)。计数非零 = 有老 / 坏行在飞(列着、没身份);`/stream` 每 3s 一拍重读,同一行每拍计一次(量值 = 行 × 拍数,在场才是信号)。 7.137.0 起第四面:park 账本行(`GET /v1/runs/:id/events` 的 `suspended` / `needs_review`;唯一构造器 `trace/project.ts` 的 `parkEventData`,写时判一次,detail `face=run-events-park`)—— 暂停因由上的门身份没过信任边界 ⇒ 行照写、`checkpointId` 键缺席(决断方回显不了这道门,退回不带键的决断或从 run 结果取原值;行本身、门、待批调用身份照常)。",
     },
     "server.approvals.queue-row-gate-kind-missing": {
         cls: "F",
@@ -459,6 +459,18 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "k8s 车道工作区空间结束时对**快照对象**的回收(`plugins/remote-env-k8s.ts` `createSpaceReclaimer` 的对象部分;与上一条同一只回收座、两条腿:会话删除协调器与托管留存 sweep):按空间的 `<前缀>/<化身>/space/` 分区(快照 + `latest`)和该会话停驻车道里名字带被结束住客归属记号的 `<前缀>/<会话 id>/*.tar.gz` 分别 LIST、逐个预签 DELETE;LIST 失败、DELETE 失败(HTTP 非 2xx / 非 404、网络)LIST 超过 1000 个对象被截断,或回收座一次调用的绝对截止(= 快照时限;卷回收也在内)到点〔切断在途请求、停掉余下的;这次调用里还没轮到的空间零请求、各记一次;没删的归生命周期规则〕,各记一次(detail `lane=space|park stage=list|delete|budget`;会话删除口把回收座脱离应答路径,座若抛了——契约禁止——记 `stage=seat_threw`)⇒ 这些对象留在桶里,会话照删(不挡删除)。放行的最坏后果 = 一份已无人能读的工作区快照留在桶里(会话已删,经 API 不可达;内容是用户工作区,所以不是「只占盘」—— 留到桶的生命周期规则把它过期掉为止);不碰任何别的空间、不是门不是凭据;反方向(清不掉对象就拒删会话)会让一个对象存储抖动挡住用户的删除权。故 F 类,但必须留痕:静默吞掉之后「这个会话删了、它的工作区内容还在不在桶里」在遥测里没有任何痕迹。同拍一行 `workspace_space_reclaim_failed`(`space` 前缀 / `sessionId` / `lane` / `stage` / `count` / `error`;一次调用里同类〔分区 × 阶段〕的失败合成一行,`count` = 撞上它的空间数,其余键点名调用里排第一的那个,计数仍逐空间;回收座同一时刻最多 4 个空间在收,sweep 与会话删除共用这一只门)。计数非零 = 有对象没回收掉,运维按行里的空间前缀 / 会话 id 去桶里手清,并核对象存储的可达性与 DELETE 权限。回收与同一空间的尚在途的 run 末提交不是互斥的:会话删除时没有活 run(409 挡),但上一条 run 的提交若恰在删除之后才落对象,这批对象不在本次回收射程内(同样归桶的生命周期规则)。停驻分区按会话 id 分区,所以只删名字带被结束住客归属记号的对象(不读任何钟)—— 会话 id 删后被别人重新登记,新住客停驻出的快照带它自己的记号、不碰;不带记号的旧形与 `none` 留给桶的生命周期规则。",
     },
+    "server.sandbox-secret.seat-unverified": {
+        cls: "F",
+        note: "k8s 车道沙箱秘密座的起服核(`boot/execution-env.ts` `ensureSandboxSecretSeat`,第 5 段 await;只在 `K8S_SANDBOX_ENV` 点到了本进程环境里有的键时问):对沙箱命名空间 secrets 的 env 座那一行动词(create —— 适配器为 env Secret 真发的调用)各发一次 SelfSubjectAccessReview,**问不到**(请求失败 / 审查本身被拒 / 答复没有布尔 `status.allowed`)而没有一个动词答「不许」⇒ 照常起服(答了「不许」⇒ 拒启,不走本 tag)。放行的最坏后果 = RBAC 真缺时第一个要建 Secret 的 run 在连接时被拒(`auth_failed`)、它的 pod 被删 —— 名单值仍然只经该 pod 自己的 Secret,不回落成 pod spec 里的明文;不是门不是凭据的放宽,只是把「缺 RBAC」从起服挪到了第一次连接。detail = `namespace=<ns>` + 每个没问到的动词与原因(不带值)。同拍一行 `sandbox_secret_seat_unverified`。计数非零 = 这台部署起服时没能确认 Secret 动词,按 detail 核 API 可达性与该服务账号能不能建 SelfSubjectAccessReview。",
+    },
+    "server.sandbox-pod-reaper.list-failed": {
+        cls: "F",
+        note: "k8s 车道沙箱 Pod 回收器(`plugins/k8s-pod-reaper.ts` `reapOnce`,维护 tick 每副本每 5 分钟一轮)按身份标签列沙箱命名空间的 Pod **失败**(API 不可达 / 403 / 非 2xx)⇒ 这一轮一只都不删、不抛,下一轮一个周期后照常再列。最坏后果 = 已结束的沙箱 Pod 与已终 run 的 Pod(连同它们以 `ownerReferences` 挂着的 Secret —— 部署名单值 / 成员凭据租约)在 etcd 里多留至少一个周期:是**静态数据**多留,不是凭据被用 —— 成员凭据的使用界是代理的租约(到点 destroy,不随回收器);run 收尾的正常删除路不经本腿。不是门 / 凭据的放宽 ⇒ F。计数逐轮一次 + 探针行(`namespace=` + 原因)+ 同拍一行 warn `sandbox_pod_reap_list_failed`;修前只一行 info 轮次行(`listed:false`),不计数、不响。计数持续非零 = 回收器连续列不到 Pod,按原因核 API 可达性与 Role 的 pods `list`。",
+    },
+    "server.sandbox-pod.delete-failed": {
+        cls: "F",
+        note: "k8s 车道**删一只沙箱 pod 却没删成**,两个座一只上报口(`plugins/k8s-pod-delete-failure.ts` `reportPodDeleteFailed`;detail = `namespace=<ns> pod=<名> why=<原因词> cause=<http_<状态>|request_failed>`):①连接清理座(`plugins/remote-env-k8s.ts` `discardRefusedPod`,`why` = `env_secret_unsealed|lease_secret_unsealed|broker_image_pull_failed`):env Secret / 租约 Secret 建不成、或代理镜像拉不下 ⇒ 连接被拒、该 pod 要删,而这一删本身失败(请求抛 / API 回 403、5xx 等非 2xx 非 404)⇒ 拒答不变(仍是原来那一条),pod 与挂在它名下的 Secret(部署名单值 / 租约占位)留在命名空间里,由回收器兜(`plugins/k8s-pod-reaper.ts`:带 run 标签的按 run 终态删,不带的等容器全部结束后删);②回收器座(`plugins/k8s-pod-reaper.ts` `reapOnce` 的删一步,`why` = `reaper_containers_ended|reaper_run_ended_past_hold`):兜底本身删失败 ⇒ 这一只留到下一轮(一个周期后)再判再删,一只失败不挡同轮其余。最坏后果 = **静态数据**多留至少一个回收周期(与 `server.sandbox-pod-reaper.list-failed` 同一件事的另一半):没有值进 pod spec、没有连接被放过、成员凭据的使用界是代理的租约 ⇒ 不是门 / 凭据的放宽 ⇒ F。计数逐次 + 探针行 + 同拍一行 error `sandbox_pod_delete_failed`(pod / 命名空间 / 原因词 / 原因码,不带值、不带 API 文本;运维行座缺席或只有 warn 的座上行不发、计数照记);修前连接清理三处 `.catch(() => {})` 吞,零日志零计数,回收器的删失败只落一行 warn(不计数)。计数持续非零 = 删 pod 的 Role 动词(pods `delete`)或 API 可达性有问题,按 `cause` 核;`why` 以 `reaper_` 起头的计数持续非零 = 兜底本身删不动,残留会随轮次累积。",
+    },
     "server.sandbox-egress.policy-gap": {
         cls: "P-DEBT",
         note: "k8s 车道沙箱出网的起服自检(`plugins/remote-env-k8s.ts` `checkSandboxEgressPolicy` 读节点表与沙箱 ns 的 NetworkPolicy,判法 `sandbox-egress-policy.ts` `sandboxEgressGaps`;起服一次、不挡起服)读出一个缺口 —— 某节点的 InternalIP / ExternalIP 落在一条放行 ipBlock 内(`kind=node_address_open`)、没有策略以 Egress 选中沙箱 pod(`kind=policy_absent`)、pod 保留 IPv6 而策略层担保不了 v6(`kind=ipv6_enabled`)、节点表或策略表读不到(`kind=unreadable what=nodes|networkpolicies`)⇒ 车道**照常起**,每个缺口一行 `sandbox_egress_policy_gap`(带后果句与去哪改)。归 P 类:出网策略是保护面,缺口意味着沙箱里的代码可能够到节点上的服务;归 DEBT 的理由:修法都在集群配置里(节点地址点名、kubelet 放行 v6 sysctl、CNI 的 v6 执行、RBAC),本服务改不了,而拒起车道会让缺省单节点装法(恒有 `ipv6_enabled`)升级即停摆沙箱执行 —— 车道自己的隔离(VM 边界、零 SA token)仍在。放行的最坏后果 = 读出缺口的那一面照旧可达,直到运维按行里的后果句改配置。计数非零 = 这台部署的沙箱出网面有读得出的缺口。读不出的面(宿主 DNAT 发布端口、「pod 所在节点恒放行」的实现差异、CNI 根本不执行策略)不在本 tag 的射程里。",

package/dist/observability/metrics.js

@@ -262,7 +262,6 @@ export function createMetrics() {
     m.counter("resume_anchor_capture_failed", "E18 resume-at per-turn anchor captures that failed (best-effort, run unaffected)");
     m.counter("brain_retry_total", "Brain-layer status events (S4), by phase (rate_limited/retrying/reconnecting/circuit_open/waiting_first_token/recovered/gave_up)");
     m.gauge("store_backend_degraded", "1 when the auto DB probe failed at boot and this replica degraded to in-memory (S5)");
-    m.counter("images_omitted_total", "Tasks whose images will be degraded to text placeholders (no-vision model), by model (S6)");
     m.counter("runs_reaped_total", "Run rows flipped by the background reapers (S7), by kind (stale/suspended/expired_checkpoint)");
     m.counter("checkpoints_reaped_total", "Durable checkpoints expired by the backstop reaper (S7)");
     m.counter("user_input_converged_total", "User-input acceptances (S-928 ledger) converged to crashed by the maintenance tick (the boot pass reports its count on the user_input_ledger_crash_converged warn line instead): steers accepted whose writer process ended before the run settled");
@@ -303,6 +302,7 @@ export function createMetrics() {
     m.counter("remote_env_exec_idle_timeout_total", "Remote-env exec idle timeouts, by provider");
     m.counter("remote_env_file_timeout_total", "Remote-env file-op timeouts, by provider");
     m.counter("remote_env_rpc_timeout_total", "Remote-env RPC timeouts, by provider");
+    m.counter("sandbox_pods_reaped_total", "Sandbox pods deleted by the k8s lane's pod reaper, by reason (containers_ended: every container finished; run_ended_past_hold: the pod's run ended longer ago than the hold)");
     m.counter("task_outcomes_total", "Task outcome-ledger rows recorded, by status and oracle green flag");
     m.counter("workflow_runs_total", "Self-orchestration workflow runs, by status");
     m.histogram("auth_bridge_verify_seconds", "Registry SSO JWT verify latency (hot path sub-ms; cold path includes a JWKS fetch)", [0.001, 0.005, 0.02, 0.1, 0.5, 2, 10]);

package/dist/observability/run-terminal.js

@@ -153,6 +153,7 @@ const RESULT_KEY_TREATMENT = {
     retryAfterMs: "verbatim",
     degraded: "verbatim",
     structuredOutput: "verbatim",
+    resultEntryIds: "verbatim",
     rewindNotes: "redacted",
     haltedOnUserRejection: "verbatim",
     haltedByUser: "verbatim",

package/dist/operator-ask.d.ts

@@ -82,8 +82,8 @@ export declare function requestAlwaysHumanAsk(rule: string, message: string): Op
  * 只加一位、从不放宽)。同步叶保持同步返回;叶抛照抛(fail-closed 的属主仍是叶)。
  *
  * **只收叶**:治理层(`runtime-governance.ts` `applyRuntimeGovernance`)对每一片叶各盖一次,再交 core `combinePolicies` 折**一次**
- * (折叠是最外层,其输出原样交回 —— core 把落选 ask 的类(含本位带出的 `operator_forced`)写进 `foldedAskClasses` 并担保那只对象)。
- * 把一只折叠交给本函数 = 在折叠的输出上展开 —— 那正是 [ref] 修掉的病(7.39.0 起按名拒,响亮、fail-closed,不是静默)。
+ * (折叠是最外层,其输出原样交回 —— core 把落选 ask 的类(含本位带出的 `operator_forced`)记进它铸的认证记录 `attestation.foldedClasses`)。
+ * 把一只折叠交给本函数 = 在折叠的输出上再盖一次出身(只改幸存者自己的类)—— [ref] 收成「逐叶盖、折一次」,治理层只有一个折叠点。
  */
 export declare function createDeploymentAuthoredPolicy(leaf: ToolPolicy): ToolPolicy;
 //# sourceMappingURL=operator-ask.d.ts.map

package/dist/org-delivery-gate.js

@@ -16,7 +16,7 @@ async function shareAnOrg(directory, a, b) {
         return false;
     return Object.keys(la.scopes).some((org) => Object.hasOwn(lb.scopes, org));
 }
-const principalShaped = (s) => s !== "" && principalShapeProblem(s) === undefined;
+const principalShaped = (s) => principalShapeProblem(s) === undefined;
 const fitsInboxKey = (recipient) => mailboxKeyProblem("scope", recipient) === undefined;
 export function createOrgDeliveryGate(deps) {
     const nowMs = deps.nowMs ?? Date.now;

package/dist/org-memory-admission.d.ts

@@ -19,8 +19,8 @@ import type { MemoryScopeAdmission } from "@sema-agent/core";
 /**
  * 单机腿:装载 `MEMORY_ORG_DIRECTORY_JSON`(`Record<principal, Record<orgScope, {write?}>>`)。启动期调用,
  * **fail-loud**——任何非法直接 throw 且消息点名坏在哪个键(响亮拒是正确方向:一张半坏的授权表比拒绝
- * 启动更危险)。principal 键复用 {@link assertPrincipalShape}(拒保留哨兵/超长租户名,与所有其它
- * principal 入口同一道闸);scope 键必须是 `org:` 前缀、值必须是仅含可选 `write: boolean` 的 plain object。
+ * 启动更危险)。principal 键复用 {@link assertPrincipalShape}(拒不是名字的串 / 保留哨兵 / 超长租户名,与所有其它
+ * principal 入口同一道闸;拒句按键在 JSON 文本里的出现序点名,不回显不是名字的键 —— 对象的枚举序会把整数形的键排到最前,不能拿它编号);scope 键必须是 `org:` 前缀、值必须是仅含可选 `write: boolean` 的 plain object。
  */
 export declare function parseOrgDirectoryStatic(json: string): Map<string, Record<string, {
     write?: boolean;

package/dist/org-memory-admission.js

@@ -2,6 +2,37 @@ import { PrincipalOrgMemoryWire } from "@sema-agent/settings-schema";
 import { assertPrincipalShape } from "./security.js";
 const isPlainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 const ORG_SCOPE_RE = /^org:\S+$/;
+function topLevelKeysInTextOrder(json) {
+    const keys = [];
+    let depth = 0;
+    let expectKey = false;
+    for (let i = 0; i < json.length; i++) {
+        const c = json[i];
+        if (c === '"') {
+            let j = i + 1;
+            while (json[j] !== '"')
+                j += json[j] === "\\" ? 2 : 1;
+            if (depth === 1 && expectKey) {
+                const key = JSON.parse(json.slice(i, j + 1));
+                if (typeof key !== "string")
+                    throw new Error("MEMORY_ORG_DIRECTORY_JSON: a top-level key did not decode as a string (scanner out of step with the JSON text)");
+                keys.push(key);
+                expectKey = false;
+            }
+            i = j;
+        }
+        else if (c === "{" || c === "[") {
+            depth++;
+            if (depth === 1)
+                expectKey = c === "{";
+        }
+        else if (c === "}" || c === "]")
+            depth--;
+        else if (c === "," && depth === 1)
+            expectKey = true;
+    }
+    return keys;
+}
 export function parseOrgDirectoryStatic(json) {
     let parsed;
     try {
@@ -14,8 +45,14 @@ export function parseOrgDirectoryStatic(json) {
         throw new Error("MEMORY_ORG_DIRECTORY_JSON must be a JSON object: Record<principal, Record<orgScope, {write?: boolean}>>");
     }
     const table = new Map();
-    for (const [principal, scopesRaw] of Object.entries(parsed)) {
-        assertPrincipalShape(principal);
+    for (const [n, principal] of topLevelKeysInTextOrder(json).entries()) {
+        try {
+            assertPrincipalShape(principal);
+        }
+        catch (e) {
+            throw new Error(`MEMORY_ORG_DIRECTORY_JSON principal key #${n + 1} (in text order): ${e instanceof Error ? e.message : String(e)}`, { cause: e });
+        }
+        const scopesRaw = parsed[principal];
         if (!isPlainObject(scopesRaw)) {
             throw new Error(`MEMORY_ORG_DIRECTORY_JSON[${JSON.stringify(principal)}] must be an object of org scopes`);
         }

package/dist/parked-decide.js

@@ -4,7 +4,7 @@ import { routeWorkflowPark } from "./orchestration/workflow-agent-session-index.
 import { recordFailOpen } from "./observability/fail-open.js";
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
 import { backgroundScopesForCheckpointScope, decodeCheckpointScope, ownerOfCheckpointScope } from "./security.js";
-import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
+import { ASK_USER_QUESTION_TOOL_NAME, isEngineQuestionRow } from "./approval-content-kind.js";
 import { sessionFaceOfHead } from "./session-incarnation.js";
 import { refusalBody, resumeRefusalFacts } from "./http/refusal-body.js";
 export async function findParkOrigin(sources, cp) {
@@ -120,12 +120,13 @@ export function buildParkedResumeOutcome(req) {
     const pa = req.pendingAction;
     const persistedCallId = pa?.kind === "tool_approval" ? (pa.toolCallId ?? "") : "";
     const persistedHash = pa?.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
+    const engineQuestion = isEngineQuestionRow(req.pendingAction);
     return {
         gate: "policy_ask",
         boundCallId: req.binding?.boundCallId ?? persistedCallId,
         boundInputHash: req.binding?.boundInputHash ?? persistedHash,
         decision: req.decision === "approve" ? "allow" : "deny",
-        ...(req.decision === "approve" && req.binding?.updatedInput !== undefined ? { updatedInput: req.binding.updatedInput } : {}),
+        ...(req.decision === "approve" && !engineQuestion && req.binding?.updatedInput !== undefined ? { updatedInput: req.binding.updatedInput } : {}),
         ...(req.binding?.feedback !== undefined ? { feedback: req.binding.feedback } : {}),
         ...(req.answer !== undefined ? { answer: req.answer } : {}),
         ...(req.reason !== undefined ? { reason: req.reason } : {}),

package/dist/peer-directory.js

@@ -85,6 +85,7 @@ export function createPeerDirectory(ctx) {
                     startedAt: Number.isFinite(started) ? started : 0,
                     updatedAt: Number.isFinite(updated) ? updated : 0,
                     liveness: "live",
+                    where: "hosted",
                     ...(tempo !== undefined ? { tempo } : {}),
                     inboundPosture: posture,
                 });
@@ -125,6 +126,7 @@ export function createPeerDirectory(ctx) {
                     startedAt: t.retiredAt,
                     updatedAt: t.retiredAt,
                     liveness: "deleted",
+                    where: "hosted",
                     diedAt: t.retiredAt,
                     inboundPosture: posture,
                 });

package/dist/permission-rule-list.d.ts

@@ -40,7 +40,7 @@ export declare function buildRuleListJudgeOptions(pathBases: PathRuleBases | und
  *  `namespacedCoveringEntries/Hit`。同族分家,差的只是解析器。
  *
  *  ⇒ **规则表的 policy 面现在同源**:两种态度都由 `createPermissionRulePolicy` 的 covering 车道解,底下是
- *  core 的**同一只** `namespacedRuleNameCovers`(协议无关:`mcp__`/`a2a__` 同解;peer 段精确比;工具段 `*`/glob 覆盖)。
+ *  core 的**同一只** `ruleNameCovers`(协议无关:`mcp__`/`a2a__` 同解;peer 段精确比;工具段 `*`/glob 覆盖)。
  *  本仓**不自写第二套 glob** —— 那正是当年分家的成因。
  *
  *  ⚠️ 「同源」的**射程**说准了免得下一个人当成全仓结论(codex 交叉轮 finding-1 追出来的边):
@@ -51,7 +51,7 @@ export declare function buildRuleListJudgeOptions(pathBases: PathRuleBases | und
  *     所以各表收 `mcp__figma__*`(等价、且被推荐)、拒 `mcp__figma`。
  *   · **同源的射程已扩到 operator 名单腿**([ref] 孪生修,[ref]):`createDurableAskPolicy`(`src/approval.ts`)的
  *     deny/neverAuto/require 三集合过去是逐字 `Set.has`,自 core 5.60.1 谓词根导出后改成「精确 ∪ covering」,用的是
- *     **同一只** `namespacedRuleNameCovers`。⇒ env `APPROVAL_*` 腿 / 中心下发 `runtime.approvalRequire` 腿 / 规则表三家
+ *     **同一只** `ruleNameCovers`。⇒ env `APPROVAL_*` 腿 / 中心下发 `runtime.approvalRequire` 腿 / 规则表三家
  *     现在对 covering 拼法的解读逐字一致,`mcp__figma__*` 在哪条腿上都是真判。
  *   · **两段形为什么仍不放开**(理由已换,别再引「approval.ts 还不认」):它一名两义——「整台服务器」与「三段名写漏一段」
  *     在 boot 期不可分辨,所以各条腿一律响亮拒 + 指引给无歧义的 `mcp__figma__*`。放宽是各腿同时变宽的 behavior-facing

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -4,14 +4,27 @@ import { type ExecutionOutcomeRecordWord, type GateOutcome, type Checkpoint, typ
 import { type ParkRowFacts, type RuleOfferProjection, type SkillCardFacts } from "../approval-card.js";
 import { type SqlDialect, type SqlDriver } from "./sql-driver.js";
 import type { SealedCheckpointCtx } from "../http/checkpoint-ctx.js";
-/** M28 店腿的读数(两孪生同形;随 M28 删):扫到的可读行 · 回写成的行 · 回写成的行里被改写的值 · 读不出的行 · 封好之后一行装不下的行。 */
-export interface CtxRowsRewriteM28 {
+/** ctx 行改写店腿的读数(两孪生同形):扫到的可读行 · 回写成的行 · 回写成的行里改写函数报的改动数 · 读不出的行 · 改写之后一行装不下的行。 */
+export interface CtxRowsRewrite {
     readonly scanned: number;
     readonly rewritten: number;
     readonly valuesRewritten: number;
     readonly unreadable: number;
     readonly tooLarge: number;
 }
+/** 一行的改写:交回新的落盘形(只有封口模块的铸点产得出 —— 品牌型)与这一行的改动数;`undefined` = 这一行不写。 */
+export type CtxRowRewrite = (sessionId: string, ctx: object) => {
+    readonly ctx: SealedCheckpointCtx;
+    readonly values: number;
+} | undefined;
+/**
+ * 🔴 **一次性迁移的 ctx 行改写店腿**(两孪生:`SqlCheckpointStore` / `LocalCheckpointStore` 的 `rewriteCtxRows`;逐行判词两孪生同):扫全部 `checkpoint_ctx` 行、
+ * 交给 `rewrite`、交回新体的行原地回写(续跑时钟不动)。店不知道改写是什么 —— 用它的迁移各自带行改写:M28(凭据位明文封好)、M30(退役请求键改写)。
+ * 窗与删法逐条在 `plugins/one-time-migrations.ts` 登记表;登记表里最后一条用它的迁移删码时,本腿、读数型与扫描页一起删。
+ */
+export interface CheckpointCtxRowsRewriter {
+    rewriteCtxRows(rewrite: CtxRowRewrite): Promise<CtxRowsRewrite>;
+}
 export { approvalPayloadFingerprint } from "./approval-payload-fingerprint.js";
 /**
  * [ref] D-1 (§3 invariant #3 — crash-safe reaper backstop): an ABSOLUTE upper bound on a pending
@@ -832,17 +845,14 @@ export declare class SqlCheckpointStore implements CheckpointStore {
     putCtx(sessionId: string, ctx: SealedCheckpointCtx): Promise<void>;
     getCtx<T extends object = object>(sessionId: string): Promise<T | null>;
     /**
-     * 🔴 **一次性迁移 M28 的店腿**(窗与删法见 `plugins/one-time-migrations.ts` 登记表 M28;编排 = `checkpoint-ctx-seal-m28.ts`,行改写 =
-     * `http/checkpoint-ctx.ts` 的 `sealStoredCheckpointCtxM28`;本店不知道「封」是什么,只负责扫与回写):按 `session_id` 键集分页扫 `checkpoint_ctx`
+     * 🔴 **一次性迁移的 ctx 行改写店腿**({@link CheckpointCtxRowsRewriter};用它的迁移与各自的行改写见那里,窗与删法见 `plugins/one-time-migrations.ts` 登记表;
+     * 本店不知道改写是什么,只负责扫与回写):按 `session_id` 键集分页扫 `checkpoint_ctx`
      * (每页 {@link CTX_REWRITE_PAGE} 行,只取会话 id 与 ctx 文本),行体经读腿**同一只**判形({@link decodeCtxColumn})—— 读不出 ⇒ 计数、跳过、不动;
      * `rewrite` 交回新体 ⇒ 经写腿同一只编码与形闸,**按原文 CAS** 回写(MySQL 协议两边 `CAST(… AS BINARY)`,与 M17 / M18 同一条理由:连接排序规则大小写
      * 不敏感;PG `text` 等值)。`updated_at_ms` **不动**(收割按它判,迁移不许延长或缩短一行的寿命)。CAS 打空(扫描与回写之间这一行被续跑腿 / 别的副本写过)
-     * ⇒ 不计、不重试(新写者是本版就已封好;是旧版副本就由之后的起服再扫到)。一行装不下(封签比明文长)⇒ 计 `tooLarge`、那一行留原样,其余照扫。
+     * ⇒ 不计、不重试(新写者是本版写下的、已是新形;是旧版副本就由之后的起服再扫到)。一行装不下(如封签比明文长)⇒ 计 `tooLarge`、那一行留原样,其余照扫。
      */
-    rewriteCtxRowsM28(rewrite: (sessionId: string, ctx: object) => {
-        readonly ctx: SealedCheckpointCtx;
-        readonly values: number;
-    } | undefined): Promise<CtxRowsRewriteM28>;
+    rewriteCtxRows(rewrite: CtxRowRewrite): Promise<CtxRowsRewrite>;
     /**
      * GC ctx rows whose lifecycle is over (bound to the checkpoint, don't leak):
      * a session with NO pending checkpoint, NO active run, AND not touched since `cutoff`.

package/dist/plugins/checkpoint-store-sql.js

@@ -1,7 +1,7 @@
 import { parkedApprovalCard } from "../approval-content-kind.js";
 import { createHash } from "node:crypto";
 import { CHECKPOINT_FACET_SQL, CHECKPOINT_SWEEP_ORDER_SQL, CheckpointIndexRefusedError, judgeCheckpointIndexCells } from "./checkpoint-index-columns.js";
-import { CheckpointError, isGateKind, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendingSteer, winnerFromOutcome, summarizeCheckpoint, MAX_SUPPORTED_CHECKPOINT_VERSION, ExecutionOutcomeConflictError, executionRecordDisposition, executionVerdict, } from "@sema-agent/core";
+import { CheckpointError, isGateKind, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendingSteer, winnerFromOutcome, summarizeCheckpoint, checkpointRevOf, MAX_SUPPORTED_CHECKPOINT_VERSION, ExecutionOutcomeConflictError, executionRecordDisposition, executionVerdict, } from "@sema-agent/core";
 import { redactDeep, redactSecrets } from "../trace/redact.js";
 import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, parkRowCarriesSkillCardFacts, parkRowFacts, readRuleOfferList, skillCardFacts } from "../approval-card.js";
 import { assertJsonColumnWritable, createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, readJsonArrayColumn, readJsonObjectColumn, readNonNullJsonValueColumn, } from "./sql-json-column.js";
@@ -412,7 +412,7 @@ export class SqlCheckpointStore {
                 cells.risk_descriptor === null ? null : this.json(cells.risk_descriptor, "risk descriptor"),
                 ruleOffers === undefined ? null : this.json(ruleOffers, "rule offers"),
                 cells.has_bidi_controls,
-                cp.rev ?? 0,
+                checkpointRevOf(cp),
                 cp.reopenReason ?? null,
                 executionOutcome,
                 executionAtMs,
@@ -738,7 +738,7 @@ export class SqlCheckpointStore {
         const { rows } = await this.db.query(this.q(`SELECT ${jsonColumnText("tidb", "ctx")} FROM checkpoint_ctx WHERE session_id=?`, `SELECT ${jsonColumnText("pg", "ctx")} FROM checkpoint_ctx WHERE session_id=$1`), [sessionId]);
         return rows[0] ? refusing("a resume context nobody can read", () => decodeCtxColumn(rows[0].ctx, `for session ${JSON.stringify(sessionId)}`)) : null;
     }
-    async rewriteCtxRowsM28(rewrite) {
+    async rewriteCtxRows(rewrite) {
         const out = { scanned: 0, rewritten: 0, valuesRewritten: 0, unreadable: 0, tooLarge: 0 };
         let after = "";
         for (;;) {
@@ -748,7 +748,7 @@ export class SqlCheckpointStore {
                 after = sessionId;
                 let ctx;
                 try {
-                    ctx = decodeCtxColumn(row.ctx, `for session ${JSON.stringify(sessionId)} (M28 scan)`);
+                    ctx = decodeCtxColumn(row.ctx, `for session ${JSON.stringify(sessionId)} (ctx row rewrite scan)`);
                 }
                 catch {
                     out.unreadable += 1;
@@ -759,13 +759,13 @@ export class SqlCheckpointStore {
                 if (next === undefined)
                     continue;
                 const text = this.json(next.ctx, "checkpoint ctx");
-                assertJsonColumnWritable(text, createObjectColumnReader(), `checkpoint_ctx.ctx for session ${JSON.stringify(sessionId)} (M28 write)`);
+                assertJsonColumnWritable(text, createObjectColumnReader(), `checkpoint_ctx.ctx for session ${JSON.stringify(sessionId)} (ctx row rewrite)`);
                 let affected;
                 try {
                     ({ affected } = await this.db.query(this.q("UPDATE checkpoint_ctx SET ctx = ? WHERE session_id = ? AND CAST(CAST(ctx AS CHAR) AS BINARY) = CAST(? AS BINARY)", "UPDATE checkpoint_ctx SET ctx = $1::jsonb WHERE session_id = $2 AND ctx::text = $3"), [text, sessionId, String(row.ctx)]));
                 }
                 catch (e) {
-                    const folded = rowTooLargeOrSelf(this.db.dialect, e, `checkpoint_ctx.ctx for session ${JSON.stringify(sessionId)} (M28 write)`);
+                    const folded = rowTooLargeOrSelf(this.db.dialect, e, `checkpoint_ctx.ctx for session ${JSON.stringify(sessionId)} (ctx row rewrite)`);
                     if (!(folded instanceof StoreRowTooLargeError))
                         throw folded;
                     out.tooLarge += 1;

package/dist/plugins/file-history-store-sql.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { captureFileBackupViaEnv, applyFileRestoreViaEnv, fileHistoryModeProvenDifferent, worldStillMatchesMint, boundaryPublishVerdict, fileHistoryDescribeTrackKey, fileHistoryTrackKeyOf, fileHistoryResolveTrackKey, fileHistoryExportDigest, validateFileHistoryExport, resolveFileHistoryRetention, fileHistoryBoundariesToKeep, } from "@sema-agent/core";
+import { captureFileBackupViaEnv, applyFileRestoreViaEnv, fileHistoryModeProvenDifferent, worldStillMatchesMint, annulProofFailure, boundaryPublishVerdict, fileHistoryDescribeTrackKey, fileHistoryTrackKeyOf, fileHistoryResolveTrackKey, fileHistoryExportDigest, validateFileHistoryExport, resolveFileHistoryRetention, fileHistoryBoundariesToKeep, } from "@sema-agent/core";
 import { BlobTooLargeError, SqlBlobBackend } from "./blob-backend.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { isMissingColumnError } from "./sql-errors.js";
@@ -149,15 +149,8 @@ export class SqlFileHistoryStore {
                 const baseAvailable = truthy(t.rows[0].base_available);
                 const mintedBlobHash = v1.rows[0]?.blob_hash != null ? String(v1.rows[0].blob_hash) : null;
                 const proof = await worldStillMatchesMint(verify.env, absPath, root, baseAvailable, mintedBlobHash, verify.signal);
-                if (!proof.unchanged) {
-                    return {
-                        ok: false,
-                        error: {
-                            code: "conflict",
-                            message: `first-touch record for ${absPath} is NOT retractable: ${proof.reason} — the write this retraction compensates for may have changed the file, and deleting the only baseline of a modified file is worse than keeping a stale record`,
-                        },
-                    };
-                }
+                if (proof.verdict !== "unchanged")
+                    return annulProofFailure(proof, absPath);
             }
             const conn = await this.db.connect();
             try {
@@ -441,7 +434,7 @@ export class SqlFileHistoryStore {
                 let targetVersion = boundary.get(t.keyHash);
                 if (targetVersion === undefined) {
                     if (!t.baseAvailable) {
-                        ledger.refused.push({ path: t.trackKey, reason: "base_unavailable" });
+                        ledger.refused.push({ path: t.trackKey, reason: "base_unavailable", class: "base_unavailable" });
                         continue;
                     }
                     targetVersion = 1;
@@ -452,12 +445,12 @@ export class SqlFileHistoryStore {
                     continue;
                 }
                 if (rec.mode !== undefined && !(Number.isInteger(rec.mode) && rec.mode >= 0 && rec.mode <= 0o7777)) {
-                    ledger.refused.push({ path: t.trackKey, reason: `recorded mode ${String(rec.mode)} is not a valid POSIX permission value — refusing to apply a corrupted permission record` });
+                    ledger.failed.push({ path: t.trackKey, reason: `recorded mode ${String(rec.mode)} is not a valid POSIX permission value (store integrity) — refusing to apply a corrupted permission record` });
                     continue;
                 }
                 const resolved = fileHistoryResolveTrackKey(root, t.trackKey, t.keyDesc);
                 if (!resolved.ok) {
-                    ledger.refused.push({ path: t.trackKey, reason: resolved.reason });
+                    ledger.refused.push({ path: t.trackKey, reason: resolved.reason, class: resolved.class });
                     continue;
                 }
                 let applied;
@@ -488,7 +481,7 @@ export class SqlFileHistoryStore {
                 else if (applied.outcome === "identical")
                     ledger.identicalSkipped.push(t.trackKey);
                 else if (applied.outcome === "refused")
-                    ledger.refused.push({ path: t.trackKey, reason: applied.reason });
+                    ledger.refused.push({ path: t.trackKey, reason: applied.reason, class: applied.class });
                 else
                     ledger.failed.push({ path: t.trackKey, reason: applied.reason });
                 if ((applied.outcome === "applied" || applied.outcome === "identical") && applied.modeNotPreserved === true)

package/dist/plugins/file-run-store.js

@@ -9,6 +9,7 @@ import { recordFailOpen } from "../observability/fail-open.js";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, StoreBootRefusalError, buildRunOrphanedError, readLegacyHolderDeathCode } from "./store-contracts.js";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
+import { readRunIdentityCells, runIdentityCells } from "../identity-source.js";
 import { createInProcessSpaceCommitTable, fenceSpaceCommitAtTerminal, SPACE_COMMIT_RECORD_SCHEMA } from "../workspace-space-commit.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 const isParseableDate = (v) => typeof v === "string" && !Number.isNaN(Date.parse(v));
@@ -140,16 +141,19 @@ export class FileRunStore {
         return this.spaceCommits.abandonSpaceCommit(spaceKey, taskId);
     }
     toRow(d) {
+        const { identitySource, identityScope, identityPrincipalInc, ...rest } = d;
         return {
-            ...d,
+            ...rest,
             idemKey: typeof d.idemKey === "string" ? d.idemKey : null,
             idemBodyFingerprint: typeof d.idemBodyFingerprint === "string" ? d.idemBodyFingerprint : null,
+            identity: readRunIdentityCells(identitySource, identityScope, identityPrincipalInc),
             createdAt: new Date(d.createdAt),
             updatedAt: new Date(d.updatedAt),
         };
     }
     toDisk(r) {
-        return { ...r, createdAt: r.createdAt.toISOString(), updatedAt: r.updatedAt.toISOString() };
+        const { identity, ...rest } = r;
+        return { ...rest, ...runIdentityCells(identity), createdAt: r.createdAt.toISOString(), updatedAt: r.updatedAt.toISOString() };
     }
     toRecord(r) {
         return {
@@ -162,6 +166,7 @@ export class FileRunStore {
             errorCode: r.errorCode,
             jobId: r.jobId,
             source: r.source,
+            identity: r.identity,
             instanceId: r.instanceId,
             cancelRequested: r.cancelRequested,
             objectivePreview: r.objectivePreview,
@@ -376,6 +381,7 @@ export class FileRunStore {
                 objectivePreview: meta.objectivePreview ?? null,
                 idemKey,
                 idemBodyFingerprint: meta.idem?.bodyFingerprint ?? null,
+                identity: meta.identity ?? null,
                 createdAt: now,
                 updatedAt: now,
                 cancelRequested: false,

package/dist/plugins/k8s-exec-protocol.d.ts

@@ -1,9 +1,51 @@
 /**
- * The confined, ADDITIVE pod-spec patch ({@link PodSpecPatch}/{@link applyPodSpecPatch}) + the exec-socket TLS
- * shape ({@link execSocketTlsOptions}) + the v4 channel status-frame parse ({@link exitCodeFromStatus}) — the
- * k8s adapter's protocol/patch layer, independent of pod lifecycle. Split out of `remote-env-k8s.ts` ([ref]
- * A13, internal-lossless — `remote-env-k8s.ts` re-exports every symbol below unchanged).
+ * The identity labels every sandbox pod carries — the ONE spelling (RBAC selectors, the reaper's listing and the egress self-check key on
+ * them; a pod-spec patch can add labels, never set or replace one of these).
  */
+export declare const SANDBOX_POD_LABELS: {
+    readonly app: "sema-sandbox";
+    readonly "managed-by": "sema-server";
+};
+/**
+ * The pod's owning run: label key, value = the server run id (the task id) of the TOP-LEVEL run whose env created the pod. Minted only by the
+ * adapter from `K8sEnvConfig.runId` (the per-run binding decides who has one); absent ⇒ the pod names no run, and the reaper removes it only once
+ * its containers have ended. An identity label: a patch can neither set nor replace it.
+ */
+export declare const SANDBOX_RUN_LABEL = "sema.io/run";
+/**
+ * The pod's own reaper hold: annotation key, value = the decimal milliseconds the reaper must wait after the owning run turned terminal before it
+ * removes the pod (`k8s-pod-reaper.ts` `sandboxRunEndHoldMs` of the CREATING replica's data bound). Written once, by the adapter, on every pod that
+ * carries {@link SANDBOX_RUN_LABEL} (the hold is only read for those); the reaper reads this and nothing else — never its own replica's config, so a
+ * rolling change of the snapshot bound never shortens another replica's pod. A pod-spec patch reaches labels only, never annotations.
+ */
+export declare const SANDBOX_RUN_END_HOLD_ANNOTATION = "sema.io/run-end-hold-ms";
+/** The two per-pod Secret seats: `env` = the pod's env Secret (the values `K8S_SANDBOX_ENV` names); `lease` = the member-credential broker's lease Secret. */
+export type SandboxSecretSeatKind = "env" | "lease";
+/**
+ * Per seat, the secrets verbs the adapter sends for it in the sandbox namespace — the ONE table, and each row is exactly that seat's calls:
+ * `env` = `create` (the env Secret, POSTed after its pod, never touched again); `lease` = `create` (the lease Secret) + `patch` (the lease rewrite,
+ * a merge-patch of `broker.json`). Nothing else: the adapter never reads a Secret back (no `get` — which would also let the service account read
+ * every Secret in the namespace) and never deletes one (no `delete`) — each Secret is owned by its pod (`ownerReferences`, `blockOwnerDeletion:
+ * false`), so the cluster's garbage collector removes it with the pod under its own identity. A seat in play asks only its own row: the boot gate
+ * (`K8S_SANDBOX_ENV` non-empty) asks `env`, the member-credential plane judge asks `lease` — an env-only deployment is never asked for `patch`.
+ * Readers: the SelfSubjectAccessReview (`readSandboxSecretSeat`), the refusal sentences that name the Role rule, the plane's off-reason text, the
+ * catalog sentence. `test/k8s-sandbox-secret.test.ts` pins row ≡ calls per seat, both directions.
+ */
+export declare const SANDBOX_SECRET_SEAT_VERBS: {
+    readonly env: readonly ["create"];
+    readonly lease: readonly ["create", "patch"];
+};
+export type SandboxSecretVerb = (typeof SANDBOX_SECRET_SEAT_VERBS)[SandboxSecretSeatKind][number];
+export declare function isLabelValue(v: string): boolean;
+/**
+ * The volume names the adapter itself mints on a sandbox pod — the ONE table (a patch volume / volumeMount must not reuse one: it would collide
+ * with, or mount, the adapter's own volume). Today: the space's build-cache claim and the member-credential broker's lease volume. A volume the
+ * adapter adds later is added HERE, and the patch judge below refuses it with no second guard.
+ */
+export declare const ADAPTER_VOLUME_NAMES: {
+    readonly cache: "ws-cache";
+    readonly brokerLease: "sema-broker-lease";
+};
 /**
  * The confined, ADDITIVE pod-spec patch. Every field is purely additive —
  * none can override the hard isolation invariants. This is the seam the RSI L8 immutable-mount probe + the
@@ -22,19 +64,32 @@ export interface PodSpecPatch {
     /** Extra labels merged into metadata.labels (e.g. a grader/probe tag). */
     labels?: Record<string, string>;
 }
-/**
- * Apply a {@link PodSpecPatch} to a sandbox pod object IN PLACE — purely ADDITIVE. Volumes + volumeMounts are
- * APPENDED (never replaced); securityContext objects are shallow-MERGED onto any existing; labels are merged. It
- * deliberately touches ONLY spec.volumes / spec.securityContext / containers[0].{volumeMounts,securityContext} /
- * metadata.labels — so the hard isolation invariants (runtimeClassName, automountServiceAccountToken,
- * restartPolicy, activeDeadlineSeconds, image, command) are preserved by construction. Pure + exported for testing.
- */
-export declare function applyPodSpecPatch(pod: {
+type SandboxPodShape = {
     metadata: {
         labels?: Record<string, string>;
     };
     spec: Record<string, unknown>;
-}, patch: PodSpecPatch): void;
+};
+/** Which pod a patch lands on: one that carries the broker container or not. */
+export interface PodPatchPresence {
+    readonly broker: boolean;
+}
+/**
+ * Apply a {@link PodSpecPatch} to a sandbox pod object IN PLACE — purely ADDITIVE, through the one field table
+ * ({@link POD_SPEC_PATCH_FIELDS}): a key outside the table is refused; EVERY present field is judged before ANY lands (a refusal leaves the pod
+ * byte-identical). Volumes + volumeMounts are APPENDED (never replaced); securityContext objects are shallow-MERGED onto any existing; labels are
+ * merged under the identity keys. It touches ONLY spec.volumes / spec.securityContext / containers[0].{volumeMounts,securityContext} /
+ * metadata.labels — so the hard isolation invariants (runtimeClassName, automountServiceAccountToken, restartPolicy, activeDeadlineSeconds, image,
+ * command) are preserved by construction. Throws (the caller surfaces it as a provisioning failure). Pure + exported for testing.
+ * `presence.broker` ⇒ the table's broker column judges first (see {@link POD_SPEC_PATCH_FIELDS}).
+ */
+export declare function applyPodSpecPatch(pod: SandboxPodShape, patch: PodSpecPatch, presence?: PodPatchPresence): void;
+/**
+ * The patch judge alone — the same one {@link applyPodSpecPatch} runs — for a pod that carries the broker: the refusal sentence, or `undefined`
+ * when the patch may land. The boot reads it on the deployment's static patch (a refusal turns the member-credential plane off,
+ * `pod_patch_reaches_broker`); the adapter runs it again on every pod it builds with the broker.
+ */
+export declare function podSpecPatchBrokerRefusal(patch: PodSpecPatch | undefined): string | undefined;
 /**
  * TLS options for the exec WebSocket, shaped for BOTH runtimes (2026-06-11 in-cluster drill finding):
  * Bun's `ws` shim IGNORES node-ws's top-level `ca`/`rejectUnauthorized` (handshake fails against a
@@ -50,4 +105,5 @@ export declare function exitCodeFromStatus(statusJson: string): {
 } | {
     error: string;
 };
+export {};
 //# sourceMappingURL=k8s-exec-protocol.d.ts.map